Legal

Privacy notice

Last updated: October 16, 2026

CapValida is a bulk CFDI (Mexican e-invoice) validation service against the SAT, a Capdesis product. This notice describes how personal data is processed on the landing site (capvalida.com), in the web dashboard (app.capvalida.com) and in the CapValida mobile app for Android and iOS.

Data controller

The data controller is CAPDESIS S.A. DE C.V., tax ID (RFC) CAP2110299Q0, registered address Guamuchil 118, Colonia Pedregal de Santo Domingo, Coyoacán, Mexico City, C.P. 04369, Mexico. Contact: [email protected], WhatsApp +52 55 6186 9139.

Data we process

• Account: email address and password. The password is stored only as a hash, never in clear text.
• Validation batches: from each XML (CFDI 4.0) you upload we extract the invoice data (UUID, series, folio, issuer RFC and name, recipient RFC, total, currency, date, payment form and method, CFDI use and voucher type) and we store the SAT query result. The full XML is not stored; the file name is.
• Bulk downloads (optional): if you use the Downloads feature, your certificate (.cer), private key (.key) and e.firma password, and the XML packages downloaded from the SAT on your behalf. See the e.firma section.
• Store purchases (App Store and Google Play): transaction identifier, product, plan and validity period. To validate a purchase, the app sends our server over HTTPS the signed Apple transaction or the Google purchase token; for Google Play we store only a SHA-256 hash of that token, never the token.
• IP address: we use it to limit attempts at sign-up, sign-in, password recovery, resending and verifying the email, as a security measure and to prevent abuse. Data export requests also store the IP address they came from.
• Data exports: when you request a copy of your data we store the date, the file size and the IP address the request came from.
• Support: messages you send us by email or WhatsApp.

We will never ask for your SAT password or your e.firma to validate invoices: the status query uses the public SAT service.

e.firma (FIEL) and bulk download

The e.firma is used only by the Downloads feature. You upload the .cer, the .key and the password. The service checks that the three match each other and uses the e.firma only to sign, toward the SAT bulk-download services, the requests you start.

Storage: the .cer, the .key and the password are stored together in an encrypted block using AES-GCM. The encryption key is in the server configuration, not in the database. The original files are not stored in plain text.

Retention and deletion: the encrypted block and the SAT session token are deleted when the download finishes, when it fails, or when 72 hours have passed since the job was created. Expiry is applied when the job is next queried.

Downloaded packages: the XML packages we obtain from the SAT are stored as ZIP files in the service storage. In the current version, deleting the account does not delete those files; see Retention periods.

Processors and third parties

These are the providers that receive data to operate the service:

• Resend (United States): sends account emails, such as verification, password recovery and download notices. It receives your email address and the message content.
• Cloudflare Turnstile (Cloudflare, Inc.): anti-bot verification on sign-up, sign-in and password recovery. It receives the verification token generated by your browser and the IP address the request comes from, which the CapValida server sends to Cloudflare to validate the token. The mobile app (Android and iOS) does not generate or send this token, so its requests send nothing to Cloudflare for this purpose.
• Cloudflare R2 (Cloudflare, Inc.): storage of files the service generates: batch Excel files, SAT XML packages and data exports.
• Apple (App Store) and Google (Google Play): purchase validation and subscription notifications. They receive purchase identifiers.
• Stripe: online charging of web subscriptions, when that feature is active. Card data is processed by Stripe; CAPDESIS does not store it.
• PostHog (us.i.posthog.com by default): usage analytics for the web dashboard, only if you accept in the cookie banner. Separately, the CapValida server sends PostHog a server-side event, capdesis_payment_succeeded, when Stripe confirms a web payment: it includes your CapValida account identifier (or your Stripe customer identifier if there is no linked account), the plan, the amount in the currency's smallest unit, and the currency. This event does not depend on your choice in the banner; it is sent only if the server has a PostHog key configured.
• Firebase Crashlytics (Google): crash reports. It is off by default: collection starts disabled and is enabled only in builds configured with ENABLE_CRASHLYTICS and the FIREBASE_* values, which store versions do not use today. When active, it sends error stack traces, device model and app version, and non-fatal reports of API network failures: 5xx responses, timeouts, connection errors and TLS certificate errors, with the request path (app/lib/core/observability/observability_bootstrap.dart, shouldReportDioError). When the Android build is published, its debug symbol mapping file is also uploaded to Firebase; it contains no user data.
• SAT bulk-download and query services (tax authority): receive the RFC, dates and identifiers needed for the queries and downloads you request.
• Hosting: servers and a PostgreSQL database operated by CAPDESIS on infrastructure contracted from a hosting provider.

We do not sell your personal data. Apart from the providers above and the authorities, we do not share it with third parties.

Retention periods and account deletion

While your account is active we keep your batches, validations and download jobs.

When you delete your account from the app or the web, the database deletion happens in a single operation. Batches and their validations, invoice data of your account, download jobs (with their encrypted e.firma block, their SAT session token and their notification email) together with their recorded packages, and pending email verification and password recovery tokens are removed. The user record is kept as a deletion record: its email and password are replaced, it cannot be used to sign in, and the email address can register again.

After deletion we keep, with no automatic deletion period in the code: the user record without sign-in data (internal identifier, creation date, deletion date and, if it existed, the email verification date); the subscription records (plan, status, Stripe customer identifier and last update date) and the monthly validation counters, both linked to your account identifier or your Stripe customer identifier; the store purchase records (transaction identifier, product, plan, status, environment, validity and purchase dates); the data export log (date, size, number of files, request IP address and generated file key); and the log of received Stripe events (provider, identifier, type and date, without account data).

Generated files (batch Excel files, SAT XML packages and data exports) are not deleted with the account in the current version: we delete them on written request. Database backups may contain your data until they are rotated.

How to delete your account and what data is removed

Cookies and analytics

The landing site (capvalida.com) is static HTML with no JavaScript of its own: it sets no cookies, runs no analytics and loads no third-party resources.

The dashboard (web app) sets an HttpOnly session cookie named cv_session, which lasts 15 minutes, to keep you signed in. It loads PostHog only if you allow it in the consent banner: without your acceptance the browser loads no usage analytics. If your browser sends the Do Not Track or Global Privacy Control signal, it is not loaded either, even if you accepted. Your choice is stored in the browser as the capvalida_analytics_consent item; you can change it with the Cookies button in the dashboard footer or by deleting that item. These rules do not apply to the server-side event described under Processors and third parties.

The mobile app does not use third-party usage analytics. Crash reports are described under Processors and third parties.

Legal framework and ARCO rights

Processing is governed by the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette on March 20, 2025 and in force since March 21, 2025. The competent authority is the Secretaría Anticorrupción y Buen Gobierno, following the dissolution of INAI.

You can exercise your rights of access, rectification, cancellation and objection (ARCO) by writing to [email protected] or on WhatsApp at +52 55 6186 9139. If you believe your request was not handled, you may go to that Secretariat.