Involy Privacy Policy

Last updated: 19 May 2026 · Version: 2.0

This Privacy Policy describes how Intellizy S.L. (hereinafter, "Involy", "we", "us" or "our") processes your personal data when you use our services. It is drafted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and with Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights ("LOPDGDD").

Data controller

We are the data controller for the personal data we collect directly from our customers, prospective customers and website visitors. Our contact details are:

• Intellizy S.L.
• Faraday 7, 28049 Madrid (Spain)
• Spanish business identification number: ESB85342822
• Privacy contact email: support@involy.com

Scope of this policy

This policy applies to the personal data we process as data controller: registration data, billing data, support communications and technical data associated with your use of the Involy service.

When you use Involy to issue invoices to your own customers, the personal data contained in those invoices (name, tax identification number, address and other identifying data of the recipient) is processed by Involy as data processor, on your behalf, with you acting as data controller. The relationship between you (controller) and Involy (processor) is governed by the data processing agreement (DPA) entered into at the time of subscription, in accordance with Article 28 of the GDPR.

Categories of personal data we process

We collect and process the following categories of personal data:

• Account and registration data: first and last name, email address, password (stored in hashed form), phone number when provided, language and time zone.
• Billing data: tax identification number, company name (where applicable), postal address, fiscal contact details and other information necessary (a) to populate the invoices that you issue through Involy to your own customers, and (b) for our payment service provider to issue, on our behalf, the invoices corresponding to your Involy subscription.
• Payment data: Intellizy does not collect, access or store any credit or debit card data. Card details are entered directly into the payment gateway operated by our payment service provider, which handles them in accordance with its own security policies and applicable industry standards (for example, PCI DSS). On our own systems we only retain the subscription identifier, sufficient to verify the status of your subscription. Our internal system logs may include, during the applicable retention periods, references to the transactions (transaction identifier and date).
• Content of invoices you issue: data you enter about your own customers (name, tax identification number, address, billed items, amounts). We process this data as data processor (see "Scope" above).
• Support communications: the content of the messages you send us at support@involy.com and our replies.
• AI feature usage data: textual or audio content that you voluntarily provide in order to use features of the service that rely on artificial intelligence (for example, audio transcription). See the "Artificial intelligence features" section.
• Technical data: IP address, device identifier and characteristics, browser, operating system, date and time of requests, session identifiers and system event logs.
• Cookies: we use cookies and similar technologies as described in our Cookies Policy.

Purposes of processing and legal basis

We process your personal data for the purposes set out below. The legal basis for each purpose under Article 6 GDPR is indicated in each case.

Service delivery

We process account, billing, invoice content and technical data in order to provide the Involy service, authenticate the user, maintain the session, generate invoices, manage subscriptions and pay-per-use consumption, and to comply with the obligations we assume under our Terms of Service. The processing is based on the performance of the contract between us, in accordance with Article 6(1)(b) GDPR.

Communications via the contact form or email

When you contact us through the contact form or by email, we process the data you provide (name, email address, phone number where provided and the content of your message) in order to respond to your enquiry. If you are already a customer, the processing is based on the performance of the service contract, in accordance with Article 6(1)(b) GDPR. If you are a prospective customer, the processing is based on our legitimate interest in handling enquiries received and maintaining pre-contractual dialogue, in accordance with Article 6(1)(f) GDPR.

Accounting and tax obligations

We retain invoices and accounting documents, including the personal data they contain (name, address, tax identification number, description of the service), for the periods required by applicable accounting and tax legislation. The processing is based on compliance with a legal obligation, in accordance with Article 6(1)(c) GDPR, in particular the obligations arising from Article 30 of the Spanish Commercial Code (Código de Comercio) and the General Tax Act (Ley General Tributaria).

