PRAVNO

Privacy policy

Effective date: 23 July 2026

This Privacy Policy explains how MATHCODE d.o.o. (“we”, “us”, “our”) collects, uses and protects information when you use:

BillZi — our invoice-scanning mobile app for Android and iOS; and
AIron — our on-premises AI workflow automation platform

(together, the “Services”).

This Policy is a privacy notice. It does not replace any consent or other legal basis that may be required for a particular processing activity.

1. Data controller and contact

Data controller for BillZi and MATHCODE’s own commercial, support and website-related processing:

MATHCODE d.o.o.
Hrvatskih branitelja 116A
44320 Kutina
OIB: 02570890421
Croatia

Contact email for privacy matters: info@mathcode.hr

For personal data that an AIron customer processes through its mailbox, workflows and connected services, the customer determines why and how that data is processed and is normally the data controller. This includes mailbox content, scheduling data and information about the customer’s users or other correspondents.

MATHCODE hosts AIron and its LLM and processes that customer-controlled data on the customer’s documented instructions. For this processing, MATHCODE acts as a processor under a data processing agreement in accordance with Article 28 GDPR. MATHCODE accesses customer content only as required to operate, secure, maintain or support AIron and does not use it for MATHCODE’s own purposes.

Questions about personal data contained in a customer’s mailbox or AIron workflows should be directed to that customer using the contact information in its own privacy notice.

2. Scope

This Policy applies to:

The BillZi app on Google Play (Android) and the Apple App Store (iOS)
The AIron platform hosted by MATHCODE in Zagreb, Croatia and accessed at https://airon.mathcode.hr
MATHCODE’s support, maintenance and related services for either Service

A customer using AIron must provide its own privacy notice to the people whose personal data it processes.

3. Information we collect

3.1 BillZi

3.1.1 Account and authentication information

Account details (e.g. email address, username and other registration data you provide).
Authentication information when you sign in with Google Sign-In or Apple Sign-In. We do not store your Google or Apple password; we only receive the data necessary to identify you and create or log into your BillZi account.

3.1.2 Photos and documents

Photos and images you upload or capture in the app.
Invoice-related documents and content you manage through BillZi.
These are stored on our servers to provide the core functionalities of the app (e.g. storing and managing invoices).

3.1.3 Device and usage data

Device type and model, operating system version, language settings.
App version and settings.
Usage data (e.g. screens viewed, features used, in-app actions).
IP address and similar technical identifiers.
Some of this information may be collected via Firebase Analytics.

3.1.4 Crash and performance data

We use Firebase Crashlytics and similar tools to collect crash reports and performance data (device model, OS version, app version, technical details about the crash/error), used only to debug and improve app stability.

3.1.5 Financial and invoice data

Within the app, you may create and manage invoices and related financial information (e.g. client details, invoice amounts, dates, items), stored on our servers to provide the core invoicing features.
We do not store your payment card details. If any payment is processed, it is done through external providers (e.g. Google/Apple), according to their own privacy policies.

3.2 AIron

3.2.1 Local account, authentication and security information

AIron stores the account information required to operate the customer’s hosted service, such as a user’s name, email address, organization, role, language, account status and authentication events. AIron uses password-free email login links and time-based one-time passwords (TOTP), together with recovery codes. It does not store an AIron account password. Authentication secrets and session data are protected using encryption or one-way hashing, as appropriate.

The customer controls which members of its staff may access AIron and which roles they receive.

3.2.2 Connected accounts and integrations

When the customer connects an email, calendar or business system to AIron, AIron stores the credentials or authorization tokens needed to perform the customer’s configured workflow. Those credentials are encrypted at rest on the MATHCODE-hosted AIron server. AIron does not receive or store the user’s password for an OAuth-connected service.

Supported connections may include Gmail and Google Calendar, Microsoft Outlook/Microsoft 365, IMAP/SMTP mailboxes, MCS Calendar and other customer-configured workflow destinations. Only the connections enabled by the customer apply to a particular deployment.

The customer—not MATHCODE—selects, contracts with and connects its email, calendar and destination providers. AIron exchanges only the data required to perform the operations configured by the customer.

The connected provider may independently retain and process data under the customer’s agreement with that provider and the provider’s privacy terms.

3.2.3 Mailbox, workflow and scheduling data

Depending on the workflows enabled by the customer, AIron may process and locally store:

sender and recipient details, message subject, message body, identifiers, headers and timestamps;
scheduling requests, proposed or confirmed time slots and calendar event identifiers;
classifications, extracted information, reply drafts and workflow outcomes;
workflow definitions, settings, execution inputs, execution results and operational audit records; and
business, customer, financial or health-related information that a sender includes in a message or document.

Message content and workflow payloads stored by AIron are encrypted at rest on the MATHCODE-hosted server in Zagreb.

