Privacy Policy

1. Data Controller

Tibby is a service of Blue Rhizome V.O.F., Mathenesserlaan 273 B, 3021 HG Rotterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KVK) under number 76801969. BTW (VAT) number NL860793941B01.

Blue Rhizome V.O.F. is the data controller responsible for your personal data, and is committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR).

If you have questions about how we handle your data, you can contact us at support@tibby.io.

2. Personal Data We Collect

2.1 Freelancer Account Data

When you register and use the Platform, we collect:

• Identity information — Full name, email address, password (hashed)
• Business information — Company name, KVK number, BTW (VAT) number, business address
• Financial information — IBAN, BIC, bank account holder name
• Invoice data — Invoice numbers, amounts, line items, payment status, client details
• Expense receipts and purchase invoices — The documents you photograph, upload or forward to us, kept as you supplied them, plus the details read from them: supplier, date, amounts, VAT, and any line items. Receipts often carry personal data of their own, such as a named cardholder
• Template preferences — Selected invoice template, brand colours, logo
• Terms acceptance record — Which version of these documents you accepted, when, and the address the acceptance arrived from

2.2 Client Portal Data

When a client accesses the portal to view or pay invoices, we collect:

• Identity information — Name, email address (as provided by the freelancer)
• Portal account data — Email, password (hashed), if registered
• Payment information — The payment method, the transaction status, and the payment record Mollie returns to us. For a bank payment such as iDEAL or SEPA that record includes the payer’s name and IBAN; for a card payment, the cardholder name and the last four digits. We never see or store full card numbers — card data is handled by Mollie.

2.3 Automatically Collected Data

• Usage data — Pages visited, features used, session duration
• Device information — Browser type, operating system, screen resolution
• Connection data — IP address, access timestamps

2.4 Banking Data (Optional)

Connecting a bank account is optional — Tibby works without it. If you do connect one, we use Enable Banking Oy, a licensed account information service provider, and we collect:

• Account information — Bank name, account name, IBAN, account type
• Transaction data — Transaction amounts, dates, descriptions and counterparty details, covering up to 12 months of history
• Access credentials — An encrypted access token / session identifier (see Data Security)

We use this for one purpose: matching incoming payments to your invoices, so they can be marked paid without you doing it by hand. The connection is read-only. It cannot move money, initiate a payment, or change anything at your bank.

You authorise the connection at your own bank, and that authorisation expires after 90 days, at which point your bank asks you to approve it again. You can disconnect at any time from Settings, or withdraw access directly at your bank. Disconnecting deletes the transactions we fetched for that account.

2.5 Cross-Provider Invoice Aggregation

When you access the Client Portal, Tibby may display invoices from multiple freelancers or service providers in a single dashboard view. This allows you to see all your outstanding invoices in one place, regardless of which freelancer sent them. This aggregation is based on your email address or business registration number (KVK).

To enable this feature, we generate a Tibby-ID — a pseudonymised, deterministic identifier derived from your KVK number (for businesses) or email address (for individuals) using a one-way cryptographic hash (HMAC-SHA256). It is used solely to link your invoices across different freelancers on the Platform. A Tibby-ID is a stand-in for an identity rather than an anonymous value: a KVK number is only eight digits, so someone holding both our secret key and a list of candidate numbers could work backwards from one. We therefore treat it as personal data, and all the rights in section 7 apply to it.

The portal only displays invoice-level data: invoice numbers, dates, amounts, line item descriptions, and payment status. It does not reveal any freelancer’s internal business data, pricing structures, profit margins, client lists, or any information beyond what appears on the invoice itself.

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

Contract Performance (Art. 6(1)(b) GDPR)

Processing your account data, invoice data, and payment information is necessary to provide our invoicing services to you.

Legitimate Interest (Art. 6(1)(f) GDPR)

We process usage data and device information to improve our services, ensure security, and prevent fraud. We have assessed that these interests do not override your rights.

