Privacy Policy

When you use AirBill's online accounting tool, the AirBill apps, purchase our services or visit one of our websites, we process personal data about you. We consider it important to handle this data carefully and to protect your privacy as well as possible. In this privacy policy we explain which personal data we process, for which purposes and how we handle it, so that you know exactly where you stand.

1. Definitions: who do we mean in this policy?

In this privacy policy, 'you' or 'your' refers to you as a user of AirBill's online accounting software, as a user of the AirBill apps, as a purchaser of additional AirBill services and/or as a visitor to one of our websites. When the AirBill administration is registered in the name of a company, 'you', 'your', 'your company' and 'your business' refer to that company as a business customer of AirBill.

'We', 'us' or 'our' means: Tally AI B.V., established at Schipluidenlaan 4, 1062HE Amsterdam, and registered with the Chamber of Commerce under number 99443570.

2. Responsibility for personal data

Under privacy legislation (GDPR), AirBill is the data controller for the personal data of its users and visitors to the website. This privacy policy relates exclusively to that personal data.

For the personal data you process about your own customers or business relations within your AirBill administration, you are the data controller yourself. This also applies to data that is made available through integrations, for example from the Trade Register of the Chamber of Commerce. You can view, manage, modify and delete this data yourself.

In that context, AirBill acts as a processor. To clearly set out the responsibilities, you can enter into a data processing agreement with us through the account management section in AirBill.

3. Which personal data do we process and for what purpose?

Which personal data AirBill processes and for which purposes depends on the way you use our services. Below we explain, per situation, which data is processed and why.

a. When you visit our websites

When you visit one of AirBill's websites, we collect data about the use of the website. This concerns, for example, the number of visitors, the origin of visitors, pages visited and interactions with the website (such as via heatmaps). Exactly which data is processed depends on the information that your browser automatically sends. This may include information about your device, operating system, browser settings and the time of your visit.

We use this data to: gain insight into the use of our websites; compile statistics; make our websites more user-friendly and better tailored to visitors.

This processing takes place on the basis of our legitimate interest in optimising our websites. For these analyses we use cookies. You can find more information about this in our cookie statement.

b. When you contact us

If you contact AirBill, for example via support, email or a message from your account, we process your name and email address. Depending on the situation, we may also record which browser, which device or which API client you use and on behalf of which company you are contacting us.

We use this data solely to: answer your questions; provide support; maintain contact with you in the context of our agreement.

Please note: never send us sensitive personal data, such as passwords, unsolicited. If we do receive such information, we will inform you about it, delete the message and not deal with it substantively. If necessary, we will immediately reset your password and you will be required to set a new password.

c. When you sign up for AirBill or take out a paid subscription

When you sign up for AirBill, we ask you for your company name, your name and your email address. Without this data we cannot enter into an agreement with you.

In addition, depending on the chosen services, we process supplementary data about your business, such as: contact details; Chamber of Commerce number; VAT number; SBI codes; data of ultimate beneficial owners (UBOs); bank account number.

This supplementary data is necessary when you take out a paid subscription or use services for which additional verifications are required, such as Peppol or AirBill Payment Methods.

We use this data for: performing the agreement; providing our services; carrying out mandatory verifications; providing support; preparing and sending invoices; marketing purposes (for customers who signed up from 1 July 2025 onwards); analysing and improving the functioning of our application.

In addition, we use your email address to send service messages and newsletters. This takes place on the basis of our commercial interest or your consent. You can unsubscribe from this at any time via the unsubscribe link in the message.

We also record how you became an AirBill customer, for example via advertisements or a referral. We do this to measure the effectiveness of our marketing campaigns.

d. When you use AirBill's services

To continuously improve our services, we analyse the use of AirBill. For this we process data in anonymised or strongly pseudonymised form, which can only be traced back to individual users to a very limited extent.

These analyses help us to: better understand how the application is used; gain insight into general trends and statistics; make targeted improvements.

The results of these analyses may be used in blogs or other communications. In doing so, we never publish data that can be traced back to individual users.

In limited cases we use small datasets, such as a selection of invoices, to improve our algorithms. For this we have put in place appropriate safeguards to handle this data carefully.

e. When you sign up as an advisor

Through the AirBill website you can sign up as an advisor, for example as an accountant or bookkeeper. When you sign up, we process personal data such as your name, address and contact details.

By signing up, you give AirBill permission to store this data and publish it on the website, so that customers can find you as an advisor. In addition, we collect and publish reviews about you as an advisor, written by customers. You also give your consent for this when you sign up.

f. When you leave a review

Users can post a review about AirBill or about an advisor through AirBill. With your consent, we store this review and publish it on our website.

In doing so, we process: the content of the review; your name; your gender; possibly your company name.

Reviews about AirBill may also be shared with partners, so that they become visible on search engines and comparison websites.

g. Other purposes

Finally, we process your name, email address and/or business address for administrative purposes, such as: invoicing; collecting outstanding receivables; creditworthiness checks; our financial administration; handling complaints and disputes.

These processing activities are necessary for the correct performance of the agreement.

4. How do we secure your personal data?

AirBill takes appropriate technical and organisational measures to protect your personal data against loss, unauthorised access and unlawful use. In determining these measures, we take into account the state of the art, the costs of implementation, the nature of the personal data processed and the potential risks.

Our websites and applications are secured, for example, with a TLS certificate, and we use additional security measures, such as firewalls, to prevent misuse and unauthorised access.

