Privacy Policy

1. Data controller

• Controller: Francisco Ruiz de Lope
• Tax ID (NIF): 74228093D
• Address: C/ Mar, 4, 03130 Santa Pola (Alicante), Spain
• Contact: fruizdelope+statsreceipt@gmail.com

This policy applies to statsreceipt.com and complies with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

2. What we process and why

• Account (Firebase Authentication): if you sign in with Google we receive your name, email address and profile picture. We use them to identify your account and manage your usage limits.
• Pro verification: if you buy a licence, we store the email address linked to the purchase in order to unlock paid features.
• Metrics you enter: the numbers you type to generate a receipt are processed to render the image. They are not linked to your profile or used for anything else.
• MRR data (TrustMRR): when you generate an MRR receipt we look up public revenue data on TrustMRR. The request is made from our server and no data about you is sent to TrustMRR. The response is cached briefly to avoid repeat calls.
• Analytics (Google Analytics 4): only if you accept analytics cookies. It tells us, in aggregate, which pages are visited and from which country.
• Browser local storage: we store your language preference, your cookie choice and your daily free-receipt count. This is not a tracking cookie and never leaves your device.
• Server logs: our hosting provider (Google Cloud / Firebase App Hosting) records the IP address, timestamp and user agent of each request for security and operational purposes.

3. Legal basis for each purpose

• Performance of a contract (art. 6.1.b GDPR): account management, Pro licence verification and delivery of the service.
• Consent (art. 6.1.a GDPR and art. 22.2 LSSI): cookies and analytics technologies. You can withdraw it at any time via the "Cookies" link in the footer, as easily as you gave it.
• Legitimate interest (art. 6.1.f GDPR): server logs, to keep the service secure and available.
• Legal obligation (art. 6.1.c GDPR): retention of tax records arising from sales.

4. Recipients and processors

We do not sell or rent your data. We share it only with:

• Google Ireland Ltd. / Google LLC — Firebase Authentication, Firestore, App Hosting and Google Analytics.
• Lemon Squeezy LLC — Merchant of Record, which processes payments and issues the invoice. See their privacy policy.
• TrustMRR — lookup of public startup revenue data. Only the startup's public identifier (slug) is sent, never your personal data.

5. International transfers

Some providers are established in the United States or may process data outside the European Economic Area.

• Google: certified under the EU-U.S. Data Privacy Framework and, in the alternative, covered by Standard Contractual Clauses approved by the European Commission.
• Lemon Squeezy LLC: transfers covered by Standard Contractual Clauses.

You can request a copy of the safeguards in place by writing to fruizdelope+statsreceipt@gmail.com.

6. Retention periods

• Account data: while the account is active; deleted on request.
• Pro verification email: for the duration of the licence and, thereafter, the statutory limitation period for obligations arising from the sale.
• Billing records: 4 years under Spanish tax law, and up to 6 years where the Commercial Code applies.
• MRR cache: automatically discarded within hours.
• Analytics: per Google Analytics 4 settings (14 months).
• Server logs: per Firebase App Hosting defaults (approx. 30 days).

7. Your rights

You may exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw your consent at any time without affecting the lawfulness of prior processing.

To do so, write to fruizdelope+statsreceipt@gmail.com stating which right you wish to exercise. We will respond within one month at the latest.

If you believe your request was not handled properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD).

8. Cookies and similar technologies

• Strictly necessary (no consent required): authentication session, language preference and the record of your cookie choice.
• Analytics (consent required): Google Analytics 4 sets the `_ga` and `_ga_<ID>` cookies, lasting roughly 2 years. They are only set if you press "Accept".

We use no advertising or ad-personalisation cookies, and Google advertising signals are explicitly disabled.

You can change or withdraw your choice at any time via the "Cookies" link in the footer. On withdrawal we delete any analytics cookies already set.

9. Minors

The service is not directed at children under 14. If we find we have processed a minor's data without guardian authorisation, we will delete it.

10. Changes to this policy

We may update this policy. The "last updated" date indicates the version in force. If a change is substantial and affects you, we will flag it visibly on the site.