Data Processing Agreement
Version 2026-10 · Effective October 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Aranzolm Technologies LLC ("Processor", "Billsato") and the Billsato Pro customer who accepts it ("Controller", "you"). It applies whenever Billsato processes personal data on your behalf that is subject to the GDPR, UK GDPR or Swiss FADP. The free invoice generator processes nothing on our servers, so this DPA applies only to Billsato Pro.
1. Definitions
Terms such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have their GDPR meanings. "Customer Personal Data" means personal data in the content you put into Billsato Pro.
2. Roles and instructions
You are the controller and Billsato is the processor of Customer Personal Data. Billsato processes it only on your documented instructions: the Terms of Service, this DPA, and your use of the service. Billsato will tell you if it believes an instruction breaks data protection law. You are responsible for having a lawful basis for the personal data you put into the service.
3. Details of processing (Annex I)
| Subject matter | Providing Billsato Pro |
|---|---|
| Duration | Until you delete the data or your account |
| Nature and purpose | Storing, displaying, generating PDF invoices from, and exporting invoice-related data at your direction. Billsato does not send invoices or emails to your clients. |
| Data subjects | Your clients and their contact people |
| Categories of data | Names, business names, postal and email addresses, phone numbers, tax IDs, invoice contents (items, amounts, dates), payments you record, and the payment details you print on invoices |
| Special categories | None intended. Don't put special-category data (for example health data) into invoices. |
| Frequency | Continuous, for the duration |
4. Confidentiality
Everyone authorized to process Customer Personal Data is bound by confidentiality and accesses it only as needed to provide the service or support you.
5. Security
Billsato implements the measures in Annex II and will not materially reduce the overall level of protection during the term.
6. Subprocessors
You give general authorization for Billsato to use subprocessors. The current list is at billsato.com/subprocessors. Billsato will email account owners at least 30 days before adding or replacing one. You may object on reasonable data-protection grounds in that period; if we cannot resolve it, you may cancel and receive a pro-rata refund of any prepaid fees. Billsato imposes data protection obligations on each subprocessor no less protective than this DPA, and remains liable for them.
7. Data subject requests
Billsato will help you respond to requests from data subjects. Most can be handled directly in the service (export, correction, deletion). If Billsato receives a request directly, it will pass it to you and not answer it itself unless you ask.
8. Assistance
Billsato will give you reasonable help with security, breach notification, data protection impact assessments and prior consultation with supervisory authorities, taking into account the processing and the information available to it.
9. Personal data breaches
Billsato will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, describing as far as known its nature, the categories and approximate numbers of data subjects and records, the likely consequences and the measures taken or proposed.
10. Return and deletion
You can export Customer Personal Data at any time and delete it by deleting your account, which removes it immediately, unless EU or member-state law requires it to be kept.
11. Audits
Billsato will make available the information necessary to demonstrate compliance with this DPA. You may audit, or appoint an independent auditor, at your own cost, no more than once a year, on 30 days' notice, during business hours and under confidentiality — unless a breach or a supervisory authority requires otherwise.
12. International transfers
Customer Personal Data is stored in the EU (Amsterdam). Because Billsato is established in the United States, its processing of Customer Personal Data is a transfer to a third country. For transfers from the EEA, the parties incorporate the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 2 (controller to processor), completed as follows: Clause 7 (docking) applies; Clause 9 option 2 (general authorization, with the notice period in section 6); the optional language in Clause 11 does not apply; Clauses 17 and 18: the law and courts of the Netherlands. Annex I is section 3 of this DPA, Annex II is below and Annex III is the subprocessor list. For transfers from the UK, the UK International Data Transfer Addendum applies; for Switzerland, the clauses apply with the adjustments the Swiss FADP requires.
13. Liability and precedence
Liability under this DPA is subject to the limits in the Terms of Service, except where the clauses or the law provide otherwise. If this DPA conflicts with the Terms, this DPA prevails; if it conflicts with the clauses, the clauses prevail.
Annex II — Technical and organizational measures
- Hosting: EU (Amsterdam) with DigitalOcean. The database accepts connections only from the server itself; the API is reachable only through Cloudflare, with a secret the API checks on every request. The service runs as an unprivileged, sandboxed system user.
- Encryption: TLS for all traffic. Two-factor secrets are encrypted with AES-256-GCM.
- Account security: passwords hashed with Argon2id; rate-limited login and password-reset attempts; single-use, expiring email links; optional TOTP two-factor authentication with recovery codes; HttpOnly, Secure, SameSite=Strict session cookies, with an origin check on every change.
- Isolation: every query runs scoped to one account and is enforced by Postgres row-level security; automated tests check that one account cannot read another's invoices, clients or PDFs.
- Integrity: issued invoices are immutable (enforced by a database trigger); recorded payments and stored PDFs can't be changed; the SHA-256 of each issued invoice and of its PDF is stored; an append-only log records account and invoice events.
- Payment details: changing them needs the password again, the account owner is emailed, and invoices show a warning for 14 days.
- Payments: processed by Stripe; Billsato holds no card data and has no access to your own payment providers (payment links are stored as plain addresses). Stripe webhooks are signature-verified.
- Vulnerability reports: info@billsato.com.
Accepted electronically at sign-up. Billsato records the version accepted and when.