Privacy Policy for Bill

We process personal data from four categories of people:

2.1 Users of the Bill app (individuals)

2.2 Company customers' contact persons

For the companies that are our customers, we process contact details for the employees who administer the integration: name, email, position, and organization.

2.3 Visitors who try the demo or get in touch on billuminate.io

The demo is a demo. Do not enter national identity numbers, account details or other sensitive data into it, neither your own nor anyone else's. The test personas you can pick are fictional, and the answers are not advice.

2.4 People whose data appears in public source material

Bill collects knowledge from the public web. When personal data appears in such material, for example the names of customer service staff published on a company website, our default is to strip it during collection, or not to collect at all if the material looks sensitive.

We process personal data to:

• Answer your questions in the Bill app
• Provide the technical service to company customers who have integrated Bill
• Improve the quality of the service and prevent misuse
• Fulfill legal obligations

Legal basis:

• Consent (where required, for example at registration and when uploading content)
• Performance of contract (to deliver the service you've requested)
• Legitimate interest (to improve and secure the service)

We do not use personal data for:

• Advertising or targeted marketing
• Profiling
• Resale to third parties

We use AI providers to generate answers to your questions. Today there are two:

• OpenAI interprets the question and writes the answer.
• Anthropic checks that the answer's citations hold up against the documents they came from. That step only sees the already-written answer and the sources, not your original question.

We may change providers in the future, and we are working towards moving more steps to EU-based providers.

Regardless of provider, these requirements apply:

• Your questions are transmitted over encrypted channels.
• The provider does not train its models on your data.
• The provider does not keep your questions for its own purposes, and we have turned off all logging on our provider accounts. A copy may remain for up to 30 days for the provider's abuse monitoring, after which it is deleted.
• The provider acts as a data processor under GDPR, with Standard Contractual Clauses (SCC) for data transfers outside the EU and EEA.

If we change providers, we will update this policy and our sub-processor list. You can request a current list at any time via privacy@billuminate.io.

All data is stored within the EU, via Railway in secure EU data zones.

We encrypt data at rest and in transit (SSL/TLS). Access to stored data is controlled, monitored, and logged. No individual has access to your content. Only the application itself uses it to answer your questions.

We use no cookies on this website. We store nothing else on your device either, not in localStorage and not in any other form. That is why you get no consent banner here: there is nothing to consent to.

We still measure how many people visit the site and which pages they read, using Umami, which we run ourselves at stats.billuminate.io. The statistics never leave our own infrastructure, and they contain no profiles and nothing that identifies you as a person. We record the page you visit, the link you arrived from, approximate location at country level, and the type of device and browser. We also record whether you open the demo chat and whether you submit a form, but never what you wrote.

The IP address is used momentarily to tell one visit from another and is not stored. The legal basis is legitimate interest: we need to know whether the site works and gets used. If you would rather not be measured at all, the site works just as well with an ad blocker or Do Not Track enabled.

We retain personal data only as long as necessary for the purpose, or as required by law.

You can delete all your data at any time through the "clear my data" function in the app, or by emailing privacy@billuminate.io.

Under GDPR, you have the right to:

• Access your data
• Correct inaccurate data
• Delete your data
• Restrict or object to processing
• Have your data transferred to another provider (data portability)
• Withdraw consent you have previously given

Contact privacy@billuminate.io to exercise any of these rights.

You also have the right to lodge a complaint with Integritetsskyddsmyndigheten (IMY, the Swedish Authority for Privacy Protection) if you believe we are processing your data incorrectly.

Bill builds its knowledge base partly on public material from the web, in accordance with the Robots Exclusion Protocol (RFC 9309). Our working methods and commitments are described in detail on our transparency page.

If personal data that concerns you appears in such material and you want us to remove it, email privacy@billuminate.io. We will respond within 7 days.

Questions about how we process personal data?

privacy@billuminate.io