We process your data under the GDPR (EU 2016/679) and applicable national law. Updated: 2026-06-18.
1. Controller
Ferkovics Lionel Jenő
Straße I. 4.
7061 Trausdorf an der Wulka
Austria
Email: hello@billtree.sk
2. Data we process
- Account data: name, email, password (hashed), language, login times.
- Company & billing data: company name, address, VAT ID, IBAN, and the customers, products, invoices and expenses you enter.
- Payment data: via Stripe (we never store card data).
- Technical data: IP address, device/browser, logs (security, debugging).
3. Purposes & legal bases
- Providing the service — performance of a contract (Art. 6(1)(b)).
- Retaining invoices — legal obligation (Art. 6(1)(c); Austrian BAO §132: 7 years).
- Security, abuse prevention — legitimate interest (Art. 6(1)(f)).
- Marketing/newsletter — consent (Art. 6(1)(a)), revocable anytime.
4. Processors
We use trusted providers under data-processing agreements:
- Hostinger — server hosting (EU, Frankfurt).
- Amazon Web Services (SES) — email delivery (EU, Frankfurt – eu-central-1).
- Stripe — payment processing.
- Anthropic — AI assistant / receipt scanning (only when you use that feature).
5. Transfers to third countries
Some providers (e.g. Stripe, Anthropic) may process data outside the EU; in such cases the EU Standard Contractual Clauses and appropriate safeguards apply.
6. Retention
Account data is kept for the life of the account; billing data for the statutory retention period (generally 7 years), after which it is deleted or anonymized.
7. Your rights
You have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw consent. Requests: hello@billtree.sk.
8. Complaints
You may lodge a complaint with a supervisory authority: in Austria the Datenschutzbehörde (dsb.gv.at), in Hungary the NAIH (naih.hu).
9. Cookies and consent management
Necessary cookies: cookies essential for operation (login, language, active company, storing your cookie choice) are used without consent (Art. 6(1)(f) GDPR).
Measurement and advertising cookies (Google): we use Google Tag Manager and Google Analytics 4 (provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to measure traffic and — where advertising campaigns run — Google Ads conversion tracking. These services set cookies ONLY after your prior consent (Art. 6(1)(a) GDPR), given via our cookie banner and enforced through Google Consent Mode v2: before your decision, or if you decline, no measurement cookies are placed on your device. Data may be transferred to the USA under the EU-U.S. Data Privacy Framework. Details: Google Privacy Policy.
Meta (Facebook) Pixel: to measure our advertising campaigns we also use the Meta Pixel (provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland) — likewise ONLY after your prior consent (Art. 6(1)(a) GDPR). Data may be transferred under the EU-U.S. Data Privacy Framework. Details: Meta Privacy Policy.
Withdrawing consent: you can change your decision at any time: open cookie settings. Withdrawal does not affect the lawfulness of prior processing.
10. Web analytics (Umami)
In addition we use a cookieless, privacy-friendly analytics tool (Umami) that produces only aggregate visit statistics, sets no cookies and identifies no individual users — no consent is required for this.