Privacy Policy
Last updated
This policy explains what personal data ByteBill collects, why we collect it, how long we keep it and what rights you have. It covers the ByteBill mobile app and this website.
Who is responsible
OneArkive AS ("OneArkive", "we") is the data controller for the personal data described here.
- Organisation number: 929 347 900
- Registered address: Fossumberget 40, 0983 Oslo, Norway
- Privacy contact: support@bytebill.no
- Data protection officer: we have not appointed one, as we are not required to. Contact support@bytebill.no.
For the accounting records you keep inside ByteBill about your own customers, suppliers and employees, you are the controller and we are your processor. See Our role in your books below.
What we collect, and why
Account and identity
| Data | Why | Legal basis |
|---|---|---|
| Phone number | It is your login and your account identifier. Your country is derived from its calling code. | Contract |
| One-time SMS codes | To verify it is you signing in | Contract |
| Name and national identity number, where you verify with BankID | To confirm you may act for the organisation you connect | Contract; legal obligation |
| Organisation numbers you connect | To receive invoices addressed to your company and to keep its books | Contract |
Invoices and accounting data
Invoices you receive and send, receipts and bills you capture, your ledger, customers, products, employees and payroll. This is the substance of the service.
Legal basis: performance of our contract with you, and compliance with the bookkeeping obligations the service exists to help you meet.
Support correspondence
When you contact us we keep your name, email address, what you wrote and our reply — so we can answer you and so there is a record of what we told you.
Legal basis: legitimate interest in providing support.
Technical and usage data
Server logs (IP address, timestamps, requests), crash and error diagnostics, and app version. Used to keep the service running, to investigate faults, and to detect abuse.
Legal basis: legitimate interest in operating a secure and reliable service.
This website
This site is static and carries no analytics, advertising or tracking cookies. See the cookie policy.
What we do not do
- We do not sell your personal data. Not to anyone, in any form.
- We do not use your accounting data to build advertising profiles.
- We do not use your books to train machine-learning models.
- We do not read your accounts as a matter of routine. If answering a support question needs us to look at a specific record, we will tell you.
Where your data is stored
Your region is determined by the phone number you verify with, and your data is stored in that region's environment.
| Region | Where |
|---|---|
| Norway and the EU | Amazon Web Services in Stockholm, Sweden (eu-north-1), with disaster-recovery copies in Microsoft Azure Norway East, Norway |
| United Arab Emirates | Not open yet. When it opens: Microsoft Azure in the UAE |
The environments are kept separate.
Who we share it with
We share personal data only with the processors we need to run the service. Each is bound by a data processing agreement. The current list, with what each one does and where it operates, is on the subprocessors page.
We also disclose data where we are legally required to — for example a valid order from a court or a competent authority.
How long we keep it
| Data | Retained |
|---|---|
| Accounting records and the documents behind them | For the statutory retention period (in Norway: 5 years after the end of the financial year, bokføringsloven § 13), because bookkeeping law requires it |
| Account and identity data | While your account is open |
| Support correspondence | 2 years after the case is closed |
| Server logs | Up to 2 years |
When you delete your account we remove your account and identity data. Records subject to a statutory retention obligation are retained for the remainder of that period and then deleted. See Delete your account for exactly what goes and what stays.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Rectify data that is wrong
- Erase data, where no retention obligation applies
- Restrict or object to processing based on legitimate interest
- Portability — receive your data in a machine-readable format. ByteBill has SAF-T export built in, so you can exercise this yourself at any time
- Withdraw consent, where processing is based on consent
To exercise any of these, write to support@bytebill.no. We respond within one month.
If you believe we have handled your data wrongly, you may complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or your local supervisory authority.
Our role in your books
The invoices, customer records, supplier records and employee data you keep in ByteBill are your records. You decide what goes in them and why. For that data you are the controller and we act as your processor, handling it on your instructions.
If you need a data processing agreement for your own compliance, write to support@bytebill.no.
Children
ByteBill is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.
Security
We use encryption in transit and at rest, passwordless authentication, and an optional app PIN lock. Access to production systems is restricted and logged.
To report a vulnerability, write to support@bytebill.no.
Changes
We will update this policy as the product changes. The date at the top shows when it was last revised. For changes that materially affect you, we will notify you in the app or by email before they take effect.
Contact
OneArkive AS Fossumberget 40, 0983 Oslo, Norway support@bytebill.no