Privacy Policy

MailToBills is operated from Portugal and is the controller of the personal data described here. For anything in this policy — questions, complaints, requests — write to support@mailtobills.com.

We store only what the service needs to work:

• Account data: your name, email address, and sign-in credentials (a password hash, or the identifier from Google/GitHub if you sign in with them).
• Forwarded email data: sender, subject, message identifiers, dates, and the PDF attachments themselves, filed by Collection Month.
• Accountant details you choose to add: their name and email address, used only to deliver your exports.
• Billing status from Lemon Squeezy (plan, subscription state). Card and payment details never reach us — Lemon Squeezy is the merchant of record.
• Feedback you submit through the product, with your name and email so we can reply.
• Basic technical logs and cookieless page analytics — no advertising identifiers, no cross-site tracking, no analytics cookies.

One thing: run the service. We file your documents, show them to you, and export or deliver them where you tell us to. We do not read, parse, or extract data from your documents; we do not sell or rent personal data; we do not use your documents to train AI models; we send no marketing you did not ask for.

Your data is processed by a short list of infrastructure providers, each doing one job:

Some of these providers process data outside the European Economic Area; where they do, transfers rely on GDPR safeguards such as the EU Standard Contractual Clauses.

• Convex — database and document storage.
• Vercel — application hosting.
• Resend — sending your exports and service email.
• Lemon Squeezy — payments, as merchant of record.
• Asana — the content of feedback you submit, so we can act on it.
• Our mail infrastructure — receiving and routing what you forward to your Collection Address.

Collected documents stay until you delete them or your account — there is no automatic expiry, and also no promise of statutory archiving. When you delete your account, we remove your documents and account data from the service; residual copies in encrypted backups expire on the backup cycle. Deletion requests are honored within 30 days.

Under the GDPR you can ask for access to your data, correction, deletion, a portable copy (the monthly export ZIP already is one), restriction, or object to processing. Write to support@mailtobills.com and we will act on it. You can also complain to the CNPD (Comissão Nacional de Proteção de Dados), the Portuguese supervisory authority.

Data is encrypted in transit, access to production systems is limited to the operator, and authentication is handled by maintained industry libraries rather than home-grown crypto. No system is perfectly secure — if a breach ever affects your data, we will tell you directly and promptly.

If this policy changes in a way that matters, we tell you by email before the change takes effect. The date at the top is the version in force.