1. Who the controller is
The controller of the data described in this policy is SIGNIADIGITAL S.A. (“Flashpi”, “we”), RUC 0993411372001, with its registered address at Av. J. Orrantia 106 y J. L. Benítez, edificio Elite Building, piso 1, parroquia Tarqui, Guayaquil, Guayas, Ecuador.
- Privacy email: privacidad@flashpi.com.ec
- Phone: +593 98 773 7533
2. Scope and our role
Flashpi is an e-invoicing API: businesses integrate it to generate, sign and send their electronic tax documents to Ecuador’s tax authority, the Servicio de Rentas Internas (SRI). Depending on the case, we act in one of two roles:
- As controller, we process the data of people who create a console account or are invited to a team, people who visit this site and people who write to us.
- As processor, we process the data our customers send to the API to issue their documents: for example, data about their buyers, suppliers, withholding subjects and carriers. In that case the controller is the business that issues the document, and we process that data only on its behalf and on its instructions. Section 6 explains this case.
3. Data we process as controller
- Account data: email address, password (if you create one), preferred language, account name, the dates your email was verified and you last signed in, and the version of the terms and this policy in force when you created your user, with the date and time you created it. We never store your password in plain text: only a cryptographic hash (argon2id).
- Google sign-in, if you choose it:
- Google sends us, and we keep while it is linked to your user, the basic information of your Google account that it has: its identifier, your email address and whether Google verified it, the Google Workspace domain if your account belongs to an organization, your full name, your given name and your family name, the address (URL) of your profile picture, not the image, and your language. We update it each time you sign in with Google, and we also keep when we linked your Google account and when you last used it. We use it to identify you when you sign in with Google and to show you in the console which Google account is connected.
- While you sign in with Google, we keep a temporary record of the attempt: your IP address and the data of the form you started from (for example, the account name or the invitation).
- If you sign up with Google, we take your email address as verified only if Google manages it (an @gmail.com address or a Google Workspace account); otherwise we send you the usual verification link. If you create an account with Google without typing a name for it, we give it your Google name.
- If you already have a user with the same email address, we link your Google account to it automatically only if Google manages that address, and we let you know by email. If that user never verified its email address, linking marks its email address as verified, removes its password, closes its sessions and records again the version of the terms and this policy you accept, so nobody else keeps access. Resetting your password unlinks your Google account.
- We never receive your Google password and we do not keep tokens that give access to your Google account. We do not ask Google for other data, such as your birthday, phone number or contacts, nor for access to your email, files or other Google services.
- Two-step verification: if you turn it on, we store your authenticator app’s secret encrypted, and your recovery codes only as cryptographic hashes.
- Team: the email addresses of the people you invite, who invited them, and each member’s role and scope.
- Your issuers’ data: RUC, legal name, trade name, head office and establishment addresses, and tax settings. If the issuer is a natural person, this data is personal.
- API keys and webhooks: for each API key we store only a cryptographic hash, its name, its allowed IP list and when it was last used. For each webhook we store the destination URL and its signing secret, encrypted.
- Technical and security data:
- the IP address and user agent (browser) of each sign-in and session;
- the audit log of actions in your account (what was done, by whom, when, from which IP and with which browser);
- the API request log: method, path without parameters, result, response time, key used and source IP;
- our servers’ technical logs: IP, full request (including its parameters), referring page and user agent.
- Site analytics, only if you accept them: on the public site and the docs, never in the console: the pages you visit, where you came from, your clicks, scrolling and pointer movements, the time on each page, technical data about your browser and your device (type, system, language and screen size), your IP address, from which an approximate location is estimated, and the random identifiers of the analytics cookies. Google Analytics and Microsoft Clarity collect them (section 7); Clarity masks what you type in form fields.
- Communications: if you write to us, your email address and the content of your message. If you write to us on WhatsApp, your phone number, your WhatsApp profile name and the content of your messages. The site’s WhatsApp button opens the conversation with a suggested text about the page or section you were viewing, which you can change before sending; nothing is sent until you send it.
- Billing data: when you sign up for a paid plan, what we need to issue our invoices to you: RUC or cédula, legal name, address and email.
We do not ask for sensitive data and we do not process data about children or adolescents.
