Privacy policy
Version of 19 October 2026
This is a translation provided for convenience. The French version prevails in case of discrepancy. Read the French version
1. Who is responsible for your data?
The controller is EDJ XTECH LAW SCHOOL, S.L., a Spanish private limited company (S.L.), registered office at Calle Gomeznarro, 168, 28043 Madrid (España), registered with the Registro Mercantil de Madrid, tomo 45444, folio 50, sección 8, hoja M-799362, inscripción 1.ª, NIF B56240278, publisher of the website www.lefrac.fr and of the Le Frac application.
- Contact for any question about your data or to exercise your rights: contact@lefrac.io
- Phone: +34 654 83 75 24
- Post: EDJ XTECH LAW SCHOOL, S.L., Calle Gomeznarro, 168, 28043 Madrid (España)
2. What this policy covers
It covers the data of visitors to www.lefrac.fr, of people who fill in a form (test, guide, waitlist, private beta) and of users of the Le Frac application, including when they sign in with Google, Apple or Microsoft (section 4).
Data our customers record in the application about their own customers and suppliers (invoices, contacts, reminders) is processed by Le Frac as a processor, on behalf of and on the instructions of our customers, who remain the controllers. This processing is governed by the data processing agreement (DPA). If you receive an invoice or a reminder sent with Le Frac, please contact the company that sent it first.
3. Data collected, purposes, legal bases and retention periods
Here is the complete list of the data we process, why, on what legal basis and for how long:
| Purpose | Data | Legal basis (GDPR, Art. 6) | Retention period |
|---|---|---|---|
| Creating and managing your account, signing you in, providing the service | Email address, first and last name, phone number if you provide it, company and tax identifiers, settings and preferences (language, notifications); if you sign in with Google, Apple or Microsoft: the data described in section 4 | Performance of the contract (Art. 6(1)(b)) | Until the account is deleted (immediately from Security › Delete my account, section 7); when the subscription ends, 30 days to export your data, then deletion, subject to legal obligations |
| Using the application: invoices, credit notes, quotes, reminders, collections, expense reports, cash flow | Your company’s data and the data you enter or import about your customers and suppliers (we then process it as a processor, see the DPA) | Performance of the contract (Art. 6(1)(b)) | Life of the account, then 30 days to export your data; then deletion, subject to legal obligations |
| Sending the service’s emails (sign-in link, confirmations, notifications, invoices and reminders sent for your account) | Recipient’s email address, message content, delivery status | Performance of the contract (Art. 6(1)(b)) | Life of the account, then 30 days; then deletion |
| Billing the subscription, collecting payments, keeping our accounts | Company identity, address, VAT number, payment history; card and bank account details are entered at Stripe and processed by Stripe, never by us | Legal obligation (Art. 6(1)(c)) | 6 years (Art. 30 of the Spanish Commercial Code) |
| Sign-in history, for the security of your account (shown under Security) | Sign-in method (email link, Google, Apple, Microsoft), date, summarised device (for example “Chrome · macOS”), country; no IP address and no full browser identifier | Legitimate interest: account security (Art. 6(1)(f)) | 13 months, then automatic deletion |
| Push notifications, if you turn them on | Subscription address and technical keys provided by your browser, browser type | Performance of the contract (Art. 6(1)(b)) | Until you turn them off or the browser subscription expires, at most the life of the account |
| Artificial intelligence features of the application (reading replies to reminders, dictated invoices, questions about your invoices) | Only the data needed by the feature (never your email, your company number or the data received from Google, Apple or Microsoft) | Performance of the contract (Art. 6(1)(b)) | Not retained by us; see the AI provider’s terms (section 5) |
| Answering your requests, supporting you (support, beta) | Name, email, phone, content of exchanges | Legitimate interest (Art. 6(1)(f)) or pre-contractual steps (Art. 6(1)(b)) | 3 years after the last exchange |
| Contacting you about our services (website forms, waitlist, beta) | Name, email, phone, company, country, size, current tool, needs | Legitimate interest (business-to-business marketing, Art. 6(1)(f)); you can object at any time | 3 years after your last contact |
| Running and securing the website and the application | Technical logs of our hosting providers (IP address, date, page or feature requested) | Legitimate interest: security and fraud prevention (Art. 6(1)(f)) | Log retention period set by our hosting providers (Vercel, Supabase); they are used for nothing else |
Mandatory form fields are marked; without them we cannot answer your request or open your account.
We sell no data, we do no targeted advertising and the website uses no analytics or advertising tools.
4. Signing in with Google, Apple or Microsoft
On the sign-in page, you can create your account or sign in with the “Continue with Google”, “Continue with Apple” or “Continue with Microsoft” buttons instead of a link sent by email. This is optional. Before you agree, the provider shows you the information it will share with Le Frac.
- Google: your email address (and whether it is verified), your first and last name, the address of your profile picture if your account has one, and your Google account identifier. We only request the basic “openid”, “email” and “profile” permissions. We have no access to any other data in your Google account (Gmail, Drive, Calendar, Contacts or anything else).
- Apple: your email address or, if you choose “Hide My Email”, a relay address provided by Apple (ending in @privaterelay.appleid.com) that forwards our emails to you; your Apple account identifier; your name only if Apple shares it.
- Microsoft: your email address, your name and your Microsoft account identifier (“openid”, “email” and “profile” permissions).
