Privacy Policy

1. Controller

Jonas Sercombe

Marienstr. 73a

30171 Hannover

Deutschland

Email: noreply@billmebaby.de

2. Data We Process

When you use the website and application, we may process account data, contact data, invoice and customer data, communication content, uploaded documents, payment data, login data, technical usage data, and log data.

3. Hosting and Technical Delivery

The website is hosted on servers in Germany and/or the EU. When the website is accessed, technically necessary server log data may be processed, in particular IP address, date and time, requested URL, referrer, user agent, and status codes. This processing is carried out to deliver the site, maintain stability, ensure security, and prevent abuse on the basis of Art. 6(1)(f) GDPR.

4. Registration, Login, and Accounts

Authentication services and single sign-on methods may be used for login, in particular Google Sign-In through Supabase Auth. In that context, the identity and account data required for login are processed. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR for the secure operation of the application.

5. Use of the Invoicing Application

When you use the platform, content you enter or upload may be processed, especially business profile data, customer records, invoices, reminders, templates, file attachments, payment statuses, reminders, and other business communication. This processing is necessary to provide the contractual service under Art. 6(1)(b) GDPR.

If you upload personal data relating to third parties, you remain responsible for the lawfulness of that data processing within your own business operations.

6. Document Uploads and Automated Analysis

Uploaded documents, such as invoices or attachments, may be analyzed automatically in order to detect business profile data, payment details, or invoice numbering logic and to prefill parts of the application. This is done to provide the requested functionality and improve usability on the basis of Art. 6(1)(b) GDPR.

7. External Service Providers

We may use third-party providers to deliver specific functions, in particular Supabase for database, authentication, and storage, OpenAI for structured document and text processing, Stripe and PayPal for billing and payments, SMTP or mail providers for email delivery, and Telegram for bot interactions. Data is transferred only to the extent required for the respective function.

Where service providers in third countries are used, this is done on the basis of appropriate safeguards, especially EU standard contractual clauses or equivalent legal mechanisms, where required.

8. Email, Payment, and Communication Features

If you send invoices, payment links, reminders, or test messages, the communication and transaction data required for those actions will be processed. For bot or chat features, the submitted content and metadata are also processed in order to perform the requested function.

9. Cookies, Sessions, and Local Storage

The application uses technically necessary cookies, session mechanisms, and local browser storage where required for login, security, state handling, UI preferences, or error recovery. The legal basis is Section 25(2) TDDDG and Art. 6(1)(b) and (f) GDPR.

10. Retention Period

Personal data is stored only for as long as necessary for the relevant purposes or as required by statutory retention obligations. Account, contract, and billing-related data may therefore be stored longer than purely technical logs or session data.

11. Legal Bases

Processing is carried out in particular on the basis of Art. 6(1)(b) GDPR for contract performance, Art. 6(1)(c) GDPR for compliance with legal obligations, Art. 6(1)(f) GDPR for legitimate interests in the secure and economic operation of the platform, and, where applicable, on the basis of your consent under Art. 6(1)(a) GDPR.

12. Your Rights

Subject to the applicable statutory requirements, you have the right to access, rectification, erasure, restriction of processing, data portability, and objection. Any consent given may be withdrawn with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority.

13. Changes to This Privacy Policy

This privacy policy may be updated if features, legal requirements, or service providers change. The version published on this website shall be the authoritative version.