Try free for 7 days, no upfront payment +355 69 607 7276
Sign in

Privacy policy

How we collect, use and protect your personal data.

Updated on 7 November 2026
This is a translation of the Albanian original. If the two versions differ, the Albanian version prevails.

1. Introduction

This policy explains how Fature.al (hereinafter "we", "the Service") handles the personal data of website visitors, registered customers (companies and their employees) and third parties whose data our customers enter into the system (for example, buyers who receive an invoice). Fature.al processes personal data in compliance with the EU General Data Protection Regulation (GDPR) and with Law no. 124/2024 "On personal data protection", which is aligned with the GDPR.

2. Who we are (the Controller)

Fature.al is part of Ei3 Software Solution shpk.
NIPT: L62221018T
Privacy contact email: [email protected]
Phone: +355 69 607 7276

For registered accounts, the customer company acts as the controller of the data of its employees and buyers, while Fature.al acts as a processor on the company's behalf for that data, under the Data Processing Agreement.

3. What data we collect

Depending on how you use the Service, we collect the following categories:

  • Account data (user, employee): first and last name, email, phone number, username, password (hashed), operator code, link to a company, branch or fiscal device.
  • Company data: legal name, NIPT, address, phone, fax, subscription payment status.
  • Customer and buyer data (entered by you): first and last name, father's name, email, phone, address, city, country, identity document number, document type, nationality, uploaded document, date of birth (as applicable).
  • Financial data: IBAN, account holder, bank, currency, invoices issued and transaction history.
  • Technical usage data: API token, device type (iOS/Android/Other), browser User-Agent, time the account was last used.
  • Data from use of the website (cookies): see section 10.

We do not intentionally request special categories of data (racial or ethnic origin, political opinions, religious beliefs, health, genetic or biometric data, sex life).

4. Why we collect it (Purposes) and legal basis

Purpose Category Legal basis
Creating and administering the account Account, company Performance of a contract
Issuing, storing and fiscalising invoices Account, customers, financial Performance of a contract; legal obligation
Transmission to the tax authority (General Directorate of Taxation / AKSHI, the National Agency for Information Society) Customers, financial Legal obligation
Subscription billing and payment follow-up Account, company Performance of a contract
Service emails (password reset, system notifications) Account Performance of a contract; legitimate interest
Security, abuse prevention and error diagnostics Technical usage Legitimate interest
Artificial intelligence features (only when the business switches them on) The data the feature needs, e.g. product names Consent
Usage statistics (Google Analytics, Microsoft Clarity) Analytics cookies Consent
Marketing and conversion measurement (Meta Pixel, Google Ads) Marketing cookies Consent
Chat with the support team (Tawk.to) Analytics/functional cookies Consent

5. Who we share data with (recipients and sub-processors)

Your data may be shared with the following recipients, only as far as necessary:

  • General Directorate of Taxation, through AKSHI's systems, for invoice fiscalisation and e-Invoicing. (Legal obligation.)
  • Sub-processors that help us provide the Service: DigitalOcean (servers and database), Cloudflare (DNS and DDoS protection), Mailgun (service emails), Pusher (real-time notifications) and Sentry (error logging, without personal data by default). The full list, with the location of each, is on the Sub-processors page.
  • Anthropic, PBC, only for businesses that switch on the artificial intelligence features and accept their terms.
  • Integrations you connect yourself (Shopify, WooCommerce, Wolt, POK, MCP clients, API applications), only as far as you allow and on your instruction.
  • kursi.al for currency exchange rates. We do not send it any personal data.
  • Google LLC (Analytics, Ads), Meta Platforms, Inc. (Pixel), Microsoft Corp. (Clarity), BoostCDN, poopup.co, Tawk.to Inc. only on the public website and only after your consent to analytics/marketing cookies.
  • Public authorities when required by law or by a court order.

We do not sell your data to third parties and do not share it for their own purposes.

6. Where data is stored and international transfers

The servers and the database are located in the European Union, in the Netherlands (DigitalOcean, Amsterdam). Mailgun, Pusher and Sentry also process data in the EU.

Traffic passes through the global network of Cloudflare, Inc., which does not store invoice data. Anthropic (for the artificial intelligence features) and the cookie services (Google, Meta, Microsoft, Tawk.to) process data in the USA. For these transfers we rely on the EU Standard Contractual Clauses or on adequacy decisions, in accordance with Law no. 124/2024.

7. How long we keep data

  • Fiscal data (invoices, customers on invoices): up to 10 years after the fiscal year, as required by tax law.
  • Your account: for as long as it is active. After a deletion request, we delete or anonymise personal data within 30 days, keeping only the fiscal data required by law.
  • API tokens and activity logs: up to 12 months after the last login.
  • Marketing emails / newsletter subscription: until consent is withdrawn or 24 months after the last interaction.
  • Analytics/marketing cookies: according to the period of each service (usually 6 to 24 months). They can be reviewed in the cookie preferences.

8. Your rights

You have the right to:

  • Access your personal data and obtain a copy.
  • Rectify inaccurate or incomplete data.
  • Erase your data (the "right to be forgotten"), except for data we must keep by law.
  • Restrict or object to processing for certain purposes.
  • Request portability of your data to another provider (in a machine-readable format).
  • Withdraw consent at any time (this does not affect the lawfulness of earlier processing).

To exercise these rights, write to us at [email protected]. We reply without undue delay, usually within 30 days.

9. Right to lodge a complaint

If you believe your rights are being infringed, you may lodge a complaint with the Information and Data Protection Commissioner (www.idp.al).

10. Cookies and similar technologies

We use three categories of cookies:

  • Necessary (always active): login session, CSRF protection, language preference, storing your cookie choice.
  • Analytics (require consent): Google Analytics, Microsoft Clarity, Tawk.to (chat).
  • Marketing (require consent): Meta Pixel, Google Ads, BoostCDN, poopup.co, referral tracking (?ref=).

You can change your preferences at any time by clicking here to open the cookie preferences.

11. Automated decision-making and profiling

We do not make automated decisions that have a legal effect on you or significantly affect you. Usage statistics are not used to build individual profiles.

12. Security

We apply technical and organisational measures to protect data: HTTPS with HSTS for traffic, encrypted sessions, passwords hashed with bcrypt, separation of data per company, role- and permission-based access controls, and logging of API activity. No system is 100% impenetrable. If we learn of a security incident that affects your data, we will notify you within the legal deadlines. We describe the measures in detail on the Security page.

13. Minors

Our Service is aimed at businesses and is not intended for users under the age of 16. We do not knowingly collect data from children.

14. Changes to this policy

We may update this policy from time to time. Material changes will be notified to you by email or through the Service. The version in force is shown by the "Updated on" date at the top of the page.

15. Contact

For any question about privacy: [email protected].

Questions? Write to [email protected].