Privacy Policy

1.Who we are

The data controller for Facticy is the operator of facticy.com. For any privacy matter you can reach us at privacy@facticy.com.

2.What data we process

• Account data: your email and authentication credentials (stored only as a hash).
• Document content: the files you upload (PPTX, DOCX, PDF), pasted text, and any source Excel model.
• Analysis results: extracted claims, verdicts, scores and annotations derived from your documents.
• Usage & billing metadata: token counts, estimated cost and plan limits.
• Technical data: minimal server logs (timestamps, document IDs, error codes) — never document content.

3.Where your data is hosted

Your files are stored on Cloudflare R2 in its EU jurisdiction and encrypted at rest. The application runs on servers located in Germany (EU).

4.How we use your data

• To provide the analysis you request (extract, verify and annotate your documents).
• To operate your account, enforce plan limits and prevent abuse.
• To keep the service secure and to diagnose and fix problems.

5.Who processes your content

To verify claims, the text of your document is sent to our AI sub-processors (Anthropic, OpenAI, Google). Unless you use Confidential mode, claim text and the document's subject may also be used in web-evidence searches, and slide images may be analysed by OpenAI vision.

The full, current list is on the Sub-processors page. We never sell your data or share it for advertising.

6.We never train AI on your data

Your documents are never used to train any AI model. Where a provider allows it, we disable their retention of prompts and outputs.

7.Confidential mode

When you upload in Confidential mode, no web search is performed and no slide images leave the platform. Verification runs only against your own source model and the document's internal consistency; only text reaches no-training AI providers.

8.Retention & deletion

• You choose, per upload, how long we keep your original file: keep until you delete it, delete right after analysis, or auto-delete after 30 or 90 days.
• Deleting a document removes its files and derived data from our systems.
• Deleting your account removes your documents and personal data (aggregate, non-identifying billing counters may be retained).

9.Legal bases (GDPR)

• Performance of our contract with you — to run your account and deliver the analysis.
• Your consent — for optional processing such as external web research on non-confidential uploads.
• Our legitimate interest — in securing, maintaining and improving the service.

10.International transfers

Some sub-processors (Anthropic, OpenAI, Google, Resend) are located in the United States. Where personal data leaves the EEA, it is protected by Standard Contractual Clauses or an equivalent safeguard.

11.Security

We encrypt data at rest, serve everything over TLS, scope every document to its organisation and check access on every request. See the Security page for details.

12.Your rights

• Access, rectify, erase, restrict, object to or port your data.
• Withdraw consent at any time (without affecting prior processing).
• Lodge a complaint with your supervisory authority.
• Exercise any of these from your account or by writing to privacy@facticy.com.

13.Cookies & local storage

We use no advertising or tracking cookies. We store a small amount of strictly necessary data in your browser — see the Cookies page.

14.Children

Facticy is a business tool not intended for anyone under 18, and we do not knowingly collect their data.

15.Changes

We may update this policy; material changes will be announced in the app or by email. The date above reflects the current version.