Privacy policy
Last updated: November 4, 2026. Version 1 of this document.
This policy explains which personal data we process when you visit the billquill website, sign up or use the application, and what happens to the data each company stores in its billquill account.
1. Who is the controller
The controller of the data described in this policy is Human Talent & Me, a Bulgarian company operating the billquill brand, with registered address at Str. Stefan Verkovich 10, 4000 Plovdiv (Bulgaria) and VAT number BG205568902. Its business address is European Trade Center, Building D, 1F, 115 M Tsarigradsko Shose Blvd., Sofia 1784 (Bulgaria).
For any privacy question, write to privacy@talent360hub.com. We have not appointed a data protection officer; that address is handled directly by the responsible team.
2. Two different roles: controller and processor
- We are the controller of the data of the people who use billquill (each company's users), of the billing of the companies' subscriptions, of visitors to the public website and of the people who write to us through the contact form.
- We are a processor of the data each customer company stores in its account: its clients, suppliers, sales agents, products, quotes, issued and received invoices, expenses, bank accounts and transactions, payments, documents, emails, reminders and the users and tickets of its customer portal. That company is the controller and decides which data it stores and why. We process it only on its instructions, under the data processing agreement.
3. If you use billquill
When you sign up, or an administrator of your company adds you, we process:
- Account: name, email, password (stored as a bcrypt hash, never in clear text), role, company, status, date of your last sign-in and the date, version, language, IP address and browser with which you accepted these documents.
- Company and subscription: company or legal name, tax identification number, address, country, phone, email, currency, language and logo; plan, trial period and subscription data. Subscription payments are processed by Stripe on its own secure page: we never see or store your card details.
- Use of the service: what you do in the application is linked to your user (for example, who issued, changed or cancelled an invoice, or who added or replaced a file). API keys are stored only as a hash.
- Support access: if an administrator of your company authorizes it (for 24 hours, 3 days or 7 days), billquill staff can enter the account in read-only mode to help you, in sessions of up to 60 minutes. Every authorization and every access is recorded, and the administrator can withdraw it at any time.
- Connected payment accounts: if your company connects its Stripe account, we only store its identifier (
acct_…); the PayPal keys a company enters are stored encrypted.
4. If you visit the website or write to us
- Browsing: our server receives your IP address and the technical data of each request, which we use to serve the website, protect it from abuse and limit repeated attempts.
- Contact form: name, email, company if you give it and your message. It reaches our mailbox by email so we can reply to you.
- Cookies: the necessary ones and, only if you accept them, analytics and advertising cookies on the public website (see «Cookies»).
5. If your data is in a company's billquill account
If you are a client, supplier or sales agent of a company that uses billquill, or you receive its invoices, quotes or reminders, use its customer portal, pay one of its invoices online or accept one of its quotes, that company is the controller of your data and must tell you how it processes it. We only host and process that data on its behalf.
To exercise your rights, contact that company. If you write to us at privacy@talent360hub.com, we will forward your request to it.
6. Why we process data and on which legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the service: accounts, companies, roles and the invoicing, payments, banking and portal features | Account, company, use of the service | Performance of the contract (Art. 6(1)(b)) |
| Charging subscriptions and meeting accounting and tax obligations | Company and subscription | Contract (6(1)(b)) and legal obligation (6(1)(c)) |
| Security: authentication, abuse prevention, attempt limits, technical logs and the record of platform activity | IP, browser, technical logs, activity record | Legitimate interest in protecting the service and its users (6(1)(f)) |
| Helping you when your company authorizes support access | Account and company data visible in read-only mode | Performance of the contract (6(1)(b)) |
| Replying to people who write to us | Contact form | Legitimate interest (6(1)(f)) and, if you ask for commercial information, pre-contractual steps (6(1)(b)) |
| Service emails: portal access codes, notices and messages the application sends | Name and email | Contract (6(1)(b)) |
| Measuring visits to the public website and the results of our advertising campaigns | Cookies and online identifiers, IP address, pages visited and interactions | Consent (6(1)(a)), which you can withdraw at any time |
| Keeping proof of your cookie choice and of your acceptance of these documents | Choice, version, date, language, IP and browser | Legal obligation to be able to demonstrate it (6(1)(c) and Art. 7(1)) |
We do not sell personal data. We only use analytics and advertising cookies on the public website, never inside the application, and only if you accept them.
7. Artificial intelligence features
If the feature is enabled, when a user uploads a received invoice or a bank statement as a PDF or image and asks billquill to read it, the file is sent to OpenAI through its API to propose its data (supplier, dates, amounts, taxes or transactions). Nothing is saved until the user reviews and confirms it.
We ask OpenAI not to store the answers (store: false). Under its API terms, OpenAI does not use this data to train its models and keeps abuse-monitoring logs for up to 30 days, unless required by law. Results are generated automatically and may contain errors.
8. Emails sent from billquill
All emails go out through Brevo from an address on our domain. When a company sends invoices, quotes, reminders or portal codes to its clients, the email shows the company's name as the sender and replies go to the company's email address, not to us.
9. Online payment of invoices
When a client pays a company's invoice online, the payment is made on the secure page of Stripe or PayPal, through the account that company has connected and under its own contract with that provider. We do not see or store card or bank details: we only receive the result of the payment to mark the invoice as paid. billquill does not charge any commission on these payments.