In addition, AirBill operates a responsible disclosure policy. This means that we not only actively search for vulnerabilities in our systems ourselves, but are also open to reports of security breaches by third parties. Reports received are carefully assessed and, if necessary, resolved as quickly as possible.

5. With whom do we share personal data and from whom do we receive data?

Within AirBill, only employees have access to personal data insofar as this is necessary for the performance of their work.

We are restrained in sharing personal data. Personal data – including data from your administration – is never sold or rented to third parties. We share personal data only in the following situations:

• When we are legally obliged to do so, for example in the context of an investigation by the Public Prosecution Service or another competent authority. In that case we provide only the data we are required to share under the law.
• When this fits within the purpose for which the data was collected and this is permitted under privacy legislation, for example because you have given your consent for it.

In addition, AirBill may share personal data with parties that perform services on our behalf (legally: processors). These parties process personal data exclusively on behalf of AirBill and according to our instructions. With these partners, agreements have been made about confidentiality, security and the protection of personal data.

The main categories of processors that AirBill currently uses are:

• Hosting, database, authentication and storage — Supabase (managed Postgres and storage) and the underlying cloud infrastructure that Supabase uses.
• AI processing — Google Gemini, used to extract information from invoices and receipts, classify entries, match transactions and answer accounting questions in the app. Data sent to Gemini is processed on the basis of a data processing agreement and is not used to train Google's foundation models.
• Bank integrations (PSD2 account information) — Salt Edge Limited, the licensed Account Information Service Provider that retrieves transaction data from your bank with your consent.
• Accounting integration — Exact Online, where applicable, for synchronising entries and administration data that you choose to push through.
• Payments — Mollie B.V., for processing payments on invoices that you send via AirBill.
• Email delivery and inbound email processing — providers for sending transactional email and for reading forwarded documents into your administration.
• Product analytics and crash reporting — PostHog and Sentry, only insofar as you have not turned off product analytics in the settings.

Some of these partners are established outside the European Union or the European Economic Area. In those cases we provide appropriate safeguards, such as additional security measures or entering into Standard Contractual Clauses approved by the European Commission.

Please note: the AirBill websites may contain links to third-party websites. You can also create integrations through AirBill with applications of other parties (such as via APIs). AirBill is not responsible for the way these parties handle personal data or for their compliance with privacy legislation.

6. How long do we keep personal data?

AirBill does not keep personal data longer than is necessary for the purposes for which it was collected. In some cases we are legally obliged to keep data longer. For example, the Tax Authorities require that invoices containing personal data must be kept for ten years. AirBill complies with these statutory retention periods.

In addition, we apply the following retention periods:

• If you have a user account with AirBill, we keep your personal data for as long as you use that account. After your account is terminated, we delete personal data that is no longer needed within one month.
• We keep the following data for ten years: agreements, including data processing agreements and the agreement to use AirBill; data about entering into and terminating these agreements; verification data recorded in the context of legal obligations.
• Reviews published on our website are deleted upon request.
• Correspondence with our support department is in principle kept for one year. This period may be longer if the correspondence is relevant as evidence, for example in the event of a dispute or bankruptcy.
• If you are registered as an advisor, your data remains published on the website until you request its removal.
• Analytical data, including data from Google Analytics, is kept for a maximum of 36 months.
• Other personal data published on our website is deleted upon request as soon as possible.

7. What privacy rights do you have?

Under applicable privacy legislation (GDPR), you have various rights with regard to your personal data. For example, you have the right to: obtain access to the personal data that AirBill processes about you; have personal data that is factually incorrect corrected, supplemented or deleted; have the use of your personal data restricted; receive your personal data in a structured, commonly used and machine-readable format or have it transferred to another party (data portability) — this right applies only to personal data that we process on the basis of the agreement with you or on the basis of your consent; object to the processing of your personal data.

If you have given AirBill consent to process certain personal data, you can withdraw that consent at any time. After withdrawal, AirBill will delete this personal data, unless we also need the data for another purpose for which no consent is required. In that case the data is kept solely for that other purpose.

8. How can you exercise your rights?

You can make use of the rights mentioned above in various ways:

• Through your user account or the account management section, you can view, change or delete certain personal data yourself.
• If you no longer wish to receive newsletters, you can easily unsubscribe via the unsubscribe link at the bottom of the newsletter.
• Through the account management section, you can download personal data for which AirBill is the data controller, such as invoices or contact details.

Data that you have stored yourself in your AirBill administration and for which AirBill acts as a processor is not covered here. You can consult and manage this data directly in your own administration.

In addition, you can submit a request via support@airbill.app. To prevent misuse, AirBill may ask you to verify your identity before the request is processed. In principle, you will receive a response within one month. In exceptional cases, AirBill may refuse a request in whole or in part; in that case we will explain, with reasons, why.

9. What can you do if you have a privacy complaint?

If you have a complaint about the way AirBill handles your personal data, we ask you to first contact us via support@airbill.app. This applies, for example, when you suspect there is misuse of data or a data breach. We will work with you to find an appropriate solution.

In addition, you always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via www.autoriteitpersoonsgegevens.nl.

10. Changes to this privacy policy

AirBill may amend this privacy policy from time to time, for example when we change our services or start processing other personal data.

The most up-to-date version of the privacy policy is always available on the AirBill website. We recommend that you consult this policy regularly.

Do you have questions about this privacy policy? Then feel free to contact us via support@airbill.app. We aim to respond within one business day.