🔒 Privacy Policy

1. Responsible Party

Facilo
Berlin, Germany
Email: hello@facilo.xyz

2. Data We Collect

We collect and process the following personal data:

• Account data: Name, email address, phone number (optional), and hashed password
• Usage data: Login timestamps, IP addresses, and user-agent strings for security auditing
• Business data: Customer information, property addresses, job details, and invoice records you enter
• API key metadata: Key names, scopes, and usage timestamps

3. Purpose of Processing

We process your data to:

• Provide the facility management and fleet service portal
• Authenticate users and secure access to the platform
• Generate invoices and track payments
• Maintain audit logs for security and compliance
• Improve our service quality

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest for security).

4. Data Retention

• Account data: Retained until account deletion
• Audit logs: Retained for 24 months, then anonymized
• Business records (invoices, jobs): Retained for 10 years per German tax law (§147 AO)
• API keys: Active until revoked by user

5. Your Rights

Under GDPR, you have the right to:

• Access your personal data (Export your data)
• Rectify inaccurate data (via Settings)
• Delete your data — right to be forgotten (Settings → Account → Delete Account)
• Restrict or object to processing
• Data portability (download your data in JSON format)

6. Data Security

We implement:

• Encryption in transit (HTTPS/TLS)
• Passwords hashed with industry-standard algorithms
• API keys stored as SHA-256 hashes
• Multi-partner data isolation via database-level row security
• Two-factor authentication support
• Structured audit logging

7. Cookies

We use only essential cookies:

• Session cookie: Required for authentication (expires on logout)
• Language preference: Stores your preferred language (EN/DE)
• CSRF token: Security cookie to prevent cross-site request forgery

No tracking, analytics, or advertising cookies are used.

8. Third-Party Services

• Stripe: Payment processing (only if you subscribe to a paid plan). See Stripe's Privacy Policy
• Google Fonts: We serve fonts locally; no data is sent to Google

9. Contact

For privacy inquiries or to exercise your rights, contact:
Email: hello@facilo.xyz

You also have the right to lodge a complaint with a supervisory authority (Berliner Beauftragte für Datenschutz und Informationsfreiheit).