Privacy Policy

1. Data Controller

The data controller for your personal data is VICTOR BERTHELIUS PATO, with tax ID (NIF) 54052380B, operating as a self-employed professional under the trade name Frihet, with fiscal address at C/ Cervera n9, Radazul 38109, S/C de Tenerife, Spain. You can contact us regarding data protection matters at support@frihet.io.

2. Data We Collect

We collect the following types of data: Account data: name, email address, password (encrypted), company name, and tax details you provide when registering. Usage data: information about how you use the Service, including pages visited, features used, frequency of use, and configuration preferences. Payment data: your credit or debit card details are processed directly by Stripe; Frihet does not store full card numbers on its servers. Technical data: IP address, browser type, operating system, device identifiers, and connection data. Business data: information you store in Frihet as part of your business operations, including client and vendor records (names, email addresses, phone numbers, postal addresses), invoices, quotes, expenses, products, CRM contact persons, activity logs, notes, and financial summaries. This data is accessible via the Frihet web app, REST API, and MCP server based on your authentication credentials.

3. Legal Basis for Processing

We process your personal data on the following legal bases: Contractual performance (Art. 6(1)(b) GDPR): processing is necessary to provide the Service you have subscribed to. Consent (Art. 6(1)(a) GDPR): for sending marketing communications and newsletters, which you can withdraw at any time. Legitimate interest (Art. 6(1)(f) GDPR): for Service improvement, fraud prevention, and platform security. Legal obligation (Art. 6(1)(c) GDPR): to comply with applicable tax and legal obligations.

4. Purposes of Processing

We use your data for the following purposes: providing and managing the contracted Service; processing payments and billing; communicating with you about your account, Service updates, and technical support; sending marketing communications (with prior consent); improving and personalizing the user experience; statistical and aggregated analysis of Service usage; complying with legal and tax obligations; detecting and preventing fraud and abuse.

5. Data Recipients

We share your data only with the following service providers, necessary for delivering the Service: Stripe (payment processing, based in the US, DPF certified). Firebase/Google Cloud (infrastructure and authentication, based in the US, DPF certified). Resend (transactional email delivery, based in the US). Google Analytics 4 (web analytics with cookies, activated only after explicit user consent, based in the US, DPF certified). Vercel Inc. (web hosting and cookieless analytics, based in the US). PostHog (product analytics, activated only after explicit user consent, based in the US). Umami (web analytics, self-hosted in the EU, cookieless, privacy-friendly). All providers have been selected to ensure they offer adequate security measures and comply with applicable data protection regulations. OpenAI (ChatGPT integration, only when you connect Frihet to ChatGPT; based in the US, DPF certified). Google Gemini (AI-powered features within Frihet such as document analysis and smart categorization; based in the US, DPF certified, governed by Google Cloud data processing terms).

6. International Transfers

Some of our service providers are located outside the European Economic Area, specifically in the United States. These transfers are made under: the EU-US Data Privacy Framework for certified providers; standard contractual clauses approved by the European Commission; or adequacy decisions by the European Commission, where applicable. You can request additional information about the safeguards applied to these transfers by writing to support@frihet.io.

7. Data Retention Period

We retain your personal data for as long as necessary for the purposes for which it was collected: Account data and user content: for the duration of your account, and after cancellation until you request its deletion or export by contacting support@frihet.io. Deletion requests are reviewed manually and are not carried out automatically on a fixed schedule. Billing data: for the legally required period for tax compliance (currently 4 years under the Spanish General Tax Law). Usage and analytics data: in anonymized and aggregated form, without time limit. Marketing communications: until you withdraw your consent.

8. Your Rights

Under the GDPR and the Spanish LOPDGDD, you have the following rights: Access: know what personal data we process about you. Rectification: correct inaccurate or incomplete data. Erasure (right to be forgotten): request deletion of your data when it is no longer needed. Objection: object to the processing of your data in certain circumstances. Portability: receive your data in a structured, commonly used format (CSV, JSON). Restriction: request limitation of processing in certain cases. You can exercise these rights by sending an email to support@frihet.io with a copy of your identity document. We respond within a maximum of 30 days. You also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Cookies and Analytics

On frihet.io we use the following analytics tools: Umami (self-hosted in the EU, cookieless, no personally identifiable data, GDPR-compliant without requiring consent). Google Analytics 4 (uses tracking cookies, activated only after explicit user consent via our cookie banner). PostHog (product analytics, activated only after consent). Vercel Analytics and SpeedInsights (cookieless, anonymous performance metrics). When you first visit our website, a cookie consent banner is displayed. Tools that use cookies (GA4, PostHog) are only activated if you expressly accept. You can withdraw your consent at any time from the cookie settings. In our web application (app.frihet.io), we use local storage (localStorage) to save your language preferences and session, which is strictly necessary for the operation of the Service.

