Privacy Policy

Your privacy is important to us. This Privacy Policy describes how BillMySales collects, uses, stores, and protects your personal data when you use our platform.

BillMySales is a software owned by Derafu DEV SpA, a company incorporated in Chile.

Sales and customer relationships are managed by two independent entities:

• In Chile, the service is commercialized by SASCO SpA, incorporated in Chile.
• In Europe and the rest of the world, the service is commercialized by Derafu OÜ, incorporated in Estonia.

Each company is solely responsible for its own commercial activities, contracts, and legal obligations within its respective jurisdiction.

• 1. Data We Collect
  • From registered users:
  • From end-customers of our users:
• 2. Legal Basis for Processing
• 3. Data Storage and Security
• 4. Data Retention
• 5. Your Rights (GDPR)
• 6. Cookies and Analytics
• 7. Subprocessors
• 8. International Data Transfers
• 9. Changes to This Policy

1. Data We Collect

From registered users:

We collect only the minimum personal data required to operate the platform:

• Full name.
• Email address.
• Account credentials.

Users may optionally provide business-related data for billing purposes (e.g. tax ID, legal entity name, business address).

From end-customers of our users:

As part of the invoicing process, we may temporarily process:

• Order details (products/services sold).
• Customer data (e.g. name, email, address).
• Tax-related information.

We do not use this data for any purpose other than fulfilling the invoicing operation requested by our users.

2. Legal Basis for Processing

We rely on the following legal bases under the General Data Protection Regulation (GDPR):

• Performance of a contract (Article 6(1)(b)): to provide our services to users.
• Compliance with a legal obligation (Article 6(1)(c)): to generate and store tax-compliant documents.
• Legitimate interest (Article 6(1)(f)): to improve service reliability and performance.
• Consent (Article 6(1)(a)): for cookies and optional marketing tools (see section 6).

3. Data Storage and Security

All data is securely stored in Amazon Web Services (AWS) infrastructure located in Ohio, United States.

We apply strong technical and organizational measures, including:

• Encryption at rest and in transit.
• Secure access control to all systems.
• Isolation of tenant data via configuration.

Credentials (e.g. API keys, tokens) provided by users are stored encrypted and accessed only when strictly necessary to execute services.

4. Data Retention

We retain personal and transactional data for as long as necessary to provide our services and comply with applicable laws.

• Order data is kept for 7 to 60 days, depending on the user’s subscription plan.
• Metadata (e.g. totals, invoice numbers) may be retained longer for auditing purposes.
• User accounts that remain inactive for 90 days will be deactivated.
• After 120 days of inactivity, all data may be permanently deleted.

Users may also delete their account and associated data at any time through the platform or by submitting a request.

5. Your Rights (GDPR)

If you reside in the European Economic Area (EEA), you have the right to:

• Access your personal data.
• Correct inaccurate information.
• Delete your data.
• Object to or restrict processing.
• Request data portability.

To exercise these rights, please contact us at 📧 legal@billmysales.com

We will respond to all requests within the time limits required by law.

6. Cookies and Analytics

We use cookies to analyze platform usage and improve user experience.

• Essential cookies: required for the platform to function.
• Analytics cookies (e.g. Google Analytics): used only with your consent.
• Marketing cookies (e.g. Facebook Pixel): used only with your consent.

You will be asked to accept or reject non-essential cookies through a cookie banner on your first visit.

You can also adjust your preferences at any time.

7. Subprocessors

We use trusted third-party service providers (subprocessors) to deliver parts of our service:

• Amazon Web Services (AWS) – Hosting, storage and transactional email (United States).
• Cloudflare – CDN and website performance (global).

All subprocessors are bound by data protection terms and comply with applicable regulations.

8. International Data Transfers

As our infrastructure is hosted in the United States, data may be transferred outside the European Economic Area (EEA).

We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, as part of the AWS Data Processing Addendum, to ensure a high level of data protection.

9. Changes to This Policy

We may update this Privacy Policy as needed to reflect changes in our service or in data protection laws.

We will notify users of any significant changes via email or through the platform.