Privacy Policy

Last updated: 12 October 2026

1. Data Controller

Tibby is a service of Blue Rhizome V.O.F., Mathenesserlaan 273 B, 3021 HG Rotterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KVK) under number 76801969. BTW (VAT) number NL860793941B01.

Blue Rhizome V.O.F. (“we”, “us”) is the data controller for data processed through the Client Portal. For questions about your data, contact info@tibby.io.

2. Cross-Freelancer Invoice Aggregation

Invoices from different senders (freelancers) addressed to the same email address or company registration number (KVK) may be shown together in your Client Portal. This allows you to view and manage all your invoices in one place.

3. Tibby-ID System

Each client is assigned a unique reference number (Tibby-ID) derived from their company registration number or email address. This reference appears on invoices and is used to link invoices across different senders in the portal.

The Tibby-ID is generated using a one-way cryptographic hash (HMAC-SHA256) with a secret key. It is a stand-in for your identity, not an anonymous value: a company registration number is only eight digits, so someone holding both our secret key and a list of candidate numbers could work backwards from it. We therefore treat the Tibby-ID as personal data, and all the rights below apply to it.

4. Data We Collect

Guest users (magic link access)

Email address (from the invoice)
Invoice data (amounts, dates, descriptions, status)
Payment transaction records
Session data (IP address, browser type, access timestamps)

Registered users (optional account)

In addition to the above:

Account credentials (email, hashed password)
Account preferences and settings — your display name, profile picture if you add one, language and time zone
Payment history and receipts
Messages you send about an invoice, including a draft you have typed but not yet sent
Support requests you raise, and any files you attach to them
Decisions you record — approving or rejecting an estimate, requesting a credit note, and any reason you give
Sign-in records: when you logged in, from which IP address, kept as a security log

5. Data Scope

The Client Portal only displays invoice data (amounts, dates, descriptions, status) that was already sent to you by email. No internal business data from freelancers is ever visible to clients, including:

Internal notes or tags
Profit margins or cost calculations
Business analytics or revenue data
Other clients’ information

6. Legal Basis (GDPR Article 6)

Contract performance (Art. 6(1)(b)): Processing invoice and payment data to fulfill the invoicing relationship
Legitimate interest (Art. 6(1)(f)): Cross-freelancer aggregation to provide a unified invoice management experience. You already know this data (it was emailed to you). No cross-client data is ever shared.

7. Data Sharing & Processors

These are the companies that receive any of your data, what each one gets, and where it is:

Mollie B.V. (payment processing) — Netherlands, PCI-DSS Level 1 certified. Mollie handles your card details, and full card numbers never reach Tibby. Mollie does send us a record of each completed payment, which we store: the amount, the method, the status, and — for a bank payment such as iDEAL or SEPA — your name and IBAN.
Gigalixir LLC (hosting) — a US company; your data is stored on Google Cloud in europe-west1 (Belgium).
Brevo (Sendinblue SAS) (transactional email delivery) — France. Receives recipient email + invoice link, retained only for delivery and bounce tracking.
Cloudflare, Inc. (routing and bot protection) — a US company, served from European edge locations. Receives the metadata needed to route a request, not its contents.
Adobe Inc. (web fonts) — a US company. Receives your IP address and browser details when your browser requests the typefaces these pages are set in.

Where your data is. Your invoices and portal account are stored and processed inside the European Union. Three of the companies above are US-established: Gigalixir, which operates the infrastructure holding EU-stored data, and Cloudflare and Adobe, which receive only technical request data — your IP address and browser details — as a side effect of your browser loading the page. Where a transfer outside the EEA occurs, it rests on the European Commission’s Standard Contractual Clauses or on an adequacy decision. We would rather name them than leave you to infer them from a general statement.

We never sell your data. We never share your data with advertisers.

If Blue Rhizome V.O.F. changes legal form, or the Portal is transferred to another entity that continues to run it, your data would pass to that entity so the service can carry on. The successor would be bound by this Privacy Policy, or by one offering equivalent protection, and we would tell you before it happened. A transfer of this kind is not a sale.

8. Data Retention

Guest sessions: 72 hours after last access
Invoice and payment records: for as long as the freelancer who issued the invoice keeps their Tibby account. If they close it, the invoices they sent you are erased with it — so keep your own copies of anything you need, as you would with any invoice you receive by email
Portal account data: until you ask us to delete it

9. Your Rights (GDPR)

Under GDPR, you have the right to:

Access (Art. 15): see all data we hold about you
Rectification (Art. 16): correct inaccurate data
Erasure (Art. 17): “right to be forgotten”. We apply no tax-retention exception to hold your data back. Where an invoice addressed to you is also the freelancer’s own business record, we will tell you if that limits what we can erase rather than refusing outright
Restriction (Art. 18): pause processing while a complaint is resolved
Data portability (Art. 20): export your data in a structured machine-readable format
Object (Art. 21): refuse processing based on legitimate interest, including the cross-freelancer aggregation

Subject Access Request via portal

For most clients, the easiest way to exercise Art. 15 (access) is to log into the portal: every invoice, payment record, and freelancer you've interacted with via Tibby is already visible there, including export options (CSV, PDF). For data not visible in the portal (session logs, IP records), email info@tibby.io. We respond within 30 days.

Right to lodge a complaint (Art. 77)

If you believe we have processed your data unlawfully, you have the right to complain to the Dutch supervisory authority, Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also complain to the supervisory authority of your EU/EEA country of residence.

10. Security

We protect your data with:

256-bit TLS encryption (HTTPS)
AES-256-GCM encryption for sensitive tokens at rest
CSRF protection on all forms
Content Security Policy headers
Rate limiting on authentication endpoints
Regular security audits

11. Contact

For privacy-related questions or to exercise your rights:

Email: info@tibby.io

Post: Blue Rhizome V.O.F., Mathenesserlaan 273 B, 3021 HG Rotterdam, the Netherlands (KVK 76801969)