Bilanea

Privacy

Privacy policy

We collect only what the service needs, your accounting documents serve your own analyses alone, no model is trained on them and you stay in control at all times. Version of 8 September 2026.

Controller

The controller is ICRAFT, 58 rue de Monceau, 75008 Paris, France, registered under number 992314237. A data protection contact handles your requests within one month; reach them through the contact form with the mention "personal data". The publisher is not required to appoint a data protection officer (Article 37 GDPR): it processes neither special categories of data at scale nor systematic monitoring of individuals.

Data we process

  • Account: first name, last name, e-mail address, hashed password, language, declared profile (director, acquirer, chartered accountant…), consent to communications, login dates
  • Organisation: name, SIREN, subscribed plan, members and roles, credit balance and movement history
  • Uploaded accounting documents (accounting entries file, general ledger, balance sheet, tax return) and everything derived from them: analyses, reports, optimisation plans, questionnaire answers, monthly check-ins
  • Marketplace: listings, non-disclosure agreements (signatory name, timestamp, IP address), offers, deposits, messages exchanged, deal stages
  • Billing: identity, address, VAT number and invoices; card details are entered at Stripe and never reach us
  • Support: contact form messages, help requests, tickets
  • Technical: IP address, browser, timestamps of sensitive actions (audit log), content security policy violation reports, server logs
  • Referral: code used and referred organisation

Purposes and legal bases

  • Providing the subscribed service: account, analyses, plans, marketplace, notifications and service e-mails (performance of the contract)
  • Invoicing, collecting payment and keeping accounting records (legal obligation: ten years)
  • Securing the platform: authentication, lockout after failed attempts, audit log, rate limiting, fraud prevention (legitimate interest)
  • Improving the service from aggregated, anonymised statistics (legitimate interest); no customer data feeds the benchmarks without aggregation
  • Sending you guides and product news (consent, withdrawable at any time from your profile or through the unsubscribe link)
  • Answering your support requests and requests to exercise rights (legal obligation and legitimate interest)

Accounting documents: roles and safeguards

A general ledger or an accounting entries file contains personal data of third parties: employees, directors, customers, suppliers. For that data, the organisation uploading the document is the controller and Bilanea acts as processor, under the Article 28 GDPR terms set out in the terms of use: processing on instructions, solely to produce the requested analyses, confidentiality of authorised persons, sub-processors listed below, assistance with data subject requests, notification of any breach within 48 hours, deletion on request or when the account is closed.

Documents are read only by the calculation engine and, for scanned files or written summaries, by a language model under professional terms that exclude training. Team access is limited to support, at your request, and administration actions are logged.

Public company data

The observatory, the radar and the opportunity pages reuse data published by the official bulletin of civil and commercial announcements, the company directory and the National Institute of Industrial Property: company name, directors, directors' age bracket, proceedings, sales and transfers, filed accounts. This processing relies on our legitimate interest in informing acquirers and on the public nature of these registers. Persons named may request rectification at the source or, on a reasoned request, removal of a record from our pages.

Processors and recipients

  • OVH SAS (Roubaix, France): hosting of servers, database, documents and backups
  • Cloudflare, Inc. (United States, certified under the EU-US Data Privacy Framework): network, attack protection, routing of e-mails sent to the contact address
  • Stripe Payments Europe, Ltd (Ireland): payment, invoicing, VAT calculation, billing portal
  • Resend, Inc. (United States, standard contractual clauses): transactional e-mail delivery
  • Mistral AI SAS (Paris, France): reading of scanned documents and drafting of summaries, with no retention of and no training on your data
  • Google Ireland Ltd (Firebase Authentication, certified under the Data Privacy Framework): only if you choose to sign in with a Google account
  • pCloud AG (Switzerland, a country recognised as adequate by the European Commission): off-site copy of encrypted backups
  • No data is sold or shared with advertisers. Authorities access it only under a lawful order.

Transfers outside the European Union

Data is hosted and processed in France. Three providers may access it from the United States (Cloudflare, Resend, Google): these transfers are covered by the adequacy decision on the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses, a copy of which is available on request. The backup copy in Switzerland is covered by an adequacy decision.

Retention periods

  • Documents, analyses, reports and plans: as long as your organisation exists; you can delete them at any time from your workspace, deletion takes effect immediately and reaches the backups within sixty days at most
  • Account: until you delete it or after three years without a login; personal data is then anonymised
  • Invoices and payment records: ten years (accounting obligation)
  • Marketplace non-disclosure agreements and offers: five years after the end of the deal (limitation period)
  • Audit log, e-mail history and notifications: twelve months
  • Technical server logs: thirty days
  • Backups: fourteen days on the server, sixty days for the encrypted off-site copy
  • Contact messages and help requests: three years

Security

Encrypted connections (TLS 1.2 minimum, preloaded HSTS), hashed passwords, temporary lockout after five failed attempts, strict isolation per organisation, hashed and revocable API keys, nonce-based content security policy, rate limiting, audit log of sensitive actions, daily encrypted and tested backups. Details are on the dedicated page. In the event of a data breach likely to put you at risk, we inform you without delay and notify the CNIL within 72 hours.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to set instructions on the fate of your data after your death. From your workspace you can edit your profile, download a complete JSON export of your data, delete your documents and analyses, and delete your account. For any other request, use the contact form: we answer within one month, after verifying your identity if necessary. You may also lodge a complaint with the CNIL, the French supervisory authority.

Cookies

The website uses only strictly necessary cookies, exempt from consent: the authentication session cookie, the anti-forgery request token and the return address after sign-in, all limited to the signed-in area. The theme preference is stored locally in your browser. No advertising cookie, no audience measurement tool and no third-party tracker is set, which is why no consent banner is shown.

Updates to this policy

This policy changes when the service or its providers evolve. The version date appears at the top of the page; a change of processor or purpose is announced by e-mail to account holders at least fifteen days before it takes effect.