Transmission to the Spanish Tax Authority (Verifactu)

Involy is a Computerized Billing System (Sistema Informático de Facturación, "SIF") that operates exclusively in VERI*FACTU mode, in accordance with Spanish Royal Decree 1007/2023 and Order HFP/1177/2024. This means that the records of the invoices you issue through the service are transmitted in real time to the Spanish Tax Authority (Agencia Estatal de Administración Tributaria, "AEAT"), as required by applicable regulation. Further details are available in our Verifactu Responsibility Statement. The processing is based on compliance with a legal obligation, in accordance with Article 6(1)(c) GDPR.

Artificial intelligence features

Some Involy features rely on third-party providers of artificial intelligence services (language models and speech-to-text transcription) located in the European Union. When you use these features, the data you provide is processed on the infrastructure of those providers, located within the EU/EEA, solely to generate the requested response or transcription. Our AI providers are contractually required not to use your data to train models nor for any purpose other than the immediate provision of the service. See the "Sub-processors" and "Limitations of the AI features" sections below.

Availability and opt-out. AI features are available across all Involy subscription plans. Under plans that include AI, the features form part of the contracted service. Under plans that do not include AI by default, we offer promotional credits that allow you to try the functionality at no additional cost; under these plans, AI is enabled by default. At any time, regardless of your subscription plan, you can disable the use of AI features from the "AI Data" section of your account settings.

Where the AI features form part of the contracted services (plans that include AI), the processing is based on the performance of the contract, in accordance with Article 6(1)(b) GDPR. Where those features are offered as an optional add-on under plans that do not include them by default (for example, through promotional trial credits), the processing is based on our legitimate interest in allowing you to evaluate the product, in accordance with Article 6(1)(f) GDPR. In the latter case, you are entitled, under Article 21 GDPR, to object to the processing at any time through the "AI Data" control referred to above.

Collection of outstanding balances

When an account is terminated with outstanding amounts owed, we retain the identifying and billing data necessary to issue the final invoice and to manage collection through our payment service provider, until collection is completed or the amount is recorded as uncollectible. The retention is based on our legitimate interest in the collection of amounts due, in accordance with Article 6(1)(f) GDPR, in conjunction with Article 17(3)(e) GDPR, which permits the retention of data necessary for the establishment, exercise or defence of legal claims.

Service security and fraud prevention

We process technical data and event logs to maintain the security of the service, detect unauthorised access, prevent fraud and diagnose incidents. The processing is based on our legitimate interest in the security of the network, the systems and the users, in accordance with Article 6(1)(f) GDPR, in line with Recital 49 of the Regulation.

Sub-processors

In order to provide the Involy service we work with third-party providers that process personal data in our name and on our behalf. These providers act as data processors and are bound by written contracts that comply with Article 28 GDPR, requiring them to protect personal data and to use it solely for the purposes agreed.

For operational flexibility and to preserve our ability to evaluate and change providers when appropriate, we identify our sub-processors below by category rather than by name. The list of current providers identified by name is available to any customer upon written request to support@involy.com:

• Cloud hosting provider located in the EU/EEA
• Payment service provider
• Language model (artificial intelligence) provider located in the EU/EEA
• Speech-to-text provider located in the EU/EEA
• Application performance monitoring (APM) provider located in the EU/EEA

In addition, we transmit invoice records to the Spanish Tax Authority in accordance with Verifactu (see the corresponding section). AEAT does not act as a sub-processor of Involy: it is a public administration that processes the data on its own legal basis and for its own purposes.

If we add a new sub-processor or replace an existing one and the change involves a material modification of the categories listed above (for example, a new processing category or the relocation of a category outside the EU/EEA), we will notify you at least 30 days in advance and you will be entitled to object on reasonable grounds in accordance with the conditions set out in the DPA. Changes within a category already disclosed (for example, replacing one European hosting provider with another equivalent European provider) do not require individual notification, because the categorical commitment remains unchanged.

International data transfers

As a general rule, all processing of personal data takes place within the European Union or the European Economic Area (EU/EEA). At present we do not carry out international transfers of personal data outside the EU/EEA.

