Legal
Privacy Policy
Last updated: 18 May 2026
This translation is provided for convenience. The Portuguese version is the legally binding text and prevails in case of any discrepancy.
1. Data controller
The controller of personal data is Fieldbase Systems, Lda., registered in Portugal, which operates the BillingBase platform. For data protection matters, contact our Data Protection Officer (DPO) at info@billingbase.net.
2. Personal data we collect
We collect the following categories of personal data:
2.1. Registration and account data
- Full name and email address
- Company details: legal name, tax number (NIF), registered address
- Billing information (processed by Stripe, Inc.)
2.2. Your customers' data
- Name, tax number, address, email and phone of the customers you register on the platform
- We process this data as a processor, with you acting as the controller
2.3. Usage data
- IP address, browser type, pages visited, timestamps
- Activity records (audit logs) for security and compliance purposes
3. Purposes and legal basis for processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the invoicing service | Performance of a contract (Art. 6(1)(b)) |
| Meeting tax obligations (10-year data retention) | Legal obligation (Art. 6(1)(c)) |
| Payment processing via Stripe | Performance of a contract (Art. 6(1)(b)) |
| Sending service communications | Legitimate interest (Art. 6(1)(f)) |
| Security and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
4. Sharing data with third parties
We share personal data only with the following processors, which are necessary to deliver the service:
| Processor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database and authentication | EU (eu-west-2) |
| Stripe, Inc. | Payment processing | USA (standard contractual clauses) |
| Vercel, Inc. | Application hosting | EU (Frankfurt) |
| Resend, Inc. | Email delivery | USA (standard contractual clauses) |
We do not sell, rent or share personal data with third parties for marketing purposes.
5. International transfers
When data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or adequacy decisions, in line with the GDPR.
6. Retention periods
| Data type | Retention period |
|---|---|
| Account data | While the account is active + 30 days after cancellation |
| Tax documents (invoices, receipts, credit notes) | 10 years (legal obligation — Portuguese IRS/IRC Codes) |
| SAF-T files | 10 years |
| Audit records | 5 years |
| Usage data (logs) | 90 days |
7. Data subject rights
Under the General Data Protection Regulation (GDPR), you have the following rights:
- Access — Request a copy of your personal data
- Rectification — Correct inaccurate or incomplete data
- Erasure — Request deletion of your data, except where a legal retention obligation applies
- Portability — Receive your data in a structured format (SAF-T, CSV, PDF)
- Objection — Object to processing based on legitimate interest
- Restriction — Request that processing be restricted in certain circumstances
To exercise your rights, contact info@billingbase.net. We will respond within 30 days.
You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.
9. Security
We implement appropriate technical and organisational measures to protect personal data, including:
- Encryption in transit (TLS 1.3) and at rest
- Per-tenant data isolation (Row Level Security) at the database level
- API keys stored as SHA-256 hashes, never in plain text
- JWT token authentication with automatic expiry and secure refresh
- Immutable audit records for all activity
10. Changes to this policy
We reserve the right to update this Privacy Policy. Any significant changes will be communicated by email and/or a notice on the platform at least 30 days in advance.
11. Contact
For data protection matters, contact us:
- Email: info@billingbase.net