Privacy Policy

The data controller for personal data processed through this website is:

Billingz EOOD
Registered office: Vranya Str. 32, fl. 4, ap. 11, Sofia 1233, Bulgaria
Company registration number (EIK): 208766693
VAT number: BG208766693
Email for privacy matters: privacy@billingz.com

We only collect personal data that you actively and voluntarily provide to us, plus a limited amount of technical data automatically generated when you visit the site.

2.1 Data you provide directly

When you submit a form, sign up for early access, or otherwise contact us, we may collect:

• Your name
• Your email address
• Business or professional information you choose to share (role, company, country)
• The content of any messages, inquiries, or feedback you submit

2.2 Data collected automatically

When you visit billingz.com, we and our infrastructure providers automatically collect basic technical data, including:

• IP address (anonymized where possible)
• Browser type and version
• Device type and operating system
• Pages visited and timestamps
• Referring URL (where you came from)

This data is used to operate the site, prevent abuse, and understand aggregate usage patterns. It is not used to identify individual visitors. There is no analytics or advertising script on the site or in the product.

When you register for and use the Billingz product, we additionally process:

• Account data: email address, password (stored hashed), name, and sign-in identifiers (Sign in with Google or Sign in with Apple)
• Company profile: business name, address, tax or VAT identifiers, bank details you choose to store for your own invoicing, currency, and preferences
• Product data: invoices, clients, expenses, cash entries, and settings you create in the product
• Billing data: subscription plan, billing address, VAT number if provided, and payment status. Card details are collected and stored by Stripe, not by us; Take a NAP (Софтауеър ООД) issues and emails the fiscal receipt Bulgarian law requires for card payments, from the first payment
• Trying without an account: what you type while looking around before you have an account is kept on our servers for 30 days, then deleted, unless you create an account and keep it
• Service emails: emails about your account, your documents and your plan. The Monday mirror email is on by default and can be switched off under Settings, Emails; security emails always come
• Technical data: log data, device and app version, IP address, and diagnostic events needed to operate and secure the product. The IP address is also stored with each consent you give (sign-up, agreeing to the terms, withdrawing it), as evidence
• Security data: if you turn on two-step sign-in, the key for your authenticator app (stored encrypted) and your recovery codes (stored only as hashes); records of failed sign-in attempts (address and connection, kept 24 hours)
• Consent record: the version of the Terms you accepted, your marketing choice, the connection address and the time
• People you invite: if you give your accountant or a viewer access, their login, and a record of what they change in your books, under their name
• Payment connections: if you connect your own Stripe account to send payment links, its key, stored encrypted
• Calendar link: if you add your Billingz calendar to your phone or calendar app, we create a private link for it. Your calendar provider (for example Apple or Google) then reads your due dates through that link and keeps its own copy, under its own privacy terms. Client names and amounts are left out unless you switch them on. Anyone who has the link can read it, so keep it private. You can cancel it at any time in Billingz, and the old link stops working at once.
• Support requests: when you ask for a person from the Say or ask box, your message, your login, the business and plan, the page you were on, and the last lines of what you said to the box before it, so we can answer without asking you again. We use them to answer you, and to see which questions come up most, so the box can answer them itself
• What you say or type in the box: used to carry out what you asked. Conversations are kept for 30 days, as section 2b says, then deleted; only the last lines go with a support request. Speech is turned into text by your browser: Chrome sends the sound to Google, Safari to Apple. Billingz receives only the text

Where product data contains personal data about your own clients or contacts, you act as data controller for that data and Billingz acts as your data processor under the Billingz Data Processing Agreement.

Product data is processed to provide the Service under the Subscription Terms (Art. 6(1)(b) GDPR), to meet accounting and tax obligations (Art. 6(1)(c)), and to secure the product (Art. 6(1)(f)). Support requests are answered as part of the Service (Art. 6(1)(b)); seeing which questions come up most is our legitimate interest in improving it (Art. 6(1)(f)). Our own billing and invoicing records for your subscription are retained as Bulgarian accounting and tax law requires (up to 10 years).

You can delete your account from within the product settings. Deletion is scheduled 30 days ahead, and signing in before then cancels it. On that day everything else is erased. Backups are kept for 35 days; an account restored from a backup is erased again the next day.

Billingz has an AI assistant, Ask Billingz. It works only when you write or speak to it.

What it receives. Your message, the recent conversation, and the facts it needs to answer: for example your runway, your open invoices, or the page you are on. It never receives your password. Billingz never holds your card details.

Where it runs. On Google Cloud, within the European Union (Vertex AI, EU region). Google acts as our processor. Google does not use your data to train AI models. Under its cloud terms, Google may keep prompts for a limited time to detect abuse.

Why. To answer your questions and to prepare what you ask for, as part of the service you use (Art. 6(1)(b) GDPR).

