Legal and security
The documents and, below them, what the software really does with the data: where it is, who can see it and how it is protected. Described by reading the code, not copied from a template.
This translation is provided for convenience. The Spanish version is the legally binding one. Read the Spanish version
- Legal notice Who provides the service, how to reach us and the terms for using the website.
- Privacy policy What data we process, on what legal basis, who else handles it and how to exercise your rights.
- Cookie policy Technical cookies for your session and the connection with Stripe, optional first-party analytics, preferences and browser controls.
- Terms of service What you sign up for, what the software does and doesn’t do, what it costs and how to leave.
- Data processing agreement The agreement required by Article 28 of the GDPR (the EU General Data Protection Regulation), which is what allows us to process your customers’ data.
- Partner programme The terms for recommending Remitide and earning a commission: calculation, payouts, data and termination.
If we change anything that affects you, we will tell you thirty days in advance.
What data we store
- About you
- Your name, your email address and a hash of your password (never the password itself). The company details you enter in Settings: legal name, tax ID (NIF), address, IBAN. And what you do in the application: what you changed and when.
- About your customers
- What you import from your invoicing software: name, tax ID, email address, postal address and the invoices with their amounts and due dates. This is third-party data and we treat it as such: we are the processor, you are the controller.
- What we DON’T store
- No password in plain text, neither your Remitide password nor that of any service you connect. No card details: payment is processed by the payment gateway and the money goes straight to your account. No file uploaded to the free tools: only the aggregated result, which expires after thirty days.
- For how long
- For as long as you have an account. When you close it, you can export everything first. Audit logs and sent reminders are not deleted while the account exists: they are the record of what was sent and when, and they are useful to you as well as to us.
How it is protected
- Separation between companies
- Each organisation is isolated using Row Level Security in the database, not just by a filter in the code. These policies are designed to prevent access to other companies’ data; they must be maintained and tested alongside the application’s own controls. Public pages (the one for paying an invoice) read through functions restricted to a single token, which can’t return anything else.
- Passwords
- They are stored with argon2, the algorithm recommended today for this. Sessions are kept in a cookie that the page’s JavaScript can’t read and that isn’t sent to other sites.
- Payment links
- They carry a random 32-character token, not derived from anything: having one doesn’t let you guess another. They expire after ninety days and are invalidated as soon as the invoice is paid.
- What automation can’t do
- The assistant is subject to permissions and controls. Automatic modes can send reminders without individual review: set their limits and monitor the results. The controls reduce risk, but they don’t guarantee that an error will never happen.
- Where it is
- The application and the database are in the Netherlands, and the encrypted backups in Amsterdam. US providers are certified under the EU-US Data Privacy Framework or, where they aren’t, process data under standard contractual clauses.
Terms of service
- What we do and what we don’t
- Remitide is a tool for following up your own invoices. You check the debts, the recipients and the sending rules. Remitide keeps its obligations regarding operation and data protection; it doesn’t shift all responsibility onto the customer.
- The money
- We never touch it. Payment goes straight to your payment gateway account. We charge a fixed monthly fee, not a percentage of what you collect.
- Compliant invoicing
- Remitide does NOT yet issue invoices that comply with the Spanish invoicing regulations. It works on the invoices you already issue with your own software. When it does, we will say so in those words, and not before.