Privacy policy
What data Fiscalm processes, why, who it is shared with, how long it is kept and how to exercise your rights.
Who is the controller
Fiscalm is a service of ATIEMPO.ME SL, Spanish tax ID (NIF) B56542111 (“Fiscalm”, “we”). Privacy contact: hola@fiscalm.app.
Fiscalm helps freelancers, companies and accounting firms in Spain keep invoices, bank statements and tax obligations in order. This policy explains how we process personal data on the fiscalm.app website, in the app and in the connections a user switches on. The Spanish version is the binding one.
Two different roles
- Account and service data (who you are, how you sign in, what you do on the platform): Fiscalm is the controller.
- Data a company or accounting firm uploads or connects (invoices, payslips, bank transactions, emails with invoices): the client company (or the firm serving it) is the controller and Fiscalm is its processor under Article 28 GDPR, on the terms set out in the Terms of use.
What data we process
- Account: name, email, language, role, passkey public keys (never your fingerprint or face, which never leave your device), active sessions and last sign-in.
- Security log: sign-ins, sign-outs, denied access, downloads and connection changes. IP addresses are stored only as a keyed hash, never in clear.
- Company: legal name, tax ID, activity, IAE code and tax profile.
- Documents: invoices, receipts, payslips and other files uploaded or received by email. They may contain data about third parties (customers, suppliers, employees).
- Bank (read-only): account holder, IBAN, balances and transactions of the accounts the company connects or whose statements it uploads. Fiscalm cannot make payments or transfers.
- Connections: access tokens for Gmail, Zoho Invoice, Wise or the bank, and the AEAT e-certificate if the company adds it. Stored encrypted.
- Communications: notices by email and, if you switch it on, by Telegram (chat ID).
- Founders forum: what you post and attach.
- Website waitlist: name, email and form answers.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service: account, documents, bank reconciliation, tax calendar, draft returns | Contract (Art. 6(1)(b) GDPR) |
| Security: access control, logging, abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Service notices (deadlines, missing documents, pending statements) | Contract |
| Waitlist and launch news | Consent (Art. 6(1)(a)) |
| Public website analytics (Google Analytics 4) | Consent, only if you accept it in the cookie notice |
| ATIEMPO.ME SL’s own accounting and tax obligations | Legal obligation (Art. 6(1)(c)) |
Bank connection
Bank accounts are read through Enable Banking Oy (Finland), an account information service provider authorised under the PSD2 Directive. You give consent on your own bank’s website; Fiscalm never sees or stores your bank credentials. Access lasts at most 180 days and you can withdraw it at any time in “Access” or at your bank. Wise is connected with a read-only token the company creates itself.
Gmail and Google
If you connect Gmail, Fiscalm only reads emails that contain invoices and their attachments, to add them to your documents. It does not send or delete email and does not use its content for advertising. Fiscalm’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Artificial intelligence
We use the Anthropic API (Claude model) to read and classify documents. Under its commercial terms, Anthropic does not use data sent through the API to train its models. The AI suggests; amounts, drafts and returns are reviewed by the company or its accountant. We take no decisions with legal effects based solely on automated processing.
Who we share data with
Only with providers we need to run the service, under processing agreements and GDPR safeguards:
| Provider | Purpose | Location |
|---|---|---|
| Virtual server provider | Hosting the app, database and files | EU (France) |
| Enable Banking Oy | Reading bank accounts (PSD2) | EU (Finland) |
| Anthropic PBC | AI document recognition | USA |
| Resend | Sending service emails | USA |
| Google (Gmail, Google Analytics) | Gmail connection if you switch it on; website analytics if you accept it | EU / USA |
| Zoho, Wise, Telegram | Only if the company switches that connection on | per provider |
| GitHub | Tasks created from forum posts | USA |
Transfers outside the European Economic Area rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. We do not sell data or share it for advertising. We disclose it to authorities only when the law requires it.
How long we keep it
- Company data and documents: while the company uses Fiscalm. Deleting the company removes them immediately from the database and disk; encrypted backups age out within 14 days.
- Account: until you delete it in your profile.
- Security log: without document contents or amounts, for as long as platform security needs it.
- Waitlist: until you ask us to delete it, or 12 months after launch.
- ATIEMPO.ME SL’s own invoicing: for the periods required by commercial and tax law.
Your own retention duties (for example, keeping books and invoices for 4 years for the Spanish tax agency) belong to your company: download the full export before deleting it.
Security
TLS in transit; files, keys and certificates encrypted at rest (AES-256-GCM); encrypted backups; passkey sign-in and a second factor for accountants; strict separation between companies, checked by automated tests; an access log each company can see.
Your rights
You can request access, rectification, erasure, objection, restriction and portability by writing to hola@fiscalm.app. In the app you can already download all your company’s data as a ZIP, delete the company and delete your account. If the data is in Fiscalm on behalf of your company or accounting firm, we will help you direct the request to the right controller.
If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
Cookies
The app uses only necessary cookies: the session cookie and the language cookie. The public website loads Google Analytics 4 only if you accept it; you can change your choice under “Cookies” at the bottom of the page.
Minors
Fiscalm is a professional service and is not aimed at anyone under 18.
Changes
If we change this policy in a meaningful way, we will tell you in the app or by email before it applies. Last updated: 18 October 2026.