If a transfer outside the EU/EEA were to become necessary in the future, we will ensure that it is covered by one of the mechanisms set out in Chapter V of the GDPR: an adequacy decision of the European Commission, Standard Contractual Clauses approved by the European Commission, or any other valid mechanism, together with any supplementary measures that may be necessary following the corresponding transfer impact assessment.

Retention periods

We retain your personal data only for as long as is necessary for the purposes for which it was collected. The specific retention periods are as follows:

• Prospective customer data: until it is clear whether you wish to use our services or not, unless there is a specific and proportionate need to retain it for a longer period.
• Data in the Involy application during the life of the account: while the account remains active and, where applicable, while there are outstanding amounts owed after cancellation. For technical reasons relating to referential integrity between accounts and invoices issued through the service, we do not carry out selective partial deletions during this period.
• Data in the Involy application after cancellation and resolution of outstanding amounts: once the account has been cancelled and all outstanding amounts have either been collected or recorded as uncollectible, we delete in full the personal data associated with the account from the Involy application: account data, technical data, content of invoices issued, usage history, AI feature usage data and resolved support communications.
• Operational system logs after cancellation: for security, diagnostic and operational traceability purposes, certain operational system logs may retain minimal technical references associated with operations (for example, internal identifiers or email addresses) for a maximum period of 30 days from cancellation. After that period, the logs are deleted automatically. The legal basis for this retention is our legitimate interest in network and system security and operational traceability, in accordance with Article 6(1)(f) GDPR, in line with Recital 49 of the Regulation.
• Our own accounting records: separately from the Involy application, we retain in our internal accounting records a copy of the invoices issued in respect of your subscription (which may include name, tax identification number, postal address and description of the service) for 6 years from the date of the last entry, in accordance with Article 30 of the Spanish Commercial Code (Código de Comercio). This period may be extended in cases of tax inspection or fraud in accordance with Article 66 of the General Tax Act (Ley General Tributaria).
• Invoices stored by our payment service provider: the invoices issued by that provider on our behalf remain available in its systems in accordance with its own policies and legal obligations, irrespective of the deletions we carry out within the Involy application.
• AI feature usage data on the AI provider's infrastructure: our AI providers apply their own retention periods; we work with providers that maintain retention limited to what is necessary for the provision of the service. The list of providers identified by name and the specific retention periods are available upon request.

Security measures

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or accidental or unlawful destruction, in accordance with Article 32 GDPR. These measures include:

• Encryption of communications between your browser and our servers using TLS.
• Encryption of passwords using salted hash functions, with no plaintext storage.
• Access controls based on the principle of least privilege for authorised personnel.
• System event logs that enable auditing of access and relevant operations.
• Periodic backups and recovery procedures.
• Continuous review of security measures and ongoing internal training on data protection and information security.

No system is entirely secure. If we become aware of a security breach that may affect your personal data, we will act in accordance with the "Security breach notification" section.

Automated decision-making and profiling

We do not take individual decisions based solely on automated processing, including profiling, which produce legal effects on you or similarly significantly affect you, within the meaning of Article 22 GDPR.

The artificial intelligence features described above generate content (text, transcriptions) which is made available to the user for the user to decide what to do with it. The acceptance, modification or rejection of that content is always for the user; no decision producing legal effects is taken automatically.

Limitations of the AI features

The artificial intelligence features integrated into Involy are tools to assist you. AI models may produce inaccurate, incomplete or incorrect results (sometimes referred to as "hallucinations"). It is the user's responsibility to review and verify any AI-generated content before relying on it, in particular before incorporating it into invoices, communications or other documents with legal or financial effect.

Before making any financial or tax decision — or filing any tax return — we recommend that you consult a qualified accountant, tax adviser or other suitably qualified professional. Involy is not a tax adviser and does not provide legal, accounting or tax advice.