10. How long we keep data
| Data | Period |
|---|---|
| User account | While it exists. An administrator of your company can deactivate or delete it |
| A company's data in its account | While the company keeps its account. After it closes, it has 30 days to download its data or cancel the closure; then it is deleted, except what the law requires us to keep |
| Database backups | Up to 12 months |
| Subscription payments and billing | 10 years, under Bulgarian accounting and tax law |
| Record of platform activity (who did what in the back office and in support accesses, and the IP address) | 2 years; then deleted automatically. The history of each invoice is not part of it: it is kept as long as the invoice |
| Proof of acceptance of these documents | While the account exists |
| Record of cookie choices | 24 months; then deleted automatically |
| Contact form | As long as needed to answer you and, if you become a customer, for the duration of the relationship |
| In-memory attempt-limit data (IP address) | Up to 1 hour |
| Data sent to OpenAI | Up to 30 days in its abuse logs |
11. Providers processing data on our behalf
| Provider | Purpose | Where |
|---|---|---|
| Hetzner Online GmbH (Germany) | Server and database | Data center in Helsinki, Finland (EU) |
| DigitalOcean, LLC (USA) | File storage (logos, PDFs, attachments and statements) and database backups | Amsterdam, Netherlands (EU); as a US entity, it may process data in the USA |
| Brevo (Sendinblue SAS, France) | Sending emails | EU |
| OpenAI (OpenAI Ireland Ltd., Ireland) | Reading documents with AI, only if the feature is enabled | USA, through its group |
| Stripe Payments Europe, Ltd. (Ireland) | Charging billquill subscriptions | Ireland; the group also processes data in the USA |
| Dinahosting, S.L. (Spain) | Our email inboxes, including the one receiving the contact form | Spain (EU) |
With all of them, the framework required by Art. 28 GDPR is in place, either through a signed data processing agreement or through the data processing terms incorporated into their online terms of service. The Stripe and PayPal accounts each company connects to receive payments are not our providers: they act under their own contract with that company.
If you accept analytics or advertising cookies on the public website, Google Ireland Limited (Google Analytics 4 and Google Ads) and Meta Platforms Ireland Limited (Meta Pixel) receive data about your visit: online identifiers, IP address, pages visited and interactions. Google processes the analytics data on our behalf; for advertising, Google and Meta may also use that data for their own purposes, under their own privacy policies. Without your consent they receive nothing.
12. International transfers
When a provider processes data in the United States (DigitalOcean, OpenAI, Stripe and, if you accept their cookies, Google and Meta), the transfer relies on the EU-US Data Privacy Framework if the provider is certified, or on the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914). You can ask us for a copy of the safeguards at privacy@talent360hub.com.
14. Your rights
You can exercise the rights the GDPR gives you free of charge by writing to privacy@talent360hub.com. We will reply within one month. We may ask for additional information, only to check that you are who you say you are.
- Access: know what data we hold about you and what we do with it.
- Rectification: correct inaccurate data. Your company's administrators can change its details in Settings.
- Erasure: ask us to delete data that is no longer necessary.
- Restriction: ask us to keep data without using it while a complaint is resolved.
- Portability: receive your data in a machine-readable format. A company can download its issued invoices, received invoices and expenses as CSV files from «Accounting export».
- Objection: object to processing based on legitimate interest.
- Withdraw consent when processing is based on it, as easily as you gave it. For cookies, use «Cookie settings» in the website footer.
15. How to delete your user or your company
- Your user: an administrator of your company can deactivate or delete it in Settings → Users. If you are the only administrator, write to us.
- The company: its administrator can ask us to close it by writing to privacy@talent360hub.com. It then has 30 days to download its data or cancel the closure; after that, everything is deleted, except what the law requires us to keep. Download whatever you need first: your company may have to keep its invoices for the period its tax law requires.
16. Complaints to the supervisory authority
If you believe we have not handled your request properly, you can complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, cpdp.bg, or to the authority of the European Economic Area country where you live or work.
17. Automated decisions
We do not take automated decisions that produce legal effects on you or significantly affect you. The AI only proposes data, which a person reviews before saving it.
18. Minors
billquill is a service for businesses and professionals. You must be of legal age to create an account. If you believe a minor has created an account, write to us at privacy@talent360hub.com and we will delete it.
19. Security
- The website is always served encrypted (HTTPS).
- Each company can only access its own data, and within it each user only what their role (administrator, editor or viewer) allows.
- Passwords are stored with bcrypt, sign-ins and public pages have attempt limits, and deactivating a user ends their sessions.
- Payment provider keys are stored encrypted and API keys only as a hash; private files are served through links that expire.
- We verify the signature of the notices we receive from Stripe and PayPal.
No system connected to the internet is completely secure. If a security breach put your rights at risk, we would notify the supervisory authority and, where appropriate, you and the affected company.
20. If you live in the United Kingdom
Processing is also governed by the UK GDPR and the Data Protection Act 2018. The rights described above apply equally and you can complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow SK9 5AF, ico.org.uk.
21. Changes to this policy
If we change anything relevant, we will update the date and version at the top and announce it in the application or by email before it applies.
22. Other language versions
This document is published in English and Spanish. The translation is provided as a courtesy and, in case of discrepancy between versions, the English version prevails.