Privacy Policy

1. Data Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Y2K Global OÜ
Sepapaja 6
15551 Tallinn, Estonia
Email: contact@billance.ai

Further details are available in our Imprint.

2. Introduction

desk.billance.ai is committed to protecting your privacy. This Privacy Policy explains what data we collect when you use our service, how and on what legal basis we use it, who we share it with, and how we protect it.

3. Information We Collect

3.1 Personal Information

When you create an account, we collect:

• Name and email address (via Google/Firebase authentication)
• Company information you provide
• Client and project data you enter
• Offer, invoice and document content

3.2 Usage Data

We automatically collect certain information when you use our service:

• Log data (IP address, browser type, pages visited)
• Device information
• Usage patterns and feature interactions

4. Purposes and Legal Bases

We process your data for the following purposes and on the following legal bases:

• Providing and operating the service, account and contract management – performance of a contract (Art. 6(1)(b) GDPR)
• AI-assisted generation of offers/documents and sending transactional emails (offers, invoices, reminders, team invitations) – performance of a contract (Art. 6(1)(b) GDPR)
• Security, abuse prevention, improvement and reach measurement of the service – legitimate interest (Art. 6(1)(f) GDPR)
• Optional features (e.g. voice input, non-essential cookies) – consent (Art. 6(1)(a) GDPR)
• Compliance with legal (in particular commercial and tax) obligations – legal obligation (Art. 6(1)(c) GDPR)

5. Storage, Hosting and Security

Your data is stored on servers located within the European Union (Germany). Hosting is provided by site.eu (servers located in Germany) under a data processing agreement (Art. 28 GDPR). We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

6. Processors and Third-Party Services

We use the following service providers as processors to operate our service:

• Google / Firebase Authentication (Google Ireland Ltd. / Google LLC, USA) – authentication and sign-in (name, email address, auth tokens, IP address)
• Stripe (Stripe Payments Europe Ltd., Ireland; Stripe, Inc., USA) – payment and subscription processing
• Resend (Resend, Inc., USA – processing in EU region eu-west-1) – sending transactional emails (recipient address and email content)
• Amazon Web Services (AWS Bedrock) (AWS Europe, Frankfurt region eu-central-1) – AI-assisted text generation (see Section 8)
• site.eu (servers located in Germany) – hosting/server operation

Data processing agreements pursuant to Art. 28 GDPR are in place with all processors.

7. International Data Transfers

Some of the providers listed above have parent companies in the USA (Google, Stripe, Resend, AWS). Where personal data is transferred to a third country, this is done on the basis of appropriate safeguards under Art. 44 et seq. GDPR – in particular the EU-US Data Privacy Framework (where the provider is certified) and/or the European Commission's Standard Contractual Clauses (SCC). AI processing and email delivery are configured to take place in EU data centers.

8. AI-Assisted Document Generation

To generate and refine offers and documents, we process the content you enter using an AI model (Anthropic Claude) that we operate via Amazon Web Services (AWS Bedrock) in the EU Frankfurt region (eu-central-1). The following applies:

• Processing takes place within the European Union.
• The content is not used to train the AI models.
• Inputs are processed only to produce the requested result and are not stored beyond what is necessary for this purpose.

9. Email Sending and Open Tracking

When you send documents by email through the service, the recipient address and email content are processed via our email provider (Resend). Sent emails may contain a tracking pixel that lets us detect whether and when an email was opened, in order to show you the delivery status. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in delivery and status monitoring.

10. Voice Input (Speech-to-Text)

When creating or refining documents with AI, you can optionally dictate via the microphone instead of typing. Your voice recording is converted to text exclusively on our own servers within the European Union (Germany), using a self-hosted open-source speech recognition model (OpenAI Whisper). Specifically:

• The audio is not shared with any third party – not with Google, Apple or any external cloud service.
• Processing happens entirely within the EU on infrastructure we control.
• The recording is processed only transiently for transcription and is not stored.
• Voice input is optional and only starts after you explicitly grant microphone access in your browser (consent, Art. 6(1)(a) GDPR).

11. Cookies

We use only technically necessary cookies (or comparable local storage) required to operate the service:

• __session – sign-in/authentication
• NEXT_LOCALE – stores your language choice
• offerflow-cookie-consent – stores your cookie preferences

No consent is required for technically necessary cookies (Art. 6(1)(f) GDPR). We currently use no third-party analytics or tracking cookies. Should optional analytics cookies be introduced in the future, they will only be used after your consent via our cookie banner.

12. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate personal data (Art. 16)
• Request deletion of your personal data (Art. 17)
• Restrict processing (Art. 18)
• Object to processing (Art. 21)
• Data portability (Art. 20)
• Withdraw consent at any time (Art. 7(3))
• Lodge a complaint with a data protection supervisory authority (Art. 77) – in particular the authority of your place of residence

13. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you services. We may retain certain information where required by law (e.g. commercial and tax retention periods) or for legitimate business purposes.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: contact@billance.ai