Privacy policy

Last updated: 11 October 2026

This policy describes how Fakts (“we”) processes personal data when you use the fakts.lv invoicing platform. The data controller is KANEPE, SIA, registration number 40103512182. For any data protection question, write to info@fakts.lv.

What data we process

Account data: your name and email address, received from Google or Apple sign-in, or from sign-in with an email link or code. If you sign in with Apple, we also keep your Apple account identifier and an encrypted Apple access token, which we revoke when you delete your account. If you choose to hide your email address during Apple sign-in, we receive Apple's relay address instead of your own.
Company data: your company name, registration and VAT number, address, and bank details.
Content data: the clients, items, invoices, quotes, royalties and purchase documents you enter or upload.
Gmail data (only if you connect the Gmail connector): read-only access to your mailbox, from which only invoice-like attachments are taken. Access tokens are stored encrypted.
Email sent to cc@fakts.lv: the sender's address, the subject and the attachments (PDFs and photos). Attachments are kept as purchase documents for the company they are meant for. The text of the email is not kept.
Forwarding addresses: the email addresses a company accepts documents from, and whether each address's owner has confirmed it.
Email we do not accept: when an address not linked to any company writes to cc@fakts.lv, or an email cannot be accepted, we keep the sender's address, the number of attempts and the reason. The content and attachments of that email are not kept. Such an address may receive an automatic reply with a link explaining how to link it to a company.
Connected AI assistants (only if you connect one, such as Claude or ChatGPT): which app is connected, which companies it may reach and what it may do, and its requests waiting for your approval. What the assistant reads from Fakts is sent to the AI provider you chose, which handles it under your agreement with them.
Conversations with Palīgs: your questions and the documents you attach, Palīgs' answers, the data Palīgs read from Fakts to answer, the cards and your decisions on them, and your rating of an answer.
Questions to Palīgs on the public website (no account): the question and the answer, a random identifier in a cookie, and a hash computed from your IP address rather than the address itself.
Billing data (paid plan only): Stripe customer and subscription identifiers. Card details are handled by Stripe and never reach us.
Technical data: the authentication cookie and basic logs needed to run and secure the service.

Purpose and legal basis

Providing the service (performance of a contract, GDPR Art. 6(1)(b)).
Meeting legal obligations: accounting and tax requirements (GDPR Art. 6(1)(c)).
Security and improving the service (legitimate interests, GDPR Art. 6(1)(f)).

Where data is stored

The database and the API run on an Oracle Cloud server in Switzerland, which the European Commission recognises as providing adequate data protection. Uploaded files (PDFs, receipts, attachments) are stored in Cloudflare R2, in Germany. Several of the processors listed below are based in the United States, so using the matching feature transfers data outside the EU, under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Processors

Oracle Cloud Infrastructure (Switzerland): server hosting (database and API).
Cloudflare (US): site delivery through the Cloudflare Workers global network, receiving email sent to cc@fakts.lv (Cloudflare Email Routing), and file storage in Cloudflare R2.
Google (US): sign-in with a Google account; the Gmail connector, if you connect it; Google Analytics and Google Ads on the public website, only with your consent.
Apple (US): sign-in with an Apple account, if you choose it, and relaying email to you if you hid your address during Apple sign-in.
Resend (US): email delivery. Invoices and quotes you send to clients (with their PDF and XML attachments), reminders, sign-in links and codes, and forwarding address confirmations pass through it.
OpenRouter (US): reads purchase documents you upload, that arrive through Gmail, or that are sent to cc@fakts.lv, and drafts a bill from them. OpenRouter passes the document to the provider of the model it routes to.
Anthropic (US): writes Palīgs' answers. It receives the question, the conversation so far and the data Palīgs reads from Fakts to answer. It is also the fallback document reader, used only when OpenRouter is not available.
PostHog (data in the EU, Frankfurt): product analytics and error reports. Without your consent it runs with no cookies and no persistent identifier; with consent, events can be linked to your account.
Stripe (US and Ireland): payment and subscription management for the paid plan.

An AI assistant you connect to Fakts yourself (such as Claude from Anthropic or ChatGPT from OpenAI) is not our processor. By connecting it, you choose to send it the data it reads from Fakts, and its provider handles that data under your agreement with them, not on our behalf. You can narrow or withdraw its access in Settings, under Connected apps.

Invoicing also draws on public sources: European Central Bank exchange rates, and the Enterprise Register, State Revenue Service and state address register open data from data.gov.lv. How we show that register data on public company pages is described in the next section.

Public company pages

At fakts.lv/registrs we publish a page for every entity in the Latvian Enterprise Register. It shows the name, legal form, registration number, VAT status and number, legal address, registration date, status and industry, and figures from annual reports and total taxes paid. The pages can be found through search engines.

