Legal

Privacy policy

We’re committed to safeguarding your personal data with transparent and strong privacy practices.

Effective date: 1 October 2026
Last updated: 31 October 2026

This policy explains what personal data Bilio handles, why, where it goes and what you can ask us to do with it. It covers this website (getbilio.com) and the Bilio app (app.getbilio.com).

1. Who we are

Bilio is a product of Stefka.com, based in Amsterdam, the Netherlands. Stefka.com is the controller for the personal data described in this policy, except where section 4 says we act on your behalf.

Contact for anything in this policy: [email protected]. The founder reads every message.

2. What we collect and why

a. When you visit getbilio.com

To deliver the pages and protect them from abuse, our hosting providers (GitHub Pages and Cloudflare) process technical request data such as your IP address, browser type and the page requested. We do not use this data to identify you. Legal basis: our legitimate interest in running a secure website.

Google Analytics, only if you accept. When you first visit, we ask whether we may use Google Analytics to see which pages are visited and how people find us. If you accept, Google Analytics sets cookies and sends usage data (pages viewed, rough location, device and browser, how you arrived) to Google. If you decline, or do not choose, it does not load and nothing is sent to Google. We do not use advertising or ad-personalisation features. Legal basis: your consent, which you can withdraw at any time with “Cookie settings” at the bottom of every page.

The free invoice generator. What you type into the free invoice generator stays in your browser’s storage and is not sent to us. To download the PDF you create or sign in to a Bilio account (section c). When you create one there, we save that invoice, its client and your business details in your new account as a draft. Legal basis: the contract between you and us.

b. When you use the contact form

We receive your name, email address, the topic you choose and your message. We use it to reply to you. To stop spam, we keep a scrambled (hashed) version of your IP address for about two hours. Legal basis: your request, and our legitimate interest in answering it.

c. When you create and use a Bilio account

To provide the service we process:

  • Account details: your name, email address and password, or your Google or Microsoft sign-in if you choose that.
  • Business details: your business name, address, VAT and registration numbers, logo and bank details you add to invoices.
  • Your work in Bilio: clients, invoices, quotes, expenses, receipts you upload and reports.
  • Team: the names and email addresses of people you invite, and their roles.
  • Subscription: your plan and billing history. Card details are handled by Stripe; we never see or store your full card number.
  • Support: messages you send us.
  • Your choices: which version of the terms and this policy you accepted and when, and whether you opted out of product news by email.
  • Usage: once a day we note that you used Bilio (the date and your company), so we can count active users and see how many people keep using it. Only the founder sees these figures, as totals.

Legal basis: the contract between you and us (providing Bilio), and our legal obligations (for example keeping our own invoices).

Welcome and tips emails. After you sign up, we send you a welcome email and, over the following weeks, a few emails with tips for getting started with Bilio. They are sent through Resend, which tells us for each person whether they opened an email and which links they clicked. You can switch them off at any time with the link in each email or in Settings › Email preferences; if you opted out of product news (section d), you don’t get them. Legal basis: the same as for product news.

Analytics in the app, only if you accept. The Bilio app asks whether it may use analytics. Only if you accept does it load Google Tag Manager, Google Analytics (pages viewed and steps such as signing up or creating an invoice) and Hotjar (how the app’s pages are used). If you decline, or do not choose, none of them load. Visits to getbilio.com and the app are linked, so we can see which pages lead to a sign-up. You can change your choice in the app in Settings › Your account. Legal basis: your consent.

d. Product news by email

As a Bilio customer, you get product news from us by email about once a month: new features and tips for using Bilio. You can opt out at any time: when you sign up, in Settings › Your account, or with the unsubscribe link in every email. Opting out stops these emails straight away, and we keep your choice in Bilio and on our mailing list in step. Your email address is processed by Resend, which sends these emails, and by HubSpot, where we keep the mailing list. Resend also records when you open one of these emails and which links you click in it. Legal basis: our legitimate interest in telling customers about Bilio, under the rules that let a business email its existing customers about its own products as long as they can opt out at sign-up and in every message.

