Privacy policy

This comes first because it frames everything else. Remitide processes two very different kinds of data, and its legal position is not the same for both.

• Your data: your name, your email address, your company’s details and how you use the application. Here Remitide is the controller: it decides what the data is used for. That is what this page is about.
• Your customers’ data: the people and businesses you chase for payment of an invoice. Here Remitide is only a processor: you are the controller, and we simply do what you ask. This is governed by the data processing agreement, a separate document that is binding on both parties.

Blixma Capital Group, S.L., with its registered office at Carrer Jaume Balmes, 18, 08348 Cabrils (Barcelona), España. For any question about your data, including exercising your rights, write to soporte@remitide.com.

To provide the service. Your name, your email address and a cryptographic hash of your password (never the password itself); the company details you enter in Settings; and a log of what you do in the application, which is what shows who changed what and when. The legal basis is the performance of the contract you accept when you create your account: Article 6.1.b of the GDPR (the EU General Data Protection Regulation).

To keep your account secure. The IP address and browser you sign in from, and failed sign-in attempts. This lets us stop brute-force attacks and lets you see and close your open sessions. The legal basis is our legitimate interest in protecting the service and the people who use it: Article 6.1.f.

To know what gets read, without cookies. When we serve an article, a guide or a main public page, we add one to a daily counter broken down only by the domain the visit came from, the device type and the country indicated by the network. Neither the IP address nor the browser is stored, nothing is stored on your device, and there is no way to know whether two reads come from the same person. The IP address is held for a few minutes in the server’s memory, encrypted and never saved, only to stop anyone inflating the figures. The legal basis is our legitimate interest in knowing which content people find useful so we can improve it (Article 6.1.f), an interest that does not override your privacy because the result is aggregated figures that identify no one. The details are in the cookie policy; you can object by writing to our privacy email address.

If you accept our own analytics. A random identifier in a cookie, the pages you read, where you came from (UTM parameters and referring domain, the first and the last time), how far you read articles, clicks on the buttons to try Remitide, talk to the team, see pricing or the guarantee, whether you use the calculator or the collections check-up (not what you type) and whether you go on to create an account. The legal basis is your consent (Article 6.1.a of the GDPR and Article 22.2 of Spain’s Information Society Services Act, the LSSI), which you can withdraw at any time from the cookie policy as easily as you gave it; withdrawing it deletes the analytics cookies.

To bill you. The data needed to issue your invoice and keep the accounts. The legal basis is compliance with legal, tax and accounting obligations: Article 6.1.c. We don’t store any card details: the payment gateway handles that, and we never see them.

To write to you. Service emails (security alerts, important changes, incidents) are part of performing the contract and can’t be switched off while you have an account: they are the ones that tell you if something goes wrong. Any other commercial communication requires your consent and can be withdrawn at any time. If you are a founding company, the monthly request for feedback is voluntary, and quoting your name or showing your logo always requires your express permission.

If you book a call or write to us. Your name, your email address and whatever you tell us. Calls are booked through Google’s appointment calendar, which collects that data for us. We use it only to help you and answer what you ask before you sign up; the legal basis is taking steps at your request before entering into a contract or, if you are already a customer, performing the contract: Article 6.1.b. If you don’t go on to sign up, it is deleted when the conversation ends and, at the latest, after one year.

We don’t sell data. We don’t pass it to third parties for their advertising. There are no tracking cookies, social media pixels or third-party analytics on this website, and no commercial profile is built about you. Reads are always counted in aggregate and without cookies. If you also accept our own analytics, the pages you read, where you came from and which buttons you click are measured pseudonymously; the details are in the cookie policy and you can withdraw your consent at any time.

Nor do we use your customers’ data or the content of your reminders for anything other than providing the service to you: not to train models, not for shared statistics and not to sell you anything.

The software suggests or sends reminders according to the rules and permissions that have been set up. The customer must assess the effect of those automations on people and keep them under supervision. Working with invoices does not, in itself, rule out Article 22 of the GDPR. The service is not intended for making credit decisions with legal effects on people.

No automated decision with legal or similarly significant effects is made about your own account.

Technical providers and the services you connect are involved. Where they act as processors, their involvement requires the corresponding data processing agreement. Other providers, such as payment services, may also act as controllers for their own legal obligations. A provider’s label does not, on its own, determine its role.

In addition, data is disclosed to public authorities when a law requires it, for example to the Spanish Tax Agency (Agencia Tributaria) in relation to invoicing.

The application and the database are hosted in the Netherlands, and encrypted backups are kept in Amsterdam. The providers involved and where they process data are listed in the table above.

Some providers are established in the United States or may process data there. Railway Corporation, Stripe, LLC, Plus Five Five, Inc. (Resend), Google LLC and Microsoft Corporation are certified under the EU-US Data Privacy Framework, and transfers to them rely on Commission Implementing Decision (EU) 2023/1795. Their data processing agreements also include the standard contractual clauses adopted by the European Commission in 2021. The AI provider is OpenAI Ireland Ltd., which transfers data to its US affiliates under the 2021 standard contractual clauses, as OpenAI is not certified under that Framework; Anthropic, an alternative provider not currently in use, would likewise rely on standard clauses. A copy of these safeguards is available on request from our privacy email address. The assistant and the reminder writer only receive the information needed for the task they are given.

• Your account data, for as long as your account is open. When you close it, the data is deleted, except what must be kept by law.
• Remitide’s own tax and accounting records, for the applicable legal periods. This does not allow your customers’ invoices to be kept indiscriminately: those are governed by your instructions and the data processing agreement.
• The access log and the audit log, for as long as the account exists. They are the record of who did what, and they are useful both to us and to you.
• Sent reminders, with their exact wording, for as long as the account exists: they are the record of what was communicated and when, which is exactly what is needed if a debt ends up being disputed.
• The cookie-free read counters, 25 months. They contain no personal data.
• With analytics accepted: cookies last at most 13 months; what is measured about people who don’t create an account is deleted after 25 months, and the origin of people who sign up is kept with their account for as long as it exists.
• After an account is closed, the record of the contract (which version of the terms was accepted, when and from which account) and any data that must be kept by law are stored in blocked form, as provided for in Article 32 of Spain’s Data Protection Act (LOPDGDD): available only to judges, courts and public authorities, and for the limitation period of any liabilities that may arise.

You can ask for access to your data, its rectification or erasure; restrict or object to its processing; and request its portability in a commonly used format. You can also withdraw any consent you have given at any time, without affecting processing carried out before.

For portability you don’t even need to write to us: in Settings › Data and privacy you can download your invoices, your customers and your reminders in a file that any spreadsheet can open. For everything else, write to soporte@remitide.com, and we will reply within the one-month period set by the GDPR.

If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (AEPD) ↗.

What is in place is described in detail, with specific names, on the security page. In short: passwords are stored with argon2id, the credentials for your connections and your email are encrypted, each company is isolated in the database itself through row-level security, and production connections must be protected with TLS. This is not end-to-end encryption: the service needs to process readable data. No system is risk-free, and the measures must be reviewed continuously.

As controller, we will notify the authority where required, without undue delay and, where feasible, within 72 hours of becoming aware. Whether the people affected are informed depends, among other legal grounds, on there being a high risk. As processor, we will notify the customer who is the controller without undue delay.

Remitide is a work tool for businesses and professionals. It is not aimed at minors and their data is not knowingly collected.

If this policy changes, the new version is published here with a new revision date. When the change is substantial (a new provider, a new purpose), we will also let you know by email or in the application, with enough notice for you to object or close your account.