Privacy policy

1. Privacy statements

• Cosmic Bills collects the minimal amount of personal data from You, for the sole purpose of performing document processing services for You.
• Cosmic Bills collects the personal data You provided when You registered and is committed to protecting the security of Your personal information.
• Cosmic Bills keeps a copy of all documents You submit to Cosmic Bills for processing, for the purpose of tax office record keeping and Cosmic Bills' internal record keeping.
• Cosmic Bills periodically obtains accounting data from Your nominated accounting system, authorised by You for the connection with Cosmic Bills. Only relevant data will be obtained, for the sole purpose of performing document processing services for You.
• Cosmic Bills may monitor Your invoice data processing, for the sole purpose of improving invoice processing accuracy for You.
• Cosmic Bills will not disclose Your personal information, documents or accounting information to a third party unless You have provided Your explicit consent or it is compelled by court orders.
• Cosmic Bills does not store Your payment card information.

2. Google Drive access

Cosmic Bills' usage of Google Drive is described below.

• Cosmic Bills only reads files from the dedicated folder You created on Your Google Drive named "CosmicBillsUpload".
• Once a file has been uploaded to the "CosmicBillsUpload" folder by You, it is processed by Cosmic Bills for invoice data automation and moved to a folder named "CosmicBillsDone", which will be created by Cosmic Bills if it does not exist.
• Cosmic Bills does not delete any files in Your Google Drive.
• Cosmic Bills extracts invoice data from the files in Your Google Drive folder "CosmicBillsUpload" and exports it to the accounting package that You have authorised Cosmic Bills to integrate with. Other than this, Cosmic Bills does not share any of Your Google Drive files, or the information contained in the files, with any other third party.

3. Gmail and Office 365 access

Cosmic Bills' usage of Google and Office 365 email is described below.

• After You authorise the connection, Cosmic Bills will create a COSMICBILLS folder, a COSMICBILLS/BILLS folder and a COSMICBILLS/STATEMENT folder.
• Cosmic Bills only reads emails in the INBOX or the COSMICBILLS folder.
• In Automatic mode, any emails that You receive (to Your INBOX) will be read. If they contain an invoice, these invoices will get processed and exported to Your accounting system, and afterwards they will be moved to the COSMICBILLS/BILLS folder.
• In Manual mode, any emails moved to the COSMICBILLS folder will be read, and if they contain an invoice, the invoice will get processed and exported to Your accounting system. If an email contains an invoice, it will get moved to the COSMICBILLS/BILLS folder.
• Cosmic Bills does not delete any emails from Your account.
• Cosmic Bills extracts invoice data from Your incoming emails. It then exports invoice data and these files to the accounting application that You have authorised Cosmic Bills to integrate with. Other than this, Cosmic Bills does not share any of Your emails, or information contained in the emails, with any other third party.
• Cosmic Bills' use of information received from Google APIs, and Cosmic Bills' transfer of information to any other applications, will adhere to Google's Limited Use Requirements.

4. GDPR compliance

In 2012, the European Commission began a process to reform Europe's existing data protection laws by proposing a new data protection regulation to replace the Data Protection Directive. GDPR was agreed and adopted in 2016 and took effect on 25 May 2018.

At Cosmic Bills, we take our responsibilities under GDPR seriously. That's why our security and development teams have identified and implemented the necessary changes to be compliant with GDPR. We have stringent procedures for key data subject rights, such as subject access requests and the right to request deletion.

The data privacy principles that Cosmic Bills has adopted from inception, as detailed on this page above, have positioned us correctly for the introduction of data privacy initiatives such as GDPR. Here is a summary of the key features we have, including changes we have made for GDPR compliance:

• Minimal collection of private information. The primary item of information that Cosmic Bills collects from users is an email address. This is collected at initial user sign-up. Subsequently, documents such as bills, sale invoices and receipts are uploaded by users to Cosmic Bills for data extraction and processing. The extracted data, and/or a copy of the document, are exported to the user's accounting system. Cosmic Bills also obtains minimal user data from the user's accounting system, the connection to which is authorised by the user at the initial setup.
• Compliant use of private information. User email addresses are used only for communication with the user and are not distributed or used in any other way. Document files are uploaded by the user for data processing and then exported to the user's accounting system. Document files are stored by Cosmic Bills for the sole purpose of complying with the relevant tax office requirement of record keeping and Cosmic Bills' own record keeping. Data from the user's accounting system is obtained for the sole purpose of exporting the correct invoice data to the accounting system or alerting the user to a supplier item price rise. User data is not distributed to any third party or used in any other way.
• Compliant storage of private information. Similar to many SaaS providers, we use a top-tier, third-party data hosting provider (AWS web services) with servers located in the USA to host our online services.
• User access to data. Cosmic Bills users with a valid subscription have unrestricted access to their private data, including email address and stored document copies, at any time via the Cosmic Bills online portal. The user can access the data Cosmic Bills obtained from the user's accounting system via the user's accounting system, with Cosmic Bills data lagging behind by a maximum of one week.
• Right to erasure. The user's email address, invoice documents, and the user data from the user's accounting system can be deleted by Cosmic Bills upon special request from the user. This will invalidate Cosmic Bills' commitment to satisfy the tax office's requirement of record keeping for past documents processed.
• Right to restrict processing. Cosmic Bills has user Settings. In the Settings, a user can choose not to use certain services of Cosmic Bills to restrict processing of the relevant data. When a user's subscription has expired, Cosmic Bills stops processing user data.
• Right to data portability. Cosmic Bills provides methods for users to obtain past document data in a user-friendly, commonly used and machine-readable format. The user can then freely transmit that data to another controller.
• Right to object. A Cosmic Bills user has the right to object to the usage of user data. The consequences of that will be notified and explained to the user.
• User contracts and terms and conditions. The terms and conditions are available on Cosmic Bills' website. Upon special request, a written contract can be provided to the user for signing.
• Breach notification. Breach notification will be sent to the member where a data breach is likely to "result in a risk for the rights and freedoms of individuals". This must be done within 72 hours of first having become aware of the breach. Cosmic Bills will notify its customers, the controllers, "without undue delay" after first becoming aware of a data breach.