e. Features that process data in a particular way

  • Sending invoices and quotes by email. Bilio sends them to the client addresses you enter. When your client opens the email or clicks a link in it, our email provider reports this to us and we store the event on the invoice (the time, and for clicks the link and device details), so you can see it was received.
  • Receipt scanning and the AI financial advisor. The receipt image, or the question and the figures needed to answer it, are sent to Google’s Gemini API. Bilio uses Google’s paid API, under which Google does not use your content to train or improve its models.
  • Connecting an AI assistant (MCP). If you connect Bilio to Claude, ChatGPT, Cursor or another assistant, you sign in to Bilio and choose the company it may use and what it may do (read, create drafts, change status, delete, send emails to your clients). An email to a client is only sent after you confirm a preview, and it goes out through our email provider like any invoice you send from Bilio. We store a record of the connection: which assistant app, the company, its permissions, and when it was created and last used. Records an assistant creates are marked as created through it, and we keep a log of each change it makes (the action, a short summary and the time), which you see under Recent activity in Settings → Connected assistants. Each entry is deleted automatically after 12 months. The connector runs in the EU. Whatever its tools return, such as your clients, invoices or VAT figures, goes to the assistant you connected; what you ask it to create comes from that assistant. That provider handles this under your own agreement with them, not ours. You can change an assistant’s permissions or disconnect it in Settings → Connected assistants, which takes effect straight away.
  • Currency conversion. We fetch exchange rates from the European Central Bank and similar public sources. No personal data is sent.

3. Who handles your data for us

We use these service providers. Each processes data only to provide its service to us.

  • Google Cloud and Firebase (Google): database, sign-in, file storage and server functions. Your account data, records, receipts and PDFs are stored in Google’s EU multi-region (Belgium and the Netherlands), and the server functions run in Belgium (europe-west1).
  • Google Gemini API (Google): receipt reading and the AI advisor.
  • Resend: sending invoice, quote, invitation and contact-form emails and product news, and reporting delivery, opens and clicks. Emails are sent from Resend’s EU region (Ireland).
  • Stripe: subscription payments and our invoices to you. If you connect your own Stripe account to take online payments, your clients’ payments are processed by Stripe in that account, and Bilio receives its fee and the payment status.
  • HubSpot: our product-news mailing list.
  • Google Analytics and Google Tag Manager (Google): statistics for this website and the app, only for people who accept.
  • Hotjar: how the app’s pages are used, only for people who accept.
  • GitHub Pages and Cloudflare: hosting and protecting this website.

Bilio itself runs in the EU: your data is stored and processed there. Some of the providers above are based in the United States (Google, Resend, Stripe, HubSpot, Cloudflare and GitHub), and their services may involve access to or processing of data outside the European Economic Area, for example when the Gemini API answers a request or Stripe processes a payment. Where that happens we rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses.

We do not sell your data, and we do not share it with anyone for advertising.

4. Your clients’ data

When you add clients, team members or other people to Bilio, you decide what is stored and why. For that data you are the controller and we process it on your behalf, only to provide Bilio to you. If you need a data processing agreement, email us.

5. How long we keep it

  • Your account data and records: for as long as your account exists. If you cancel a paid plan, your account drops back to Starter and nothing is deleted.
  • After you delete your account: we delete your data, except what the law requires us to keep, such as our own invoices to you, which Dutch tax law requires us to keep for seven years. Keeping your own invoices for the period your tax authority requires is your responsibility, so export them before you delete your account.
  • Contact-form messages: as long as needed to handle your request.
  • Assistant connection records: until the connection is removed or your account is deleted.
  • Assistant activity log: 12 months per entry.
  • Anti-spam IP hashes: about two hours.
  • Product-news list: until you opt out or delete your account.
  • Daily usage records and your consent choices: for as long as your account exists.

6. Security

Data is encrypted in transit and at rest. Access rules keep each company’s data separate, so only the people you invite can see it. Changes to the code are reviewed before release.

7. Cookies and similar technologies

This website sets cookies only if you accept Google Analytics: _ga and _ga_84JLJRNBR8, which distinguish visits and last up to two years. We remember your choice in your browser’s storage so we do not ask on every page. To change your mind, use “Cookie settings” at the bottom of any page; declining removes the analytics cookies. If you sign up or sign in through the free invoice generator, this website keeps you signed in in the same way. The Bilio app stores what it needs to keep you signed in and remember your settings in your browser’s storage. This is strictly necessary for the app to work, so we do not ask for consent for it. The app sets analytics cookies (Google Analytics and Hotjar) only if you accept them there, and uses no advertising cookies.

8. Your rights

Under the GDPR you can ask us to:

  • tell you what personal data we hold about you and give you a copy
  • correct it
  • delete it
  • restrict or object to how we use it
  • send it to you or another service in a common format (most of it you can export from Bilio yourself)

Email [email protected] and we will reply within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the authority where you live.

9. Children

Bilio is a business tool and is not meant for anyone under 16.

10. Changes to this policy

When we change how we handle data, we update this page and the date at the top. If a change affects you significantly, we will email account holders before it takes effect.

11. Contact

Stefka.com, Amsterdam, the Netherlands
Email: [email protected]