HU EN

Privacy Policy

Effective: 2026-07-24 · AlphaBill (alphabill.hu, my.alphabill.hu, api.alphabill.hu)

1. Data controller

[CÉGNÉV / COMPANY NAME]
Registered address: [SZÉKHELY CÍME / REGISTERED ADDRESS]
Tax number: [ADÓSZÁM / TAX NUMBER]
Company registration number: [CÉGJEGYZÉKSZÁM / COMPANY REG. NUMBER]
Email: info@alphabill.hu

Operator of the AlphaBill online invoicing service (the Service). This notice is issued under Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 on informational self-determination.

2. Dual role: controller and processor

We act as controller for the data of our own registered users (accounts) — this notice covers that processing.
We act as processor for the data our users (businesses) record about their own customers (buyer details, invoice data). The controller of that data is the invoicing business; we process it on their instructions under the Data Processing Agreement.

3. Data we process: categories, purposes, legal bases, retention

3.1 Account data

Data	Purpose	Legal basis	Retention
Email address, username, display name	Account creation, identification, contact	Performance of contract (Art. 6(1)(b) GDPR)	Until account deletion
Password (bcrypt hash)	Authentication	Performance of contract	Until account deletion
Two-factor secret (TOTP)	Enhanced account security (optional)	Performance of contract	Until 2FA is disabled or account deleted
Email-verification and password-reset tokens	Account security	Performance of contract	24 hours / 1 hour (automatic expiry)
Language preference	Remembering interface language	Legitimate interest (Art. 6(1)(f))	Until account deletion / cookie: 1 year

3.2 Session and security data

Data	Purpose	Legal basis	Retention
Session token, IP address, user agent	Managing logged-in sessions, abuse detection	Legitimate interest — security of the Service	Max. 30 days (session expiry); deleted on logout
Failed login counter, lockout timestamp	Brute-force protection (15-minute lock after 5 attempts)	Legitimate interest	Until the lock expires

3.3 Business (issuer) data

Company details provided for invoicing: company name, registered address, tax number, bank account, IBAN/SWIFT, contact details, logo, NAV Online Invoice technical-user credentials. Purpose: issuing legally compliant invoices. Legal basis: performance of contract and legal obligation (Hungarian VAT and Accounting Acts). Retention: for the life of the account; issuer details embedded in issued invoices are retained per the invoice-retention rules (see 3.4).

3.4 Invoice and buyer data

Issued documents (invoice, advance invoice, pro forma, quote) contain the buyer's name, address, tax number, email and line items. The controller of this data is the issuing business — we store it as processor.

Under Section 169 of Hungarian Act C of 2000 on Accounting, accounting documents must be retained for at least 8 years. Issued invoices therefore cannot be deleted immediately even after account closure; the right to erasure does not apply to them (Art. 17(3)(b) GDPR).

3.5 Email log

We log emails sent by the system (recipient, subject, timestamp, delivered/failed) to diagnose delivery problems. Legal basis: legitimate interest. Retention: up to 12 months.

3.6 Usage and billing log

To meter subscription plan limits we record, per issued document, the fact of issuance, its channel (web/API) and any overage charge. Legal basis: performance of contract. Retention: per accounting-document rules.

4. Recipients, processors, transfers

Recipient	Activity	Data transferred
NAV (Hungarian Tax and Customs Administration) — Online Invoice system	Mandatory invoice data reporting (Annex 10, Hungarian VAT Act)	Full invoice content (issuer, buyer, items, amounts). Legal basis: legal obligation.
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Németország / Germany	Hosting (within the EU)	All data stored in the Service
Titan Email (SMTP provider)	Delivery of transactional email	Recipient name, email address, message content (e.g. invoice notification)
Cloudflare cdnjs (CDN)	Serving static assets (icon set)	Browser IP address towards the CDN (technical necessity)

We do not perform systematic transfers outside the EU. We do not use your data for automated decision-making or profiling, and we never sell it.

5. Public invoice share links

Users can generate share links for documents. Anyone holding the link can view that document without logging in (including buyer and issuer details). Sending the link is the user's decision and responsibility; treat share links as confidential.

6. Cookies

We only use strictly necessary cookies (session, language preference, UI state). No marketing or analytics cookies. Details: Cookie Policy.

7. Security measures

Passwords stored as irreversible bcrypt hashes
Optional two-factor authentication (TOTP)
Encrypted transport (HTTPS/TLS) on all surfaces
CSRF protection on forms; lockout on repeated failed logins
Multi-tenant isolation: every query is scoped to the business workspace
Per-device session revocation in account settings

8. Your rights

Under Articles 15–21 GDPR you may request:

Access to your data (a copy of it),
Rectification of inaccurate data (account and company data is also editable in-app),
Erasure ("right to be forgotten") — except for documents under the statutory accounting retention obligation,
Restriction of processing, and objection to processing based on legitimate interest,
Data portability (your data in a structured, machine-readable format).

Send requests to info@alphabill.hu; we respond within 30 days at the latest.

9. Remedies

You may lodge a complaint with the Hungarian supervisory authority (NAIH): Falk Miksa utca 9–11, 1055 Budapest, Hungary; phone +36 (30) 683-5969; email ugyfelszolgalat@naih.hu; web naih.hu — or with the supervisory authority of your habitual residence. You may also bring the matter before a court.

10. Changes to this notice

We may update this notice from time to time. For material changes we notify you in-app or by email. The current version is always available on this page.