Legal Obligation (Art. 6(1)(c) GDPR)

Like any Dutch business we keep our own administration — including the record of what we charged you and what you paid us — for the period Dutch tax law (Algemene wet inzake rijksbelastingen) requires of us. This covers our records of our dealings with you. It is not a basis on which we keep your business records after you close your account: the seven-year obligation over your own administration is yours, and your records are erased when you delete your account. See section 6.

Consent (Art. 6(1)(a) GDPR)

For optional features such as analytics cookies and marketing communications, we rely on your explicit consent, which you can withdraw at any time.

Explicit Consent — Bank Connection (Art. 6(1)(a) GDPR)

Reading your bank transactions happens only if you connect an account, and only on the explicit consent you give your own bank when you authorise it. That consent expires after 90 days unless you renew it, and you can revoke it at any time from Settings or directly at your bank.

4. How We Use Your Data

• Providing services — Creating invoices, processing payments, managing your account
• Payment processing — Facilitating online payments through Mollie
• Banking integration — Fetching transactions and matching them to invoices via Enable Banking
• Reading your receipts — Extracting the supplier, date, amounts and VAT from the expense documents you give us, so you do not have to type them (see 4.1)
• Communication — Sending transactional emails (invoice notifications, payment confirmations, account alerts)
• Service improvement — Understanding how features are used to improve the Platform
• Security — Detecting and preventing fraud, abuse, and unauthorised access
• Legal compliance — Meeting our obligations under Dutch and EU law

We do not sell your personal data to third parties, and we do not use it to build a profile of you or to make decisions about you — about your account, your creditworthiness, or anything else.

4.1 How your receipts are read

When you photograph, upload or forward an expense receipt or purchase invoice, we send the document to Microsoft Azure AI Document Intelligence to extract the details: the supplier, the date, the net and VAT amounts, the total, the VAT breakdown per rate, and the individual line items. It is read in Ireland, inside the European Union. Microsoft is listed in section 5 with everyone else who handles your data.

Microsoft’s reading service is the only outside artificial-intelligence service we use, and the only company we send your documents to.

What Microsoft does with it

Microsoft holds the document and the extracted result for up to 24 hours so that the reading can be collected, and then deletes both automatically. Microsoft states that this stored copy is encrypted and kept separate from other customers’ data; that is their account of their own systems, not something we can see from ours.

We also ask Microsoft to discard its copy as soon as it has given us the answer, which in normal operation means seconds rather than a day. Microsoft’s own 24-hour deletion applies in any case.

What we do with it

We keep the receipt itself, because it is your record and your bookkeeping depends on it. That is the only reason we hold it. We do not use your documents to train software. We have nothing to train — Tibby runs no models of its own — and your receipts go nowhere except the reading service named above.

What happens next, inside Tibby

Two further steps run on our own servers, with no outside company involved and no artificial intelligence of any kind:

• A suggested category. We match words on the receipt against a fixed list of keywords to propose a bookkeeping category and code. It is a word count, not a model, and it learns nothing.
• Supplier memory. Once you confirm how a supplier should be coded, we remember it and pre-fill the same choices the next time a receipt from that supplier arrives. Only blank fields are filled — anything read from the document itself is never overwritten. You can change any of it, on any receipt.

What all of this does, and does not, do

This is automated processing, and we would rather say so plainly than leave it to be discovered. What it does not do is decide anything about you. It proposes values for an expense entry. Every value is shown to you, attributed and editable, and no entry is filed until you confirm it.

5. Third-Party Processors

Every company that receives any of your data is listed below, with what it receives and where it processes it. Each one gets only what its job requires and uses it only for that job. If this list changes we will update it here, and we will tell you in advance where that is a material change (see section 12).

5.1 If the Business Changes Hands

If Blue Rhizome V.O.F. changes legal form, or the Platform is transferred to another entity that continues to run it, your data would pass to that entity so the service can carry on without interruption. The successor would be bound by this Privacy Policy, or by one offering equivalent protection, and we would tell you before it happened. We do not sell your personal data, and a transfer of this kind is not a sale.

