Privacy Policy

Billify (billify.org) is run by BCCBGROUP S.R.L., Str. Sub Cetate nr. 146, ap. 8, 407280 Florești, Cluj County, Romania, trade register J12/1203/2020, tax ID (CUI) 42466228. For anything about your data, write to help@billify.org.

We are the controller of your account data. For the data you put on invoices about your own clients (their names, emails, addresses, amounts), you are the controller and we process it for you, only to provide Billify.

• Account: email, name, and your password (stored only as a secure hash by our authentication provider).
• Business details you add: company name, tax ID, address, phone, logo, IBAN, payment link, wallet addresses.
• Invoices and clients you create, and the e-invoice files and PDFs made from them.
• Payments: payment status, amounts, transaction hashes and wallet addresses, and the lines of bank statements you upload. Card details for subscriptions are handled by Stripe; we never see your card number.
• Connections: API keys you create (we store only a hash) and the AI apps you connect (ChatGPT, Claude, Grok).
• Messages you send to support, and pilot or waitlist requests (email, and what you tell us).
• Technical data: IP address, browser and device, pages viewed on invoices you share, and server logs, used to run and secure the service.
• Analytics cookies, only if you accept them (see section 7).

• To provide Billify (creating, sending and tracking invoices, matching payments, exports): to perform our contract with you.
• To bill your subscription and keep accounting records: contract and legal obligations.
• To keep Billify secure and prevent abuse: our legitimate interest.
• Service emails (invoice sent, payment received, account notices): contract.
• Occasional emails about Billify features: our legitimate interest in telling customers about the service. Reply or write to us and we stop.
• Analytics: only with your consent.

We use these providers, each only for its part of the service:

• Supabase: database, sign-in and server functions, hosted in the EU (Ireland).
• Vercel: website hosting.
• Resend: sending emails, such as the invoices you send to your clients.
• Stripe: payment of Billify subscriptions.
• OpenAI (directly or through the Lovable AI gateway): writing email text and AI suggestions when you use those features.
• Google: Analytics (only with your consent) and web fonts.
• PayAI and Coinbase: confirming payments made by AI agents (x402), with the payer's wallet address and the transaction.
• Public blockchain nodes: checking payments to your wallet address.
• ANAF and the EU VIES service: the tax IDs you look up.
• AI apps you connect (ChatGPT, Claude, Grok): they receive the results of what you ask them to do with Billify, under their own terms.

Some providers are outside the EU, mainly in the United States. Where that happens, transfers rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. We do not sell personal data.

Each invoice has a private link. Anyone who has the link can open the invoice, so share it only with your client. These pages are not listed for search engines.

Blockchain transactions are public and permanent. We can delete what Billify stores, but nobody can delete a transaction from a blockchain.

• Account and invoice data: while your account exists. When you delete your account, we delete it.
• You may have to keep your invoices for years under your country's accounting rules. Export them before you delete your account.
• Our own records of your subscription payments: as long as Romanian accounting law requires.
• Server logs: for a limited time, for security.

Billify uses the storage your browser needs to keep you signed in and remember your settings. Google Analytics cookies are set only if you click "Accept" on the cookie banner. You can change your choice at any time with the "Cookies" link at the bottom of the page.

You can ask to see, correct, export or delete your data, to restrict or object to how we use it, and you can withdraw consent at any time. You can export your data and delete your account yourself in Settings → Privacy & Data, or write to help@billify.org. We answer within one month.

You can also complain to the Romanian data protection authority (ANSPDCP, dataprotection.ro) or the authority in your country.

Data is encrypted in transit, access is limited by row-level security in our database, API keys are stored only as hashes, and invoices created through the API or an AI app are logged in your audit trail. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

Billify is a business tool for people aged 18 or over. We do not knowingly collect data from children.

If we change this policy, we update the date above. If a change matters to how we use your data, we tell you by email or in the app before it applies.