4. Why we use it and on what legal basis
| Purpose | Legal basis (LOPDP, art. 7) |
|---|---|
| Creating and managing your account and providing the contracted service | Performance of the contract |
| Creating your account and signing you in with Google, if you choose it, and linking your Google account to your user | Performance of the contract |
| Sending account emails: verification, password reset, invitations, security alerts (for example, when a live API key is revoked) and the notice that we paused emailing your account’s documents | Performance of the contract and legitimate interest in your account’s security |
| Protecting the service: attempt limits, allowed IP lists, the audit log and abuse detection | Legitimate interest and the duty of security (LOPDP, art. 37) |
| Answering your questions and giving support | Performance of the contract or pre-contractual steps at your request |
| Measuring how the public site and the docs are used (pages visited, journeys, heatmaps and session recordings) to improve them, with Google Analytics and Microsoft Clarity, only if you accept it | Consent, which you can withdraw at any time under “Cookie preferences” |
| Issuing our invoices and keeping our accounts | Legal obligation |
| Meeting legal obligations and requests from competent authorities | Legal obligation or court order |
We do not send advertising, we do not sell or rent personal data, and we do not build profiles. If you accept the site analytics, we use them only to measure and improve the pages, never for advertising (section 7). Automatic attempt limits (for example, temporarily blocking sign-in after several failed attempts) are security measures. We make no decisions based solely on automated processing that produce legal effects on you.
5. If you do not give us your data
To create an account we need your email address and a password, or your Google account. To issue documents we need the issuer’s data and its electronic signature certificate. Without them we cannot provide the service. If the data is inaccurate, the SRI may reject the documents, and account notices may not reach you.
6. Data we process on behalf of our customers
When a business issues documents with Flashpi, it sends us data about other people, which we process as processor:
- Buyers, suppliers and withholding subjects: ID type and number (cédula, RUC or passport), name or legal name, address and email, plus any additional information the issuer adds to the document.
- Waybills: the carrier’s ID and name, the vehicle’s plate, and the recipients’ ID, name and address.
- The issuer’s electronic signature certificate: the .p12 file and its password, which may contain a natural person’s name and ID.
We use it only to:
- read the RUC or the cédula and the name of its holder or organization from the certificate when the customer adds an issuer or renews its signature, to propose the RUC (with a cédula, the cédula followed by 001) and the legal name, which the customer reviews and completes;
- generate, sign and send the documents to the SRI and check their authorization;
- generate the RIDE PDF;
- email the RIDE and XML to the buyer, when the issuer asks us to;
- send events to the webhook URLs the issuer set up;
- store the documents so the issuer can look them up and download them.
The Data Processing Agreement, which is part of our terms, governs this processing.
If you are a buyer or supplier of one of our customers, the controller of your data is the business that issued the document. Please send your requests to it. If you write to us, we will forward your request to it without delay and help it answer you.
7. Who we share data with
| Recipient | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS), as processor | Hosting: servers, database, file storage, encryption keys, queues, technical logs and email sending, document emails included (Amazon SES) | United States (us-east-1 region) |
| Resend (Plus Five Five, Inc.), as processor | Sending account emails: verification, password reset, invitations, security alerts and the notice that we paused emailing your account’s documents. It does not send document emails | United States |
| Servicio de Rentas Internas (SRI) | Receiving and authorizing the documents, as the issuer’s tax obligation | Ecuador |
| Certification authorities that issued the certificate | Checking whether the certificate is valid or revoked. We only send certificate data, such as its serial number | Ecuador and other countries, depending on the authority |
| Our company email provider (Purelymail) | Receiving and answering the messages you send us | Outside Ecuador (its servers are on AWS) |
| WhatsApp (Meta), only if you write to us on that channel | Receiving and answering the messages you send us on WhatsApp | United States and other countries where WhatsApp processes data |
| Google LLC (Google Analytics), as processor under its data processing terms | Measuring the use of the public site and the docs, only if you accept the analytics | United States and other countries where Google processes data |
| Microsoft Corporation (Microsoft Clarity), which according to Microsoft acts as controller | Heatmaps and session recordings of the public site and the docs, only if you accept the analytics | United States and other countries where Microsoft processes data (Microsoft Azure cloud) |
| Webhook URLs set up by the customer | Notifying status changes of their documents | Wherever the customer chooses |
| Competent authorities | When a law or a court order requires it | Ecuador |
Resend keeps a copy of each account email (recipient, subject and content) in the United States for up to 30 days, plus 7 days in backups, and may review a small sample of emails through automated analysis to prevent abuse.
If you choose to sign in with Google, you identify yourself on Google’s pages, and Google LLC (United States) sends us the data of your Google account listed in section 3. Google acts as an independent controller, not as our processor: it processes your data under its own privacy policy and knows that you used your Google account to sign in to Flashpi. We only send it what the sign-in needs, such as the language of its screens: we do not send it your email address or other data of your Flashpi account, nor the email address of an invitation. When the console displays your Google profile picture, your browser loads it from Google’s servers, which receive your IP address and browser information. We omit the referring page’s address from that request.
