Privacy policy

Draft — last updated 2026-10-13

This page is in English for now. Estonian and Russian translations are pending legal review.

Bilketa helps businesses order from suppliers that take orders by email. It learns a catalog from the invoices, price lists and other supplier documents you upload or forward, lets you build a cart across suppliers, and sends one order email per supplier from your own Gmail account. This policy explains what personal data that involves, why, and what you can do about it. We have tried to write it in plain language; if anything is unclear, ask us.

Who we are and our role

Bilketa is operated by Aleksei Baranovski, a private individual using an Estonian entrepreneur account (simplified business income taxation), Kalevipoja põik 1, 13614 Tallinn, Estonia ("Bilketa", "we", "us"). You can reach us at [email protected].

Under the EU General Data Protection Regulation (GDPR) we play two different roles:

Controller for account data. We decide how data about the people who sign up and sign in is used: your account, your sign-in, your Gmail connection, security logs, API keys and billing. This policy covers that use in full.
Processor for organisation data. Each customer organisation (a "tenant") decides what goes into its workspace: invoices, price lists and other supplier documents, supplier contacts, products, orders, and the names and email addresses of its own staff. For that data the organisation is the controller and we process it only on its instructions, under our Data processing agreement. If you are a supplier or an employee of a customer and have a question about data an organisation keeps in Bilketa, contact the organisation first; we will help it answer.

What we collect

Account data: Your name, email address, the organisations you belong to and your role in each, your language and settings. If you sign up with a password, we store only a one-way hash of it (argon2id), never the password itself. Sessions are random tokens that we store only in hashed form.
Google profile on sign-in: When you sign in with Google we receive your Google account identifier, name, email address and, if you have one, profile picture (the openid, email and profile scopes).
Gmail connection: If you connect Gmail to send orders, we ask only for permission to send email (gmail.send). We store the OAuth refresh token, encrypted at rest, and for every order we send: the Gmail message ID, the recipient addresses, the time it was sent and which Bilketa order it belongs to. We never read, list or modify your mailbox. We do not see your inbox, other emails or your contacts.
Supplier documents and what we extract from them: Invoices, price lists, offers, catalogs and order confirmations you upload or forward to your organisation's Bilketa ingest address, and the data we extract from them: supplier details, product lines, quantities, pack sizes and prices. These documents can contain personal data such as a sales representative's name, email address or phone number, or the name of the person who placed an order. We use this to build your catalog, your suppliers' contact details and your order history.
Orders: The carts you build and the order emails we compose for you: products, quantities, delivery notes, supplier recipient addresses, who confirmed the order and when.
Usage and cost metering records: For every piece of work that costs us money (for example reading an invoice or price list with an AI model, or sending an order) we record which organisation it was for, what kind of work it was, counts such as pages, rows, lines or tokens, how long it took and what it cost. These records are about operations, not about how you behave in the app, and contain no document content.
API key metadata: If you create personal API keys for automation, we store the key's name, a public key identifier, its scopes, organisation, expiry, optional IP allowlist, when and from which IP address it was last used, and audit records of its creation and revocation. We store only a keyed hash (HMAC) of the secret part, so we cannot show a key again after creating it.
Server and security logs: Like any web service, our servers log requests: IP address, time, the page or API endpoint requested, response status, browser user agent and a request ID. We use these to keep the service running, debug failures and detect abuse.
Messages to us: If you email support, we keep the conversation so we can help you.

We do not use advertising or analytics trackers, and we do not sell personal data. See Cookies and local storage for the few cookies we set.

Google user data

Bilketa accesses Google user data only to sign you in (your basic profile) and, after you press "Connect Gmail" and agree on Google's consent screen, to send order emails you have reviewed and confirmed. Each order email is sent from your Gmail account so that it appears in your Sent folder and supplier replies reach your inbox as usual.

We store only the encrypted refresh token and, per sent email, the message ID, recipients, timestamp and our order ID.
We never read, list, search, label or delete messages in your mailbox.
We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and do not let people read it except with your permission, for security reasons, to comply with law, or in aggregated, anonymised form for operations.
You can disconnect Gmail at any time in Settings → Email, or revoke access from your Google Account at myaccount.google.com/permissions. We then delete the refresh token.

