Privacy Policy
Effective date: September 11, 2026 Last updated: September 11, 2026
This policy explains how NEXTAPP LABS S.R.L., Strada Budeasa Mare nr. 228, Sat Budeasa Mare, Comuna Budeasa, Județ Argeș, Romania, company ID (CUI) 52062227, Trade Register no. J2025047098001, operator of the Halfbill service ("Halfbill", "we", "us") processes personal data when you use halfbill.uk, the Halfbill API, Halfbill Chat, the dashboard and the documentation (the "Service"). Halfbill is the controller for the data described in sections 2 to 4. For personal data you send through the API as part of your own applications, you are the controller and we are your processor (section 5).
Contact for privacy matters: legal@halfbill.uk. Data protection officer: not appointed.
1. Summary
- We do not store the content of API prompts or responses by default. Content passes through our systems to generate a response and is not written to persistent storage unless you enable retention for a project.
- We keep request metadata (model, token counts, latency, cost, key and project identifiers, status) for 30 days.
- Account, billing and support data are kept for as long as your account exists and as required by tax law afterwards.
- Prompts are transmitted to the infrastructure that runs the selected model, which may be outside the EEA. Transfers rely on the safeguards in section 7.
- You have the rights listed in section 8, exercisable by email to legal@halfbill.uk.
2. Data we collect
Account data. Name, email address, password hash or third-party sign-in identifier, organization name, role, preferences, time zone.
Billing data. Billing address, VAT ID, invoice history, credit balance and transactions, subscription status. Card details are collected and stored by our payment processor, not by us; we receive a token, the card brand and the last four digits.
Usage metadata. For each API or chat request: timestamp, model, endpoint, token counts (input, output, cached), latency, cost, response status and finish reason, API key and project identifiers, request id, coarse client information (SDK or user-agent string, IP address).
Content (only where enabled). If you switch content retention on for a project, or use Halfbill Chat (which stores your conversation history so you can return to it), we store the prompts and responses concerned for the retention period you choose or until you delete them.
Support and communications. Emails you send us and our replies.
Website data. Server logs (IP address, user agent, requested URL, timestamp) and product analytics events in the dashboard. We do not use advertising trackers.
3. Why we process it and on what basis
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Providing the Service, generating responses | account data, usage metadata, content in transit | Contract (1)(b) |
| Billing, invoicing, fraud prevention | account and billing data, usage metadata | Contract (1)(b); legal obligation (1)(c); legitimate interest (1)(f) |
| Spend limits, rate limits, abuse detection | usage metadata | Contract (1)(b); legitimate interest (1)(f) |
| Chat history, optional content retention | content | Contract (1)(b) at your request |
| Support | communications, account data | Contract (1)(b) |
| Security and operations | server logs, usage metadata | Legitimate interest (1)(f) |
| Product analytics | dashboard events | Legitimate interest (1)(f); consent where required |
| Service announcements, legal notices | email address | Contract (1)(b); legal obligation (1)(c) |
We do not sell personal data and we do not use your prompts or responses to train models.
4. Retention
| Data | Retention |
|---|---|
| Prompt and response content (API, default) | Not stored |
| Prompt and response content (retention enabled) | Period you select per project; deletable by you at any time |
| Halfbill Chat conversations | Until you delete them or close your account |
| Request metadata | 30 days |
| Aggregated usage statistics (no content, no IP) | Duration of the account, for dashboards and invoices |
| Account data | Duration of the account, then deleted within 30 days of closure |
| Invoices and transaction records | 10 years, as required by Romanian accounting law |
| Server logs | 30 days |
| Support emails | 2 years after the last message |
5. When we act as your processor
Personal data contained in the Input you send through the API on behalf of your own users is processed only to generate the Output and to operate the Service, on your documented instructions, for the retention periods above. We will assist you with data-subject requests relating to such data, notify you of personal data breaches affecting it without undue delay, and delete or return it at the end of the contract. Our data processing terms, including the list of sub-processors, are available on request at legal@halfbill.uk. Do not send special categories of personal data (GDPR art. 9) through the Service unless your application requires it and you have a lawful basis.
6. Who receives data
Model infrastructure. To generate a response, the content of a request is transmitted to the systems that run the selected model. These systems may be operated by the model vendor or by a hosting provider, and may be located outside the EEA. Content is processed to return the response; we contractually require that it is not used for training and is retained only as needed to provide the service and to detect abuse. The list of processors is available on request at legal@halfbill.uk.
Service providers. Cloud hosting, database and cache hosting, payment processing, transactional email, error monitoring and product analytics. Each provider is bound by a data processing agreement. The list of sub-processors with their locations is available on request at legal@halfbill.uk.
Authorities. Where required by law or a binding order, or to establish, exercise or defend legal claims.
Business transfers. In a merger, acquisition or asset sale, to the successor, under this policy.
7. International transfers
Halfbill is established in Romania. Where personal data is transferred outside the EEA, we rely on an adequacy decision of the European Commission where one exists, or on the Standard Contractual Clauses (Commission Decision 2021/914) together with supplementary measures where needed. You may request a copy of the relevant safeguards at legal@halfbill.uk.
8. Your rights
Under the GDPR you may request access to your personal data, rectification, erasure, restriction of processing, portability, and you may object to processing based on legitimate interest. Where processing is based on consent you may withdraw it at any time. Write to legal@halfbill.uk; we respond within one month. You can also lodge a complaint with the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or with the authority in your country of residence.
Most account data can be edited or deleted directly in the dashboard. Closing your account deletes account data within 30 days, except records we must keep under tax law.
9. Security
API keys are stored as hashes and shown once at creation. Data in transit is encrypted with TLS; data at rest is encrypted by our hosting providers. Access to production systems is limited to staff who need it and is logged. We will notify you and, where required, the supervisory authority of a personal data breach without undue delay.
10. Cookies
The website and dashboard use strictly necessary cookies for sign-in, security and your preferences (such as theme and time zone). Product analytics in the dashboard use a first-party cookie; where consent is required by law we ask for it before setting it. We do not use third-party advertising cookies.
11. Children
The Service is not directed at children under 16 and we do not knowingly collect their data.
12. Changes
We will announce material changes to this policy by email or in the dashboard before they take effect. The "Last updated" date shows the current version.
Contact
NEXTAPP LABS S.R.L., Strada Budeasa Mare nr. 228, Sat Budeasa Mare, Comuna Budeasa, Județ Argeș, Romania · CUI 52062227 · J2025047098001 · legal@halfbill.uk