10. AI, API, and Developer Integrations

Frihet provides programmatic access to your business data through a REST API (api.frihet.io) and an MCP server (mcp.frihet.io) that can be used with AI assistants such as Claude, ChatGPT, Cursor, and other compatible tools. Data accessible via API and AI tools: When you or an authorized AI assistant connects to Frihet via API or MCP, the following data categories may be accessed based on your API key permissions: business profile information (company name, plan type); client and vendor contact data (names, email addresses, phone numbers, postal addresses); invoice and quote details (line items, amounts, dates, status); expense records (descriptions, amounts, categories); product catalog (names, prices); CRM data (contact persons, activity logs, notes); financial summaries (monthly revenue, expenses, profit); and webhook configurations (endpoint URLs, subscribed events). Data minimized in third-party AI integrations: When Frihet is accessed through third-party AI platforms (such as OpenAI ChatGPT), certain sensitive data categories are automatically excluded or redacted from tool responses. Specifically, government-issued tax identifiers (NIF, CIF, VAT numbers) and signing credentials are not transmitted through these integrations. Users who need to manage tax identifiers should use the Frihet web application directly at app.frihet.io. AI processing: Frihet uses Google Gemini for AI-powered features including document analysis, smart categorization, and business intelligence. Your business data processed by these AI features is not used to train AI models. Data sent to AI services is governed by our data processing agreements with the respective providers. OAuth and API authentication: API access requires authentication via API key (fri_ prefix) or OAuth 2.0 with PKCE. OAuth access tokens expire after 1 hour; refresh tokens after 30 days. Tokens can be revoked at any time from your Frihet account settings. No training on your data: Neither Frihet nor any of our AI service providers use your business data to train, fine-tune, or improve AI or machine learning models. Your data is processed solely to provide the requested service functionality. Data returned to ChatGPT and other third-party AI assistants: When you connect Frihet to OpenAI ChatGPT (or another MCP-compatible AI client) and that assistant invokes a Frihet tool, the tool response transmits the following data categories to the AI provider, which receives and processes them as a sub-processor under its own privacy terms (for OpenAI ChatGPT: OpenAI, L.L.C., United States, EU-U.S. Data Privacy Framework certified): (a) client and vendor records (name, email, phone, and full postal address); (b) invoices and quotes (line items, subtotal, tax amount, total, currency, issue/due/validity dates, status, free-text notes, the sequential fiscal document number, and the VeriFactu integrity hash); (c) recurring-billing configuration for invoices and expenses; (d) expense records (description, amount, category, date, and supplier name); (e) product catalog (name, unit price, description, tax rate); (f) CRM data (contact persons; activity logs including type, title, free-text description and attached metadata; and free-text notes, which may contain any personal data you enter); (g) financial summaries (period revenue, expenses, net profit, invoice counts, and overdue totals); (h) business profile (company name and plan); (i) webhook configuration (endpoint URL, subscribed events, webhook name, status, internal identifiers, and any attached metadata); and (j) record identifiers and creation/update timestamps for each of the above. Government-issued tax identifiers (NIF, CIF, VAT numbers), banking identifiers (IBAN, bank account numbers), webhook signing secrets, and authentication credentials are automatically redacted and are not transmitted to third-party AI assistants; to manage these, use the Frihet web application at app.frihet.io. Because free-text fields (notes, activity descriptions) may contain personal data, avoid storing special-category personal data in them if you use third-party AI integrations. Data transmitted to ChatGPT is handled by OpenAI in accordance with OpenAI's privacy policy and our data processing agreement.

11. Data Controller Contact

For any questions regarding the processing of your personal data or the exercise of your rights, you can contact the data controller at: support@frihet.io. VICTOR BERTHELIUS PATO, C/ Cervera n9, Radazul 38109, S/C de Tenerife, Spain. We are committed to addressing your requests with the utmost diligence and transparency.

12. Frihet Chrome Extension

This section describes version 3.0.0 of the Frihet Chrome extension publication candidate. It does not mean that the extension is available in the Chrome Web Store.

The extension lets you capture and review expenses, select documents and look up records in the connected workspace. A Frihet account and appropriate permissions are required. The interface is available in Spanish and English.

To connect, the extension opens a tab on app.frihet.io. After sign-in, the workspace and permissions are shown and your consent to the connection is requested. Firebase credentials and authentication tokens remain in the web application; API keys are not copied to the extension. The extension receives session, user and workspace identifiers, the workspace name and the permissions needed to show its state. Closing the connection tab, signing out or switching workspace ends the connection. Expenses are not saved automatically while that tab is closed.

Page capture occurs after your explicit action. Visible or selected text is processed locally to propose expense fields. You can correct them before confirming. Incomplete fields require review. On confirmation, the reviewed fields are sent to Frihet through the connection to the web application and its authenticated services. Full page text is not sent. The source address is retained as an origin reference without username, password, query parameters or fragment; a path may contain identifiers, so review the displayed source. A web capture does not attach a receipt copy. The extension does not collect general browsing history or read pages in the background.

If you select a PDF or image, the file is sent to Frihet for storage and processing by its document capture service, including the AI field extraction described in this policy. Processing starts when you select the file and may retain a draft and document before you confirm an expense. Proposed fields, including withholding tax where review is required, must be checked before confirmation. Documents, drafts and expenses stored in Frihet follow the service’s general retention periods and applicable legal requirements; deleting a local extension copy does not delete those server records.

The extension stores preferences and confirmed captures awaiting a response in chrome.storage.local, scoped to the corresponding user and workspace. Access is restricted to extension contexts through TRUSTED_CONTEXTS. This does not encrypt the local file or protect it from someone with access to the system profile. The extension does not store API keys or Firebase tokens. You can delete pending local copies in the extension and remove its local data by uninstalling it.

A submission without acknowledgement remains in Pending and is retried when you request it. Retries preserve the operation identity to avoid duplicates. Changing account or workspace does not authorize sending captures to another workspace. The pending copy is removed after a confirmed response or a review response that did not create an expense. Items older than seven days are removed when the extension runs again or performs periodic maintenance; a closed browser cannot perform cleanup. Full files are not retained in this local queue.

Typed search queries are sent to the connected Frihet workspace and the extension displays a bounded selection of records. Address-bar search may run as you type after activating “frh”. Received data and providers involved in processing are governed by this general policy. The extension has no advertising or analytics of its own.

Data is used for the visible capture, review, search and recovery functions. It is not sold or used for advertising or creditworthiness decisions. For questions or to exercise your rights, contact support@frihet.io.