Your rights as a data subject

Under the GDPR and the LOPDGDD, you have the following rights in relation to the processing of your personal data:

• Access (Article 15 GDPR): to obtain confirmation that processing is taking place and a copy of the data.
• Rectification (Article 16): to have inaccurate or incomplete data corrected.
• Erasure or "right to be forgotten" (Article 17): to request erasure where applicable; this right is subject to the exceptions in Article 17(3) GDPR, in particular retention necessary for compliance with legal obligations (accounting, tax) and for the establishment, exercise or defence of legal claims.
• Restriction of processing (Article 18).
• Data portability (Article 20): to receive your data in a structured, commonly used and machine-readable format, where the processing is based on consent or contract and carried out by automated means.
• Objection (Article 21): to object to processing based on legitimate interest or to the use of your data for direct marketing. In particular, you may object to processing by AI features under plans that do not include AI by default through the "AI Data" control in your account settings.
• Withdrawal of consent, where the processing is based on consent (Article 7(3)).
• Lodging a complaint with the AEPD (see below).

How to exercise your rights

You can exercise any of these rights by sending a request to support@involy.com indicating: (i) the right you wish to exercise, (ii) a reasonable means for us to verify your identity (for example, confirmation from the email address associated with your account) and (iii) a sufficient description of the subject matter of the request.

We will respond to your request within one month of receipt, in accordance with Article 12(3) GDPR. This period may be extended by up to two further months in the case of complex or numerous requests; in such a case, we will inform you of the extension and the reasons for it within the first month.

Where you request the erasure of your data and legal retention obligations apply (for example, the 6-year accounting retention of invoices) or there are legitimate retention grounds (for example, an outstanding balance to collect), we will tell you which data is deleted within the requested time frame, which data is retained as a matter of legal obligation, for how long, and the legal basis supporting that retention.

Security breach notification

In the event of a personal data breach, we will notify the Spanish Data Protection Authority (AEPD) without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, in accordance with Article 33 GDPR.

Where the breach is likely to result in a high risk to your rights and freedoms, we will communicate it to you directly without undue delay, in accordance with Article 34 GDPR, informing you of the nature of the breach, the likely consequences, the measures taken and, where applicable, any recommendations you may follow to mitigate the risk.

Minimum age

Involy is a service intended for professionals who use the product in the course of their economic activity. It is not intended for persons under 18 years of age. To use the service you must have sufficient legal capacity to enter into the service contract and to carry on an economic activity in accordance with applicable law. If we become aware that we have collected data from a person under 18 outside the cases in which applicable law permits it (for example, an emancipated minor), we will delete such data without delay.

Changes to this policy

We may amend this Privacy Policy to reflect changes in the service, in our practices or in applicable law. The current version is always available on this page, together with the date of the last update.

Non-material changes — for example, drafting clarifications, contact updates, replacement of a provider within a category already disclosed, or adjustments arising from regulatory updates — will take effect on the date indicated in the policy itself and will be communicated to you through a visible notice in the application. Continued use of the service after that date will constitute acceptance of the changes.

Material changes — meaning those that materially expand the purposes of processing, introduce new categories of personal data or sub-processors, or reduce the data subject's rights — will be notified to you at least 30 days in advance through a visible notice in the application and, where technically feasible, by email to the address associated with your account. During that period you may cancel the service if you do not accept the new terms. For certain material changes we may also ask you for explicit acceptance within the application before the change becomes applicable to you.

Lodging a complaint with the Spanish Data Protection Authority

If you consider that the processing of your personal data infringes applicable law, or if you are not satisfied with our response to the exercise of your rights, you have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos, AEPD):

• Website: https://www.aepd.es/
• Electronic Office: https://sedeagpd.gob.es/
• Postal address: C/ Jorge Juan, 6, 28001 Madrid (Spain)

We would, in any event, ask that you contact us first at support@involy.com so that we can address your request or resolve your concern.