Account data
We are controller
Names, email addresses, sign-in events, and audit records of people who use the service. That processing is described in the Privacy Policy.
SECURITY & PRIVACY
Your documents.Our responsibility to explain.
Know where your data goes, who can access it and what happens when you delete it. Our data processing agreement and subprocessor list are public.
DATA & RESPONSIBILITY
01
Your organisation
Documents stay within your organisation’s access boundary.
02
Our role
We process document content on your instructions.
03
Your agreement
The DPA forms part of the Terms of Service.
CLEAR ABOUT OUR ROLE
Two kinds of data.
Two responsibilities.
Document content
We are processor
Personal data in the invoices you upload: names, addresses, and identifiers of suppliers, buyers, and their representatives. You determine the purposes. We process only on your instructions, under the DPA.
Account processing is described in the Privacy Policy. Document processing is covered by the DPA.
STORAGE & PROCESSING
Where your data goes.
At rest — European Union
Documents at rest are stored in the European Union, on infrastructure in Germany.
Inference may leave the EEA
The only processing that leaves the EEA is inference: document content is sent to our AI subprocessor to extract data.
No training
We do not use your documents, extracted data, or output files to train machine learning models. Logging of prompts and model outputs at the AI provider is disabled.
ACCESS & REVIEW
Who can see a document.
Review and support are part of delivering the service. Their access is described here and in our Terms.
Uploads, corrections, exports, deletions, and support access are recorded in an append-only audit log.
Organisation isolation
The organisation is the isolation boundary. A user of one organisation cannot address the documents, results, or exports of another.
Our reviewers
Our operations staff may view documents in your organisation and may correct extracted data. Review is part of the service, not an exception to it.
Support
Personnel acting in support have read access only. They cannot change extracted values.
PROCESSING PARTNERS
Our subprocessors.
The subprocessors engaged for personal data in documents are listed here and on a dedicated page. We will notify you at least 30 days before adding or replacing one.
| Subprocessor | Purpose | Data processed | Location | Transfer basis |
|---|---|---|---|---|
| netcup GmbH, Germany | Hosting and infrastructure for all services, the database, and object storage | All personal data processed under the DPA, at rest | Germany | Not applicable — within the EU |
| OpenAI Ireland Limited | Extraction of data from documents by machine learning models | Content of uploaded documents, including any personal data it contains | European Union and United States | Standard Contractual Clauses under the subprocessor's data processing addendum |
| Sendinblue SAS, trading as Brevo, France | Transactional email delivery | Email addresses and names of your users. No document content. | France | Not applicable — within the EU |
netcup GmbH, Germany
- Purpose
- Hosting and infrastructure for all services, the database, and object storage
- Data processed
- All personal data processed under the DPA, at rest
- Location
- Germany
- Transfer basis
- Not applicable — within the EU
OpenAI Ireland Limited
- Purpose
- Extraction of data from documents by machine learning models
- Data processed
- Content of uploaded documents, including any personal data it contains
- Location
- European Union and United States
- Transfer basis
- Standard Contractual Clauses under the subprocessor's data processing addendum
Sendinblue SAS, trading as Brevo, France
- Purpose
- Transactional email delivery
- Data processed
- Email addresses and names of your users. No document content.
- Location
- France
- Transfer basis
- Not applicable — within the EU
The English DPA Annex III is the binding list.
The object storage, database, identity provider, and observability tooling run on our infrastructure. They are not separate subprocessors. Stripe is not a subprocessor under the DPA; billing is described in the Privacy Policy.
Full list and notice rulesRETENTION & DELETION
Know what happens next.
Deleting a document removes it from view immediately. Permanent deletion follows the retention terms.
Bizalma is not an archive. Keep your statutory records independently of the service.
- Immediately
- Deleted documents and organisations leave the interface.
- One year later
- Irreversible deletion from databases and object storage. Audit entries recording document actions are retained.
- After termination
- Export extracted data and output files for 30 days.
Questions about your data?
Find the right contact for privacy or contractual questions.