Use: this information is used only to authenticate you, to create and secure your account and to identify you in the application (account email address, first name in the welcome message and in the service’s emails). The profile picture is neither displayed nor used. Legal basis: performance of the contract (GDPR, Art. 6(1)(b)).
What we do not do: we do not sell this information; we do not share it with anyone except Supabase, our processor that runs authentication and the database (section 5); we do not use it for advertising, profiling or creditworthiness assessment; we do not send it to the artificial intelligence features and do not use it to develop, improve or train artificial intelligence models. Our team’s access is limited to running the service (account management, support at your request, security) and to legal obligations.
Retention: as long as your account exists; it is deleted together with the account (section 3).
Deletion and revoking access: you can delete your account at any time, and with it the information received from the provider, from the application (Security › Delete my account), see section 7. You can also remove Le Frac’s access in the security settings of your Google, Apple or Microsoft account; you can then keep signing in with an email link.
Google: Le Frac’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Policy: https://developers.google.com/terms/api-services-user-data-policy — Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy#limited-use
5. Recipients and processors
Your data is neither sold nor transferred. It is accessible to our team, to the extent necessary, and to our processors, bound by a contract complying with Article 28 GDPR, each for its own role:
| Processor | Role | Place of processing |
|---|---|---|
| Supabase Pte. Ltd. | Database, authentication (including signing in with Google, Apple or Microsoft), file storage | European Union (Frankfurt); support possibly from Singapore and the United States |
| Vercel Inc. | Hosting of the website and the application | Application run in the European Union (Frankfurt); public pages and files delivered by Vercel’s global network |
| Resend (Plus Five Five, Inc.) | Sending emails (sign-in link, confirmations, reminders, notifications) | United States |
| Stripe | Subscription payment and online payment of invoices | European Union and United States (Stripe, LLC) |
| Google (Gemini API) or Anthropic Ireland, Limited (Claude API), depending on the provider used | Artificial intelligence (features listed in section 3). For Google, the Gemini API terms that apply to users in the European Economic Area exclude using content to improve its products; Anthropic’s commercial terms prohibit training its models on customer content | Possibly outside the European Union (section 6) |
| E-invoicing platforms: Super PDP, Iopole, B2Brouter, Invopop or Storecove, depending on your country and the network used | Sending and receiving e-invoices, if you use this feature | Depends on the platform (see its terms) |
| ImprovMX Incorporated | Forwarding of emails sent to an @lefrac.fr address | United States |
| Namecheap, Inc. | Forwarding of emails sent to an @lefrac.io address (including the contact address) | United States |
| OVHcloud, Merci Facteur, AR24 | Sending text messages, paper letters and electronic registered letters, if you use these features | France |
If you connect accounting software (for example Pennylane, Xero or QuickBooks), data is exchanged at your request with that software, under its own terms. If you turn on push notifications, they are delivered, encrypted, through your browser’s notification service.
6. Transfers outside the European Union
Some processors are established or process data outside the European Union, notably in the United States. These transfers rely on the European Commission adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) where the recipient is certified — which, according to their published policies, is the case for Vercel Inc. and Stripe — or otherwise on the European Commission’s standard contractual clauses (GDPR, Art. 46).
You can obtain a copy of these safeguards by writing to contact@lefrac.io.
7. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection (including, without giving reasons, to direct marketing), and the right to withdraw consent at any time. If you live in France, you may also set instructions about what happens to your data after your death.
Account deletion: you can delete your account yourself, at any time, from Security › Delete my account in the application. After signing in again less than 10 minutes earlier and confirming, deletion is immediate: your account, your sign-in identifiers (Google, Apple, Microsoft, two-factor authentication), your preferences, your sign-in history, your notifications, your reimbursement bank details and your feedback on the site are erased, and you are removed from all your companies; a confirmation email is sent to you. If you are the only owner of a company, you first transfer its ownership to another member or close it: its subscription is then cancelled immediately, with no automatic refund, and its connections and automated tasks are stopped.
What is kept, under a legal obligation (GDPR, Art. 17(3)(b)): the companies’ issued and received invoices, credit notes, e-reporting data, registers and accounting records, with no link to you (the actions you took remain, without an author; the company’s chained audit log, which cannot be altered, keeps its events under a technical identifier that no longer points to any account, together with the email address mentioned in invitations and role changes). For a closed company, these records stay archived for the legal retention period of its country (10 years in France, Commercial Code Art. L123-22; 6 years in Spain, Código de Comercio Art. 30), counted from 31 December of the year following the closure, then are deleted; a link valid for 30 days, sent in the confirmation email, lets you download them. The invoices for your Le Frac subscription are kept for 6 years (section 3).
To exercise your other rights, write to contact@lefrac.io. We reply within one month, which may be extended by two months for complex requests; we may ask you to prove your identity if in doubt.
8. Complaints to a supervisory authority
You may lodge a complaint with a supervisory authority, in particular:
- in Spain, where the publisher is established: the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es;
- in France: the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr;
- or the authority of the country where you live or work.
10. Security
Traffic is encrypted (HTTPS). Data access is separated per company at database level, credentials for third-party services are encrypted, and team access is limited to what is necessary.
11. Changes
We may change this policy; the version date is shown at the top of the page. Application users are notified by email of any significant change; if we wanted to use the information received from Google, Apple or Microsoft other than as described in section 4, we would ask for your consent first.