Source: Enterprise Register and State Revenue Service (VID) open data on data.gov.lv (CC0 licence), refreshed every night. We add nothing to it from other sources. We keep taxes-paid totals for earlier years after VID stops publishing them.
Which of it is personal data: most of it concerns legal persons and is not personal data. For a sole trader (individuālais komersants or individuālais uzņēmums) or a farm or fishing business, the name, address and tax totals can relate to one person, so we treat them as personal data.
What we do not publish: the names of board members, members, shareholders and beneficial owners. The page shows only how many there are, and the members that are themselves companies.
Purpose and legal basis: so businesses can find and check a trading partner's details and VAT status before invoicing or paying them. The basis is our and our users' legitimate interests (GDPR Art. 6(1)(f)), given that the state publishes this data openly.
Corrections and objections: the data is shown as the register holds it. If it is wrong, it is corrected at the Enterprise Register or VID, and our page updates the following night. If a page concerns you as a sole trader or the owner of a farm or fishing business, you can object to the processing (GDPR Art. 21) by writing to info@fakts.lv with the registration number. We reply within a month, and where your interests prevail we remove the page from search engines or hide it.

Fakts in ChatGPT and other AI assistants

The Fakts public MCP server (mcp.fakts.lv/public) lets ChatGPT, Claude and other AI assistants answer questions about Latvian companies, taxes and deadlines without an account, from the same open data and calculators this site uses.

What we receive: what the assistant passes to a tool (such as a company name or number, a year, an industry, a currency or an amount to calculate), and from ChatGPT also an anonymised user and conversation identifier, the language and an approximate location, as well as the IP address of the assistant's server. We do not process personal codes as input: the tools refuse them.
What we keep: only a daily count of how often each tool was called, from which assistant (ChatGPT, Claude or another) and in which language. We do not store the questions, the values passed, identifiers, locations or IP addresses.
For how long: the anonymised user identifier or IP address is held only in the server's memory to limit the number of requests, and is dropped within about 15 minutes of the last request. The daily counts contain no personal data and are kept as statistics.
Recipients: we share this data with no one. What the assistant does with an answer is governed by your agreement with the AI provider.
Links in answers: answers carry links to fakts.lv tagged with the assistant they came from. If you open one, the visit is counted as described under website analytics.
Legal basis: our legitimate interests (GDPR Art. 6(1)(f)) in providing this service and protecting it from misuse.

Retention

Accounting source documents are retained for as long as Latvian law requires (generally at least 5 years). Account data is kept while your account is active. We keep the addresses that sent email to cc@fakts.lv that we did not accept, and the number of attempts, to prevent misuse of the address. We keep conversations with Palīgs to improve its answers, including those you delete from your list.

Your rights

You have the right to access, rectify, or erase your data, to restrict processing, to data portability, and to object to processing. You also have the right to lodge a complaint with the Latvian Data State Inspectorate (dvi.gov.lv). To exercise any right, write to info@fakts.lv.

You can also download a copy of your data yourself, as a JSON file: in the app's Settings, open Profile and choose “Download my data”.

Cookies

We use essential cookies that need no consent: a secure authentication session cookie and, if you ask Palīgs a question on the public website without an account, a cookie with a random identifier that counts your two free questions. It is set only when you ask. On our public website, Google Analytics and Google Ads may set analytics and advertising cookies only if you accept the cookie banner. You can change your choice or withdraw consent at any time through the “Cookie settings” link at the foot of the page.

Product usage analytics

We collect first-party usage data (pages visited, time spent, and feature usage) to understand how the service is used and to improve it. This analytics is processed under our legitimate interest (Art. 6(1)(f) GDPR), kept in our own database, never shared with third parties, and never used for advertising. It is associated with your account and is deleted when your account is deleted.

When you create an account, we also record how you found us: the kind of source (for example search, an ad or another website), the domain of the site you came from, any campaign name in the link, and the first page you opened. We do not keep the full address of the referring page or ad click identifiers.

Website analytics & advertising (with your consent)

On our public website only, we use Google Analytics and Google Ads (loaded through Google Tag Manager) to measure where visits come from and how well our ads perform. The signed-in app and the Fakts app for iOS and Android never load them, on any page. They run in Google Consent Mode: until you accept, no Google cookies are set and Google receives only anonymous page signals with no identifier. With your consent, Google processes this data as an independent service and data may be transferred to the United States (EU-US Data Privacy Framework). You can withdraw consent at any time through the “Cookie settings” link, and opt out of Google Analytics using Google's browser add-on. The legal basis is your consent (Art. 6(1)(a) GDPR).

If you accept, your browser also remembers the visit that first brought you to us, so a later sign-up is credited to it. Withdrawing consent deletes that record.