1. Who we are

FakturaKlar provides invoicing and estimating software to businesses ("Admins") operating in Sweden, Norway, and the wider EU/EEA. This policy explains how we process personal data in accordance with the General Data Protection Regulation (GDPR).

cloudblocks AB is identified below because, depending on the type of data, we act either as the data controller or as a data processor, see Section 3 for exactly which role applies to which data.

Legal name: cloudblocks AB
Organisationsnummer: 559520-4370
Registered address: Lindekullegatan 41B, 441 65 Alingsås, Sweden
Contact email: info@fakturaklar.com

2. What we collect

Account data: name, email address, phone number, password (hashed), and company/legal details you provide during onboarding.
Customer data: the names, addresses, emails, phone numbers, and (for business customers) organization numbers you enter about your own customers.
Document data: the invoices and quotes you create, including line items, amounts, and tax rates.
Usage data: log data such as IP address and timestamps, used for security and abuse prevention.

3. Our role: controller and processor

Your relationship with us is not the same for every category of data above. GDPR requires us to be specific about this, so:

We are the data controller for your Account data and Usage data, that is, data about you as an Admin and about how your account is used. We decide why and how this data is processed (see Section 4).
We are a data processor for your Customer data and Document data, that is, the data about your own customers, and the invoices and quotes you create. You (the Admin) are the data controller for this data. We only process it on your instructions, as configured through your use of the application, and as needed to provide the Service to you.

What this means for you as an Admin: because you are the controller of your customers' personal data, it is your responsibility, not ours, to have a lawful basis under GDPR for collecting and holding that data (for example, a contract with your customer, or their consent), and to give your own customers a privacy notice explaining how you use their data. FakturaKlar does not provide that notice to your customers on your behalf.

Our obligations to you as a processor, including confidentiality, security, sub-processors, and what happens to your data if you close your account, are set out in our Data Processing Agreement (DPA), which is incorporated into our Terms of Service and which you accept when you sign up.

4. Why we process data, and our legal basis

For the data we control (Account data and Usage data), our legal basis under GDPR Article 6 is:

Providing the Service and billing you, performance of a contract (Art. 6(1)(b)).
Retaining accounting records, legal obligation (Art. 6(1)(c)), under the Swedish Bokföringslagen (Book-keeping Act).
Security, fraud, and abuse prevention, legitimate interests (Art. 6(1)(f)).
Email and phone verification, performance of a contract (Art. 6(1)(b)).

For Customer data and Document data, we do not independently determine a legal basis, as processor, we act on your instructions as controller, and it is your responsibility to have a lawful basis of your own (see Section 3).

5. How long we keep data

Accounting records (invoices, quotes, and related billing records) are retained for seven (7) years after the end of the calendar year in which the relevant financial year ended, as required by Bokföringslagen (7 kap.), this applies even after you delete your account, and we cannot shorten it on request.
All other personal data (account data, customer data not subject to the accounting-retention rule above, and usage logs) is not deleted automatically. We keep it for as long as your account exists so you can keep using and retrieving it, and delete it within 30 days once you submit a verified account deletion request from Settings.
Inactive or unpaid accounts: we do not automatically suspend access to, or delete data from, an account for being inactive or falling into non-payment. Data is retained the same as for any active account, and is only removed when you submit a deletion request yourself.

6. Your rights

Under the GDPR you have the right to access, correct, export, or request deletion of your personal data, and to object to or restrict certain processing. To exercise these rights, use the relevant controls in your account Settings or contact us using the details in Section 1 above.

On data portability specifically: you can export your invoices as a CSV file from the Invoices page at any time, and you can download a full export of everything stored under your account, customers, invoices, quotes, credit notes, payments, products, and tax rates, as CSV files, from Settings → Data & Privacy.

If you are a customer of one of our Admins (not an Admin yourself) and want to exercise your rights over data an Admin holds about you, please contact that Admin directly, they are the data controller for that data, as explained in Section 3. We will assist the Admin in responding to you, as required by our Data Processing Agreement with them.

If you believe we have not handled your personal data in accordance with the law, you have the right to lodge a complaint with the Swedish supervisory authority, the Integritetsskyddsmyndigheten (IMY), in Sweden.

7. Sharing & sub-processors

We share data with service providers strictly as needed to operate FakturaKlar, for example, email delivery providers (to send your invoices/quotes), payment processors (to manage subscriptions), and hosting providers. We do not sell personal data. The current list of sub-processors, and the safeguards we require of them, is set out in our Data Processing Agreement.

8. International transfers

Where data is processed outside the EU/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses.

9. Security

Here is what is actually true today about how we protect your data:

Passwords are never stored in plain text, they are hashed using bcrypt before being saved.
Workspace isolation: each Admin's customers, invoices, and quotes are isolated from other Admins at the application level, every database query for this data is automatically filtered to the requesting Admin's own account, so other Admins cannot see or access your data. This is enforced in our application code, not by using a separate database per Admin.
Hosting: the application and its database are hosted with a provider located within the EU.

The following are not yet finalised, and we are not going to claim otherwise:

[TODO: cloudblocks AB to confirm that HTTPS/TLS is enforced for all traffic to fakturaklar.com in production, e.g. at the web server or hosting provider level, and to confirm HTTP Strict Transport Security (HSTS) will be enabled once TLS is confirmed live.]
[TODO: cloudblocks AB to confirm whether database backups are taken, how often, and where they are stored, no backup mechanism currently exists in the application itself, so this depends on whatever the hosting/database provider is configured to do.]

10. Cookies

We use two kinds of cookies: cookies that are strictly necessary to run the Service, and optional analytics cookies that are only set with your consent.

Strictly necessary and functional cookies (always active, no consent required under EU ePrivacy rules):

Session cookie, keeps you signed in and secures your session.
CSRF protection cookie, protects the application against cross-site request forgery.
"Remember me" cookie, only set if you tick "Remember me" when logging in, so you stay signed in between visits.
Language cookie, remembers your chosen language on our public website for one year.
Cookie consent choice, stored in your browser's local storage, remembers whether you accepted or declined analytics cookies so we don't ask again on every visit.

Optional analytics cookies (only set if you click "Accept all" in the cookie banner):

Google Analytics (_ga, _ga_*), helps us understand aggregate visitor traffic to our public website (e.g. which pages are visited), so we can improve it. IP addresses are anonymized. Google Analytics is not loaded, and no such cookie is set, unless you accept analytics cookies.

We do not use advertising or third-party tracking/retargeting cookies of any kind. You can change or withdraw your analytics consent at any time using the "Cookie settings" link in the footer of our website, which will show the consent banner again.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by email to your account's registered address, and show a notice the next time you log in, before the changes take effect.

12. Contact

For privacy questions or to exercise your rights, please use the details in Section 1 above.