Site analytics, only with your consent. If you accept the analytics on the public site or the docs, your browser loads Google Analytics and Microsoft Clarity and sends them the analytics data of section 3 directly. If you reject them, or until you choose, neither loads and your browser sends them nothing; the console never loads them. In Google Analytics we turn off Google signals and ad personalization, and deny all storage for advertising (Google’s consent mode); Google processes this data on Flashpi’s behalf under the Google Ads Data Processing Terms, which govern Google Analytics, and its privacy policy. We tell Clarity, through its consent API, that you accepted analytics storage and not ad storage. Microsoft states that in Clarity it acts as a controller, under the Microsoft Privacy Statement; Clarity may also use Microsoft’s own cookies on its domains (clarity.ms and bing.com), which we cannot delete from this site.
WhatsApp, only if you write to us on that channel. The site’s WhatsApp button is a link: until you use it, your browser sends nothing to WhatsApp. If you write to us on WhatsApp, you are using a service of WhatsApp (Meta), which processes your data under its own privacy policy.
Our emails, both account and document emails, reach the recipient’s email provider. They are sent encrypted (TLS) when the receiving server supports it.
8. International transfers
Our servers are in the United States (AWS, us-east-1 region), and Resend, which sends account emails, also keeps its data there. The United States has no adequacy declaration from Ecuador’s Superintendencia de Protección de Datos Personales. We protect that data with:
- AWS’s data protection contract terms as processor;
- encryption of data in transit and at rest;
- the access controls described in section 10.
Some certification authorities answer from other countries, but they only receive certificate data.
If you accept the site analytics, Google Analytics (Google LLC) and Microsoft Clarity (Microsoft Corporation) receive your analytics data in the United States and in other countries where they process data. That transfer takes place with your consent, which you can withdraw at any time (section 11).
If you write to us on WhatsApp, your messages pass through WhatsApp (Meta), in the United States and in other countries where it processes data, because you choose that channel. If you would rather avoid that, write to us by email.
9. How long we keep data
| Data | Period |
|---|---|
| Account and team data | While the account is active and 90 days after it is closed |
| Data of your linked Google account | While it is linked to your user and, at most, as long as the account data. Deleted earlier if you reset your password or ask us to unlink it |
| Google sign-in attempts | Deleted within 24 hours |
| Production documents (data, XML and RIDE) | 7 years from issuance, because of the issuer’s tax obligation. If the customer closes its account, they are deleted 30 days after closure |
| Sandbox document files (XML and RIDE) | 90 days |
| Uploaded .p12 file | Deleted once the certificate’s registration finishes, whether it is accepted or rejected at that step. If the certificate is never registered (an issuer onboarding rejected when its certificate is checked, or one left unfinished), it is deleted automatically within 8 days of receiving it |
| Data of an issuer onboarding from its certificate: the holder, their ID and the certificate’s public data | 30 days after the onboarding is completed, expires or is rejected |
| Encrypted signature certificate | While the issuer keeps it registered and 30 days afterwards |
| API request log | 30 days |
| Copies of account emails at Resend | Up to 30 days from sending, plus 7 days in backups |
| Addresses suppressed at Resend (bounces and complaints) | Until we remove them: when the account is closed, or when the person asks even without an account |
| Server technical logs | 90 days |
| Database backups | 7 days |
| Audit and session records | 2 years |
| Support messages, including those you send us on WhatsApp | 2 years |
| Analytics data in Google Analytics, at user and event level | 14 months, the period we set in Google Analytics. Aggregated reports, which identify no one, are kept afterwards |
| Analytics data in Microsoft Clarity | Session recordings: 30 days, except recordings marked as favorites and a random sample of recordings, which Microsoft keeps for up to 9 months. Heatmaps and click data: up to 9 months (periods Microsoft sets) |
| Billing data | 7 years, because of tax obligations |
When the period ends, we delete or anonymize the data, unless a law requires us to keep it longer.
10. How we protect data
- Encryption in transit: the site and the API only work over HTTPS (TLS 1.2 or later).
- Encryption at rest: on AWS we use AWS KMS keys managed by Flashpi, with automatic rotation. Resend stores its copies of account emails encrypted.
- Signature certificates: the certificate and its password are stored encrypted (AES-256-GCM), and only the signing service can decrypt them.
- Credentials: passwords, API keys and recovery codes are stored as cryptographic hashes. Two-step verification secrets and webhook secrets are stored encrypted.
- Network: the database sits on a private network with no internet access, and a web application firewall protects the site and the API.
- Staff access: only authorized staff reach the internal tools, with two-step verification and through a restricted channel. Their lookups of customer data are logged. The Resend dashboard, which shows the account emails of the last 30 days, is used only by Flashpi’s administrator, with two-step verification.