What it decides. Nothing on its own. It answers and prepares; you decide and confirm. It gives signals, not financial, tax or legal advice.

How long we keep the conversations. 30 days, so it can follow up and so we can check the quality of its answers. Then they are deleted. Deleting your account deletes them too.

Your choice. You can always write to Billingz instead, from the ? menu or at support@billingz.com.

We process personal data only for the following purposes:

• Responding to your inquiries, when you contact us via email or a form
• Providing early access to Billingz, sending product updates, launch notifications, and onboarding information to people who join the waiting list
• Investor and partnership communication, managing dialogue with potential investors, partners, advisors, and contributors
• Operating and securing the website, basic technical operation, abuse prevention, performance monitoring
• Complying with legal obligations, record-keeping required by Bulgarian and EU law

We do not use personal data for automated decision-making, profiling, advertising, or any purpose unrelated to the above.

Under the EU General Data Protection Regulation (GDPR), we rely on the following legal bases:

• Performance of a contract, to provide the Billingz product you signed up for (Art. 6(1)(b) GDPR)
• Consent, when you submit a form or join the waiting list, you consent to us using your information for the stated purpose. You can withdraw consent at any time.
• Legitimate interest, for operating and securing the website, responding to direct inquiries, and managing investor or partnership conversations
• Legal obligation, where data must be retained or processed under Bulgarian or EU law

Your personal data is accessed only by:

• Authorized members of the Billingz team, on a need-to-know basis
• People you yourself give access to your account, such as your accountant
• Service providers we use to operate the website and the product and to communicate with you (email, hosting and payments), all of which are bound by data processing agreements and EU-adequate transfer mechanisms
• Our external accountant, Kolhida Finans OOD (Sofia), for our bookkeeping and tax filings
• Public authorities, where required by law

We do not sell, rent, or trade your personal data with any third party for marketing or advertising purposes.

Billingz operates from the European Union and uses EU-based infrastructure where possible. Where data is transferred outside the European Economic Area (e.g., to service providers based in the United States), we rely on Standard Contractual Clauses (SCCs) or other adequacy mechanisms approved by the European Commission to ensure your data remains protected.

We keep personal data only as long as necessary for the purpose it was collected:

• Inquiries and contact form submissions, up to 24 months from the last interaction, then deleted unless you have an active relationship with us
• Waiting list email addresses, until you withdraw your consent, and at the latest 12 months after the public launch (3 November 2027)
• Investor and partnership correspondence, for the duration of the relationship plus a reasonable period afterwards, as Bulgarian accounting and tax law requires (up to 10 years)
• Security and log data: failed sign-in attempts 24 hours; sign-in history 12 months; copies of service emails we send you (account, plan, notices) 13 months; copies of documents you send to your clients stay with the document in your account; our internal access log 24 months
• Support requests, kept in the product for as long as the account they were sent from, and erased with it. The copy in our support mailbox follows the rule for inquiries above: up to 24 months from the last interaction

You can request earlier deletion at any time (see Section 9).

We use reasonable and industry-standard technical and organizational measures to protect personal data from unauthorized access, alteration, disclosure, or destruction. These include encryption in transit (HTTPS), access controls, secure backup procedures, and limiting access on a need-to-know basis.

No system is perfectly secure, but we treat your data with the same level of care we expect from services we use ourselves.

Wherever you are, you have the following rights:

• Right of access, request a copy of the personal data we hold about you
• Right to rectification, ask us to correct inaccurate or incomplete data
• Right to erasure (“right to be forgotten”), ask us to delete your data, subject to legal limitations
• Right to restriction of processing, ask us to stop processing your data while a question is being resolved
• Right to data portability, receive your data in a structured, commonly used, machine-readable format
• Right to object, object to processing based on legitimate interest
• Right to withdraw consent, at any time, where processing is based on consent
• Right to lodge a complaint, with the Bulgarian Commission for Personal Data Protection (CPDP) or the supervisory authority in your country

To exercise any of these rights, email us at privacy@billingz.com. We will respond within 30 days.

billingz.com sets no cookies. The Billingz application sets only the ones it needs to work. For details, see our Cookie Policy.

Billingz is intended for adults operating professionally. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected such data, we will delete it promptly.

We may update this Privacy Policy as Billingz evolves or as legal requirements change. The “Last updated” date at the top of this document reflects the most recent revision. We email every account holder when a new version is published.

For any privacy-related questions, requests, or concerns, contact:

Billingz EOOD
Email: support@billingz.com
Address: Vranya Str. 32, fl. 4, ap. 11, Sofia 1233, Bulgaria

Person responsible for data protection: Radovan Vitoshevich, privacy@billingz.com, +359 888 360 141. Billingz has not appointed a data protection officer and is not required to. For everything else, support@billingz.com.

You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни / CPDP) at www.cpdp.bg, or with the supervisory authority in your country of residence.