6. Data Retention

While your account is open we keep your invoices and financial records so that you can meet the seven-year retention period Dutch tax law places on you. That obligation is yours, not ours. If you delete your account, these records are erased with it and we keep no copy, so please export them first — see “Export My Data” under Data & Privacy in your settings.

Deletion takes effect immediately and cannot be undone. The one qualification is that our hosting provider keeps encrypted infrastructure backups for a short period for disaster recovery; those age out automatically, and we do not restore deleted accounts from them.

7. Your Rights Under the GDPR

As a data subject in the European Economic Area, you have the following rights:

Right of Access (Art. 15)

You can request a copy of all personal data we hold about you. Use the export tools in Settings to download your data at any time.

Right to Rectification (Art. 16)

You can update your personal data directly in your account settings. If you need help, contact us.

Right to Erasure (Art. 17)

You can delete your account from Settings. Deletion is immediate and complete: your personal data and your business records go together, and we invoke no retention exception to hold any of it back. Export anything you need first — see the next right.

Right to Data Portability (Art. 20)

You can export your invoices, client data, and financial records in CSV, UBL, MT940, and CAMT.053 formats using our built-in export tools.

Right to Restrict Processing (Art. 18)

You can request that we limit how we process your data while a complaint or dispute is being resolved.

Right to Object (Art. 21)

You can object to processing based on legitimate interest. We will stop processing unless we have compelling legitimate grounds.

Right to Withdraw Consent (Art. 7(3))

Where processing is based on consent, you can withdraw it at any time. For analytics cookies and marketing, use Settings → Data & Privacy or the cookie consent manager. For a connected bank account, disconnect it in Settings or withdraw access at your bank — either stops further access and deletes the transactions we fetched.

To exercise any of these rights, contact us at support@tibby.io. We will respond within 30 days as required by the GDPR.

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

8. Data Security

We implement appropriate technical and organisational measures to protect your data:

• Encryption in transit — All data is transmitted over HTTPS (TLS 1.2+).
• Encryption at rest — Sensitive data (OAuth tokens, banking credentials) is encrypted using AES-256-GCM before storage.
• Password hashing — Passwords are hashed using bcrypt with a cost factor that prevents brute-force attacks.
• Access controls — Company data is scoped to authenticated users. IDOR protection prevents cross-account access.
• Rate limiting — OAuth endpoints and sensitive operations are rate-limited to prevent abuse.
• Audit logging — Security-sensitive operations are logged for monitoring and incident response.
• Webhook validation — Payment webhooks are validated and sanitised to prevent injection attacks.

9. Cookies

We use cookies to keep you logged in and to remember your preferences. For detailed information about the cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

You can manage your cookie preferences at any time via the cookie consent manager or in Settings → Data & Privacy.

10. International Data Transfers

Your invoices, clients, expenses and receipts — the substance of your account — are stored and processed inside the European Union. The application runs on Gigalixir, on Google Cloud in europe-west1 (Belgium), and the database sits in the same region. Gigalixir LLC is a US company, so while your data is held in the EU, a US-established provider operates the infrastructure holding it. Your receipts are read inside the EU by Microsoft (section 5). Your bank data stays in the EEA, with Enable Banking Oy in Finland.

Two companies in section 5 are US-established and receive only technical request data, never your business records: Cloudflare, which protects our public forms and serves the site from European edge locations, and Adobe, which serves the typefaces the pages are set in. In both cases what travels is your IP address and browser details, as a side effect of your browser requesting the page.

Where a transfer outside the EEA does occur, it rests on the European Commission’s Standard Contractual Clauses or on an adequacy decision for the country concerned. We would rather name the specific recipients, as above, than leave you to infer them from a general statement.

11. Children’s Privacy

Tibby is a business tool designed for professionals aged 18 and over. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at least 30 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.

13. Contact Us

For privacy-related questions, data requests, or concerns:

• Email: support@tibby.io — including data-protection enquiries and GDPR requests
• Website: tibby.io
• Post: Blue Rhizome V.O.F., Mathenesserlaan 273 B, 3021 HG Rotterdam, the Netherlands (KVK 76801969)