If a security breach affects your data, we will notify Ecuador’s Superintendencia de Protección de Datos Personales and, when there is a risk to you, you as well, within the LOPDP deadlines.
11. Your rights and how to exercise them
You can exercise these rights at any time and free of charge:
- access;
- rectification and update;
- deletion;
- objection;
- portability;
- suspension of processing;
- not being subject to decisions based solely on automated processing.
Where processing is based on your consent, you can withdraw it whenever you want, without affecting earlier processing. You withdraw the site analytics under “Cookie preferences”, at the foot of every page of the site and the docs, by choosing Reject, as easily as you accepted them: we delete the analytics cookies from your browser and no longer load Google Analytics or Microsoft Clarity. What they already received is kept as section 9 says; to ask for its deletion, write to us.
Write to privacidad@flashpi.com.ec and include:
- your names and ID number;
- the right you are exercising and the data it concerns;
- a way to reply to you;
- if you act for someone else, the document that shows it.
We may ask you to confirm your identity. We answer within the LOPDP deadlines. Some data we cannot delete while a law requires us to keep it; for example, authorized tax documents.
If you are not satisfied with our answer, you can file a complaint with Ecuador’s Superintendencia de Protección de Datos Personales.
12. Cookies and browser storage
This site and the docs only use analytics cookies and third-party scripts (Google Analytics and Microsoft Clarity) if you accept them; until you choose, or if you reject them, they use none. The console uses no analytics or third-party scripts, and only first-party cookies that are strictly necessary for it to work:
| Name | Purpose | Duration |
|---|---|---|
__Host-flashpi_session | Keeping you signed in | Up to 12 hours (ends after 2 hours of inactivity) |
__Host-flashpi_csrf | Protecting your actions against forged requests | Same as the session |
__Host-flashpi_verification | Binding your email verification to your browser | 24 hours |
__Host-flashpi_google | Protecting Google sign-in against forged requests | Up to 10 minutes |
If you accept the analytics on the public site or the docs, Google Analytics and Microsoft Clarity keep these cookies in your browser, on the flashpi.com.ec domain:
| Name | Whose and what for | Duration |
|---|---|---|
_ga | Google Analytics: telling visitors apart with a random identifier | 2 years |
_ga_GW6FTDQXQM | Google Analytics: keeping the state of the visit | 2 years |
_clck | Microsoft Clarity: keeping its visitor identifier and its preferences | 1 year |
_clsk | Microsoft Clarity: joining the pages of a visit into one recording | 1 day |
Clarity also keeps a tab identifier in your browser’s session storage (_cltk), which is deleted when you close the tab. If you withdraw your consent, we delete it along with the cookies.
Your choice is kept in your browser’s local storage (flashpi.analytics-consent), not in a cookie, and is sent to no server. If your browser sends the Global Privacy Control signal, we treat it as a rejection. You can change your choice at any time under “Cookie preferences”, at the foot of every page of the site and the docs; if you withdraw it, we delete the analytics cookies and no longer load Google Analytics or Microsoft Clarity.
The console and the docs also keep a few preferences in your browser: theme, language, the last account you used and the state of an email verification, an invitation or a Google sign-in in progress. They are technical preferences and you can clear them from your browser.
13. Electronic communications
We only send emails related to the service. Accounts use no-reply@flashpi.com.ec and no-reply@notify.flashpi.com.ec, and documents use comprobantes@flashpi.com.ec, on the issuer’s behalf. We do not send advertising emails. If you subscribe to the blog newsletter, we will only send it with your consent, and you can unsubscribe at any time by replying to the email.
14. Changes to this policy
We may update this policy. We will publish each version on this page with its effective date. If a change is significant, we will let you know by email or in the console before it takes effect.
Versions
- November 9, 2026: we added WhatsApp as a contact channel of the site (sections 3, 7, 8 and 9).
- October 29, 2026: Resend also sends the notice that we paused emailing your account’s documents (sections 4 and 7). We added analytics on the public site and the docs with Google Analytics and Microsoft Clarity, only with your consent (sections 3, 4, 7, 8, 9, 11 and 12). We added issuer onboarding from the signature certificate, from which we read the RUC or the cédula and the holder, and how long we keep its data and the .p12 file (sections 6 and 9).
- October 24, 2026: we added Google sign-in (sections 3, 4, 5, 7, 9 and 12).
- October 23, 2026: we added Resend as the provider of account emails (sections 7, 8, 9, 10 and 13) and, to your account data, the version of the terms and this policy in force when you created your user (section 3).
- October 21, 2026: first version.