FatturaSmart Privacy Policy

Introduction

Fraway S.r.l. a socio unico ("we", "our") is committed to protecting the privacy of its users ("User", "your"). This Privacy Policy describes how we collect, use and protect the personal data of users of our "FatturaSmart" service.

1. Data Controller

The data controller is Fraway S.r.l. a socio unico, with registered office at Via Fiume Giallo, 275 - 00144, Rome, and email: info@fatturasmart.com.

2. Types of Data Collected

Personal Data provided by the User:
- Business name
- Email address
- Contact information
- Company data (company name, VAT number, address, tax code)
- Billing and payment data
Navigation Data:
- IP address
- Connection data
- Cookies and similar technologies
- Server logs

3. Purpose of Processing

Personal data is collected and processed for the following purposes:

3.1. Service Provision: to enable registration, access and use of FatturaSmart, including the creation and sending of electronic invoices through SDI.
3.2. Legal Compliance: to comply with legal obligations, regulations or national and community regulatory provisions.
3.3. Communications: to send service-related notifications, updates, maintenance and changes to Terms and Conditions.
3.4. Customer Support: to provide technical assistance and respond to user requests or questions. Support may involve access, by authorized personnel, to the data in the User's account (invoices, client records, settings) to the extent strictly necessary to handle the request.
3.5. Service Improvement: to analyze service usage and improve the features offered.
3.6. Statistical Analysis: to analyze user behavior and most visited pages through tools like Google Analytics.

4. Data Recipients and Third-Party Services

Personal data may be shared with third parties involved in providing the service:

Lemon Squeezy (Link, LLC, a Stripe company, USA): merchant of record for subscription payment and invoicing; it processes the User's billing data as an independent controller. Transfer to the USA based on the EU-US Data Privacy Framework and standard contractual clauses.
Google Analytics: traffic and usage analytics.
Meta Platforms (WhatsApp Business): customer support via WhatsApp, where the User chooses to contact us through that channel.
Artificial intelligence service providers (Google Gemini, Anthropic Claude, OpenRouter): for AI-based service features (e.g. automatic document classification, document scanning, bank reconciliation, insights), limited to the data strictly necessary for the requested feature. For bank reconciliation, counterparty names and transaction descriptions are pseudonymised (replaced with tokens) before being sent to the provider.
Google Firebase Cloud Messaging: for delivering push notifications on the mobile applications.
Hetzner Online GmbH: hosting of the application, database, documents and backups, within the European Union.
Amazon Web Services EMEA SARL (Amazon SES): sending transactional emails (login, notifications, delivery of documents and reminders to the User's clients).
Functional Software, Inc. (Sentry, EU data region): error and performance monitoring for the web application and the server. Error reports, traces of a sample of requests and, for the web application, session recordings only on errors are sent, with text, input fields and media masked; request content, cookies, URL parameters, user identifiers and the profile name are not sent. The data is stored in the European Union; any access from third countries is covered by standard contractual clauses.
Mapbox, Inc.: autocompletion of addresses entered in the application.
Openapi S.p.A. Unipersonale (company subject to the direction and coordination of Open Holding S.r.l.): lookup of company data in public registers when entering client records.

Google Analytics is enabled only with your consent. For details see our Cookie Policy, which lists the cookies and explains how to manage your preferences.

Data is also accessible to duly authorized and trained Fraway S.r.l. personnel. Personal data will not be disclosed or sold to third parties for commercial purposes.

5. International Data Transfers

Personal data may be transferred outside the European Economic Area in connection with the services listed above (in particular Google Analytics, WhatsApp, Google Firebase Cloud Messaging, Mapbox and the artificial intelligence service providers). In such cases, transfers are carried out in accordance with Articles 44 et seq. of the GDPR, on the basis of adequacy decisions (such as the EU-US Data Privacy Framework) or standard contractual clauses. The list of sub-processors that process data on the User's behalf, with the relevant transfer safeguards, is set out in section 7 of the Data Processing Agreement.

6. Data Processed on Behalf of the User

Data that the User enters into the service relating to third parties (client records, invoice recipients, for healthcare professionals patients and, for Users who activate the employee management module, employees and collaborators) is processed by Fraway S.r.l. as a data processor pursuant to Art. 28 GDPR, on behalf of and under the instructions of the User, who remains the data controller. On the User's instruction, such data may be transmitted to recipients designated by the User (for example their payroll consultant). Such processing is governed by the Data Processing Agreement (DPA) and its annexes, which form an integral part of the Terms and Conditions.

7. Mobile Applications

This privacy policy also applies to the Fattura Smart mobile applications for Android and iOS. In particular:

Push notifications: notifications are delivered via Google Firebase Cloud Messaging; for this purpose we process a device token. For account-related notifications (e.g. SDI transmission outcomes, received invoices) Fraway S.r.l. acts as data controller, on the basis of contract performance; for notifications addressed to Users' employees, Fraway S.r.l. acts as data processor on behalf of the employer.
Punch-time geolocation: where the employer has enabled the relevant feature of the employee management module, location is captured exclusively at the moment of clocking in or out (no continuous or background tracking) and is processed on behalf of the employer, as set out in the Data Processing Agreement.
Camera: used on-device to scan QR codes and to photograph receipts and documents the user chooses to upload.
No advertising or analytics SDKs: the mobile applications do not embed any third-party advertising, profiling or analytics SDKs.

7-bis. Personal Data Breaches

In the event of a personal data breach, we notify the Italian data protection authority (Garante per la Protezione dei Dati Personali) without undue delay and, where feasible, within 72 hours of becoming aware of it, where required by Article 33 GDPR; we inform the data subjects where the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR). For data processed on the User's behalf, we inform the User without undue delay, as provided for in the Data Processing Agreement.

8. Contact

For any questions regarding this Privacy Policy, you can contact us at: info@fatturasmart.com

Last updated: 24 September 2026