Privacy Policy

Last Updated:

Introduction

This Privacy Policy explains how Billum ('we', 'our', or 'us') collects, uses, and protects your personal information when you use our bill management service (the 'Service').

We are committed to protecting your privacy and ensuring compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

Data Controller

Billum is the data controller responsible for your personal data. We determine the purposes and means of processing your personal information.

Contact Information: privacy@billum.ai

Information We Collect

We collect information you provide directly to us and information we obtain automatically when you use our Service.

Personal Data You Provide:

  • Account information (name, email address)
  • Household member information (names, income data)
  • Bill information (amounts, due dates, categories, merchants)
  • Payment preferences and settings
  • Communication preferences
  • Receipt images or PDF files you choose to scan, and the financial details extracted from them

Usage Data We Collect:

  • Device information (browser type, operating system)
  • Usage patterns and interactions with our Service
  • IP address and general location information

Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR:

Consent (Article 6(1)(a))

When you voluntarily provide information and agree to our processing activities.

Contract Performance (Article 6(1)(b))

To provide our bill management services as outlined in our Terms of Service.

Legitimate Interest (Article 6(1)(f))

To improve our Service, ensure security, and prevent fraud.

How We Use Your Information

We use the information we collect to:

  • Provide and maintain our bill management services
  • Process and manage your bills and household data
  • Send you important updates about our Service
  • Improve our Service and develop new features
  • Ensure the security and integrity of our Service
  • Comply with legal obligations

Cookies and Tracking

We use essential cookies for the Service. When Google Analytics is configured, it also uses cookies and similar technologies with pseudonymous identifiers to measure visits and interactions.

Types of Cookies:

  • Essential cookies for basic functionality
  • Google Analytics cookies and pseudonymous browser/session identifiers for service measurement
  • Preference cookies for user settings

You can block or delete cookies using your browser or device settings. Blocking essential cookies may prevent sign-in or other Service features from working.

Information Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

Third-Party Service Providers:

  • Cloud hosting providers for data storage and processing
  • Authentication services for secure login
  • Google Analytics may process pseudonymous browser and session identifiers, device information, approximate location, and interactions to help us understand and improve the Service
  • OpenAI processes receipt images and PDF files only when you choose to scan a receipt, so it can extract an expense draft for your review

Receipt scanning and AI processing:

When you start a receipt scan, Billum sends the selected file to OpenAI for that scan. Billum does not save the original receipt file to your account. The extracted draft is saved as an expense only if you review and confirm it. OpenAI processes the file under its applicable privacy and retention terms.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy.

Retention Periods:

  • Account data: Until account deletion or 3 years of inactivity; a minimal deletion replay receipt expires within 30 days
  • Household financial data: Permanently deleted when the account is deleted
  • Usage data: 2 years for analytics and service improvement
  • Original receipt scan files: Not saved to your Billum account; the external AI provider may retain processing data under its applicable terms

Data Security

We implement appropriate technical and organizational measures to protect your personal data:

  • Encryption of data in transit and at rest
  • Regular security assessments and updates
  • Access controls and authentication requirements
  • Staff training on data protection practices

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right of Access (Article 15)

Request a copy of the personal data we hold about you.

Right to Rectification (Article 16)

Request correction of inaccurate or incomplete personal data.

Right to Erasure (Article 17)

Delete your account in Settings or use our public Account deletion page. Billum permanently deletes household and financial data; a minimal replay receipt expires within 30 days, while identity-cleanup data remains only until cleanup completes.

Right to Restrict Processing (Article 18)

Request limitation of processing in certain circumstances.

Right to Data Portability (Article 20)

Receive your data in a structured, machine-readable format.

Right to Object (Article 21)

Object to processing based on legitimate interests or for direct marketing.

Delete your Billum account

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page.

Your continued use of our Service after any changes constitutes acceptance of the updated Privacy Policy.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

Data Protection Contact: privacy@billum.ai

We will respond to your inquiry within 30 days as required by GDPR.