Privacy Policy

Data Controller

Data Collected

We collect the following types of data:

• • Identification data (name, email address)
• • Professional data (company name, address, UID)
• • Invoicing data (clients, invoices, payment information)
• • Technical data (IP address, browser type, usage data)

Processing Purposes

Your data is processed for the following purposes:

• • Providing the invoicing service
• • Generating and sending invoices
• • Customer support
• • Service improvement and analytics

Legal Basis

We process your data based on contractual necessity for providing our services and your consent where applicable.

Data Retention

We retain your data for the duration of your account and for 10 years after account closure to comply with Swiss accounting regulations.

Sub-processors

We use the following service providers:

• • Vercel - Application hosting and analytics (USA)
• • Supabase - Database and file storage (Zurich, Switzerland)
• • Upstash - Rate limiting / Redis (Frankfurt, Germany)
• • Resend - Email delivery, including invoice content and attachments (Ireland, EU)

International Data Transfers

Your primary data (invoices, clients, business profile) is stored in Switzerland (Supabase, Zurich). For certain services, data is transferred to: the United States (Vercel for hosting and optional analytics); Ireland/EU (Resend for email delivery, which receives recipient addresses, invoice content, and PDF attachments); and Germany (Upstash for rate limiting, which processes IP addresses). Transfers to the US are protected by Standard Contractual Clauses (SCCs) approved by the European Commission and recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Cookies

We use essential cookies required for authentication and the functioning of our service. If you accept via the cookie banner, we also use Vercel Analytics and Speed Insights to understand usage patterns. These optional analytics cookies are only loaded with your explicit consent.

Your Rights

Under Swiss data protection law, you have the right to:

• • Access your personal data
• • Rectify inaccurate data
• • Request deletion of your data
• • Data portability

To exercise your rights, please contact us at info@billli.ch.

Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit and at rest.

Changes to this Policy

We may update this privacy policy from time to time. We will notify you of any material changes via email.