Bilketa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Why we use it and our legal bases

Purposes and legal bases
Purpose	Data	Legal basis (GDPR)
Create and run your account, sign you in, keep you signed in	Account data, Google profile, sessions	Contract, Art. 6(1)(b)
Build your catalog from your suppliers' documents and compose and send your orders	Supplier documents, extracted lines, orders, Gmail token and send records	Contract, Art. 6(1)(b); for organisation data, on the organisation's instructions
Run API keys, rate limits and spending budgets	API key metadata, metering records	Contract, Art. 6(1)(b)
Understand what the service costs us per document, order and organisation, and set fair prices	Usage and cost metering records	Legitimate interest, Art. 6(1)(f): running a sustainable service. Strictly operational, no behavioural profiling.
Keep the service secure, prevent abuse, investigate incidents	Server and security logs, API key metadata	Legitimate interest, Art. 6(1)(f)
Send service messages (sign-in links, password resets, API key notices)	Email address	Contract, Art. 6(1)(b)
Keep accounting records once billing goes live	Billing details, invoices we issue	Legal obligation, Art. 6(1)(c)

Where we rely on legitimate interest you can object at any time (see Your rights). AI models help us read supplier documents, but every extracted line is checked automatically or by you before it enters your catalog, and nothing is sent to a supplier without your confirmation. We make no automated decisions that have legal or similarly significant effects on you.

Optional purposes (not active)

We may later ask for your consent to the uses below. None of them is currently active. Each is off by default, will only start with your consent (or, for organisation data, the organisation owner's), and can be withdrawn at any time in Settings → Privacy. Before switching any of them on we will update this policy and ask you.

Product analytics: which features are used and where people get stuck, collected first-party without third-party trackers.
Extended error diagnostics: screen context and request contents attached to error reports.
AI improvement: using an organisation's real supplier documents and corrections to test and improve our extraction prompts. Decided by the organisation owner. Without it, an organisation's documents are never copied into any evaluation or training set.
Product update emails: occasional news about Bilketa.

Shared barcode library (active, off by default, decided by the organisation owner in Settings → Privacy, and offered once at the end of setup): the barcodes in an organisation's catalog are shared with the product name and pack facts (size, unit, pieces per pack), so other organisations that also share see what a code they meet for the first time is called. Only these are shared: never prices, suppliers, quantities, people or which organisation shared them; shop-printed weight and price labels are never shared. What others share is shown as a hint and never changes a catalog by itself. Withdrawing removes the organisation's barcodes from the library at once.

How long we keep it

Account data: while your account exists, then deleted within 30 days of account deletion.
Gmail refresh token: until you disconnect Gmail, revoke access at Google, or delete your account; then deleted immediately.
Supplier documents, catalog, orders and send records: as long as the organisation keeps its workspace, or until it deletes them. Deleted within 30 days of the organisation closing its workspace.
Usage and cost metering records: while the organisation exists; after it is deleted we keep only figures that no longer identify the organisation or any person.
API key metadata: for the life of the key; audit records of creation and revocation for 12 months.
Server logs: 30 days.
Backups: deleted data can persist in encrypted backups for up to 12 months (monthly archive copies) before being overwritten.
Accounting records (once billing is live): seven years, as required by the Estonian Accounting Act.

See Deleting your data for how to delete data yourself.

International transfers

Our servers are in the EU (Tallinn, Estonia). Some subprocessors are based in the United States:

Anthropic PBC processes supplier document content to extract lines. Under Anthropic's commercial terms, data sent through its API is not used to train its models.
Google LLC for sign-in and Gmail sending.
Cloudflare, Inc., whose network carries traffic to our servers.
Resend delivers system emails; it sends from the EU (Ireland), and the company is based in the United States.

These transfers are protected by the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. You can ask us for a copy of the relevant safeguards.

Security

All traffic is encrypted in transit (TLS). Gmail refresh tokens are encrypted at rest; passwords, sessions and API key secrets are stored only as hashes. Every organisation's data is kept separate from every other organisation's at the database query level. API keys are scoped, expire, are rate-limited and are automatically suspended on unusual spending. Access to production systems is limited to the people who run the service.

Your rights

Under the GDPR you have the right to:

access the personal data we hold about you and get a copy;
have inaccurate data corrected;
have your data deleted;
restrict how we use it;
receive data you gave us in a machine-readable format (portability);
object to processing based on legitimate interest;
withdraw any consent you gave, at any time, without affecting earlier processing.

Email [email protected] to use any of these rights. We answer within one month. If your request concerns data an organisation controls, we will pass it to the organisation and help it respond.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the data protection authority where you live or work.

Bilketa is a service for businesses and is not intended for children under 16.

Changes to this policy

We update this policy when what we do with data changes, for example a new subprocessor, a new Google permission or an optional purpose being switched on. The date at the top shows the latest version. For material changes we will tell account holders by email or in the app before they take effect.

Contact

Aleksei Baranovski, Kalevipoja põik 1, 13614 Tallinn, Estonia. Email: [email protected]. More details are in the Imprint.