Last updated: 8 October 2026
Privacy Policy — EXOfattura
This Privacy Policy describes how EXOBYTE S.r.l.s. processes personal data for the EXOfattura cloud platform and the EXOfattura mobile apps on iOS and Android (Apple App Store / Google Play), under the EU GDPR and applicable Italian law.
1. Data controller
EXOBYTE S.r.l.s.
VAT / Tax ID: 04023700786
Registered office: Via Prima Piana 16, 87075 Trebisacce (CS), Italy
Email: info@exobyte.it
PEC: info@pec.exobyte.it
Product site: https://exofattura.it/
App / web app: https://app.exofattura.it
2. Scope
This Policy covers the EXOfattura web platform, native mobile apps, related portals (e.g. employee access, e-signature), and service communications (email, SMS, push where enabled). EXOfattura is a B2B service. Customer/supplier data uploaded by business customers is typically processed by Exobyte as a processor on behalf of the customer (controller).
3. Data we process
- Account data: name, email, role, hashed credentials, passkeys / device biometrics outcome;
- Company data: legal name, VAT/tax ID, address, PEC, SDI code, contacts, IBAN if provided;
- Business documents: invoices, quotes, orders, delivery notes, contracts, attachments (including camera photos if used);
- Payment references (e.g. Mollie): amounts, status, payment IDs — we do not store full card numbers;
- Technical data: IP address, user agent, access logs, session IDs, push tokens (APNs/FCM), app update identifiers;
- Device permissions (only if granted): camera/photos, location (if a feature needs it), notifications, biometrics via the OS.
4. Purposes and legal bases
- Contract: providing the service, app access, support, billing;
- Legal obligation: fiscal document retention, e-invoicing (SDI) requirements;
- Legitimate interest: security, abuse prevention, reliability;
- Consent where required (e.g. optional push, non-essential cookies on the website).
5. Recipients
Hosting and infrastructure providers; Italian e-invoicing / Peppol channels; Mollie B.V. for payments; e-signature / SMS providers if modules are enabled; Apple / Google for push delivery; authorities when required by law. We do not sell personal data for advertising. Exobyte is not a payment acquirer and does not hold end-customer funds.
6. International transfers
Where providers process data outside the EEA, we use appropriate safeguards (e.g. EU Standard Contractual Clauses).
7. Retention
Account data for the relationship duration plus legal needs; fiscal documents per statutory periods; security logs for limited periods; push tokens until permission is revoked, the app is uninstalled, or the account is deleted.
8. Your rights
You may request access, rectification, erasure, restriction, portability and objection under GDPR by emailing info@exobyte.it. You may lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
9. Account & data deletion (App Store / Play Store)
Request account deletion from in-app / web settings where available, or by emailing info@exobyte.it from your registered address with subject “EXOfattura account deletion”. After identity verification we close the account and delete or anonymize personal data not subject to legal retention (e.g. fiscal records), usually within 30 days.
10. Children
The Service is for businesses and professionals and is not directed to children under 16. We do not knowingly collect children’s data.
11. Cookies (website)
The website uses essential session cookies, infrastructure cookies, and anti-abuse tools on public forms. No advertising profiling cookies. Details: Exobyte cookie notice. The native app does not use browser advertising cookies.
12. Updates
We may update this Policy. The current version is published at https://app.exofattura.it/privacy-en (Italian: /privacy).
See also the Terms of Service · Termini (IT).