Legal document

Privacy Policy

Last updated : 2026-04-25

Data controller

The Site and Services are published by Billify, operated as a French sole proprietorship (auto-entrepreneur regime, with no share capital, no commercial register entry, and VAT exemption). Publisher details available on request at probillify@gmail.com (hereinafter “Billify” or “we”).

Under the GDPR, Billify may act:

as data controller for the data required to manage the Site, your account, the commercial relationship, billing, support and security (the “Billify Data”);
as data processor for the data contained in the Documents you upload on behalf of your organisation (the “Organisation”), processed solely on the Organisation’s instructions under a data processing agreement (DPA).

GDPR contact: probillify@gmail.com
Address: available on request at probillify@gmail.com

Data collected

Billify Data (data controller)

Account data: first name, last name, email, company/organisation, role/job title (optional), language, preferences.
Authentication data: technical identifiers, connection logs, passwords stored encrypted/hashed via the authentication provider (never in plain text).
Usage data: pages visited, interface actions, number of sessions, duration, technical errors.
Billing data: plan/subscription, credits, invoice history, accounting information.
Support: exchanges with support (content you choose to share).
Cookies/trackers: see the “Cookies and trackers” section.

Client Data (data processing)

Uploaded Documents may contain personal data (names, contact details, references, financial information). Billify processes it to perform the Services (OCR, extraction, structuring, export).

Documents: invoices, expense reports, receipts, supporting documents, administrative/accounting records.
Data contained in Documents: supplier/client information, employee details, amounts, VAT, dates, references, payment details (sometimes IBAN), addresses, emails, etc.
Extracted data: structured fields produced by the analysis (net/gross amounts, VAT, date, invoice number, supplier, etc.).

Purposes of processing

Purposes relating to Billify Data

Site provision: account creation/management, secure access, preferences.
Service provision: credit management, analysis tracking, availability and performance.
Billing and accounting: subscriptions, payments, invoices, legal obligations.
Support: assistance, incident resolution, customer relations.
Security: fraud and abuse prevention, logs, anomaly detection.
Improvement: aggregated statistical analyses, UX and service-quality improvement.
B2B communications (where applicable): product updates, demos, newsletters (unsubscribe at any time).

Purposes relating to Client Data

OCR and automatic extraction of information contained in the Documents.
Data structuring (accounting/financial fields) to facilitate data entry and export (Excel/CSV/API).
Making results available to the Organisation and its authorised users.

Automated decisions: the Services use automated processing (OCR/structuring). On that basis alone, Billify does not make any decision producing legal effects with respect to you (Article 22 GDPR), without human intervention by the Organisation.

Legal basis

Performance of a contract: providing the Site and Services (account, analysis, exports, service-related support).
Legal obligation: accounting/tax obligations (retention of invoices and accounting records).
Legitimate interest: security, fraud prevention, service improvement, internal statistics.
Consent: only where required (e.g. non-essential cookies, certain marketing communications).

For Client Data, Billify acts as a data processor; the legal basis is determined by the Organisation (typically performance of a contract or legitimate interest).

Retention period

Account and profile data: for the duration of the active relationship, then up to 3 years after the last activity (subject to any contrary legal obligations).
Billing / accounting data: 10 years (legal obligations and evidence).
Technical/security logs: generally 6 to 12 months, unless an incident or dispute requires longer retention.
Client Data (Documents): retained for the time necessary to perform the processing and make results available, then deleted no later than 30 days after upload, unless a specific configuration or contract with the Organisation provides otherwise.
Cookies: variable durations by type; your choice is retained for a limited period.

Recipients

We do not sell your data. It may be accessible:

to authorised Billify teams (support, technical, billing), strictly on a need-to-know basis;
to our sub-processors required for operations (hosting, database, authentication, payment, transactional email, monitoring/security), contractually bound to confidentiality and GDPR compliance;
to competent authorities where required by law or for the defence of our rights.

A list of key sub-processors can be provided on request at probillify@gmail.com.

Transfers outside the EU

Where possible, data is hosted within the European Union, and Billify favours hosting in France where compatible with the architecture and service providers used.

Should a transfer outside the EU be required via certain providers (e.g. international services), it would be governed by appropriate safeguards (standard contractual clauses, supplementary measures), in accordance with the GDPR.

Security, confidentiality & integrity

Billify implements technical and organisational measures appropriate to the risk, including:

Encryption in transit (HTTPS/TLS) between your browser and our servers;
Access control (authentication, sessions, permissions, least privilege);
Logging of relevant events and anomaly monitoring;
Backups and restoration procedures for critical components;
Environment separation (production / testing / development);
Incident management: internal procedures and, where necessary, notification to the supervisory authority and the individuals concerned.

Recommendation: do not upload documents containing data that is unnecessary for the processing (e.g. sensitive information) if you can redact or anonymise it beforehand.

Your rights (GDPR)

You have the following rights, subject to the conditions provided for by applicable regulations:

right of access;
right to rectification;
right to erasure;
right to restriction of processing;
right to object (including to direct marketing);
right to data portability;
right to define post-mortem instructions (French law).

Cookies and trackers

Billify uses strictly necessary cookies for the website to function (session, security, preferences). Other cookies (e.g. audience measurement) are used only where required and in accordance with your choices.

To find out more and manage your preferences: Cookie management.

DPO contact & complaints

For Billify Data: contact us at probillify@gmail.com.

For Client Data: please contact your Organisation first (data controller). You may also write to us; we will handle the request in coordination with the Organisation.

You may also lodge a complaint with the CNIL (French data protection authority): www.cnil.fr.

We may update this policy; the version in force is the one published on this page. In the event of a material change, we will inform you by an appropriate means (notification, email, banner).