Messages classified as other or unclear are normally removed from AIron shortly after classification if the conversation has not progressed and no configured workflow has claimed it for retention. The original message remains in the customer’s mailbox. AIron retains a limited technical record needed to prevent the same message being imported repeatedly and to record that it was rejected. General enquiries, scheduling messages, progressed conversations and messages claimed by a configured workflow may be retained under the customer’s retention schedule.

Where general-question handling is enabled, AIron prepares answers using relevant information retrieved only from knowledge-base documents that the customer has approved and added to its retrieval-augmented generation (RAG) library. Administrators are instructed not to upload individual user records to this library. RAG documents, their text chunks and embeddings remain on the MATHCODE-hosted server until an authorized administrator updates or deletes them.

3.2.4 Attachments

AIron does not use its local database as permanent storage for original attachment files. Attachment metadata, such as filename, type, size and mailbox reference, may be stored with the encrypted workflow record. When a workflow needs an attachment, the original file is fetched from the connected mailbox.

An attachment may be written to a restricted temporary directory while it is being processed and is deleted from that temporary location after processing. Text or structured information extracted from the attachment may be stored as encrypted workflow or audit data. If the customer configures a workflow to upload an attachment to another system, that system receives and retains the file according to the customer’s configuration and its own privacy terms.

The original attachment also remains subject to the retention settings of the connected mailbox.

3.2.5 In-house AI processing

The AIron application and the MATHCODE-owned and operated LLM service run on a MATHCODE computer at secured premises in Zagreb, Croatia. Physical access to that computer is restricted to authorized MATHCODE personnel. Mailbox content, prompts and model responses are not sent to an external or third-party cloud AI provider. They are not used to train or improve an external or shared model.

AIron may keep encrypted LLM prompts and responses for a limited period for security, troubleshooting and workflow review. The default period is 30 days and is the period configured for the current service.

3.2.6 Device, usage, audit and performance data

AIron processes technical data needed to secure and operate the hosted service, including IP address, browser and device information, session activity, security events, workflow activity, errors, performance metrics and audit records.

AIron does not send mailbox content or product analytics to an external analytics provider. Operational monitoring is performed on MATHCODE-controlled infrastructure.

3.2.7 Support information

If a customer requests support, we process the contact details, correspondence, diagnostic information and other information that the customer chooses to provide. Authorized MATHCODE personnel may remotely administer the AIron computer for operation, security, maintenance and contracted support. Access is limited by role, logged where technically available and governed by the applicable data processing agreement. Customer content is not reviewed unless this is necessary for an authorized support, security or maintenance task.

4. How we use your information

Provide and operate our Services

Create and manage your account (BillZi and/or AIron).
Store and manage your invoices and related documents (BillZi).
Run workflows and automations configured by the customer, including interacting with the email, calendar and business systems selected by the customer (AIron).
Classify incoming messages, prepare or deliver replies according to the customer’s selected delivery mode, and support scheduling or other configured business processes (AIron).
Answer enabled general questions using only knowledge-base information approved by the customer (AIron).
Authenticate users, enforce role-based access and protect the Services.
Ensure the app or platform functions correctly on your device or browser.

Improve, secure and maintain our Services

Analyze usage to understand which features are used most.
Fix bugs and improve performance using crash, diagnostic and analytics data.
Detect, investigate and prevent security incidents, misuse and unauthorized access.

Communicate with you

Send push notifications related to invoices or app usage (BillZi) — controllable via device settings.
Send service-related emails, such as login links, workflow alerts or account notifications (AIron).
Respond to support, security and privacy requests.

We do not use personal data from either Service for advertising or advertising profiles, and we do not use AIron customer content to train shared or external AI models.

During the initial validation period for an AIron customer, outbound replies are restricted to provider-side drafts for human review. Once the customer has validated a defined workflow or use case, the customer may authorize direct sending for that workflow. AIron routes uncertain or exceptional cases for human attention according to the configured rules. AIron is not intended to diagnose, answer medical questions or make treatment decisions.

5. Legal bases for processing

Where MATHCODE acts as controller, and depending on the circumstances, we rely on:

Performance of a contract — to provide the core functionality of BillZi, manage our customer relationship and provide contracted AIron support.
Legitimate interests — to maintain, secure and improve our Services, prevent misuse, keep appropriate business records and communicate with customers, provided those interests are not overridden by the rights and interests of the affected person.
Consent — where required, for example for push notifications or certain analytics settings. Consent can be withdrawn at any time without affecting processing carried out before withdrawal.
Compliance with a legal obligation — where applicable, for example for accounting, tax, security or data protection obligations.

The AIron customer, as controller, is responsible for identifying and documenting the legal basis for the personal data it processes through AIron. For a healthcare provider, this may include taking steps at a person’s request before providing a service under Article 6(1)(b) GDPR and, where a message contains health data, processing necessary for healthcare under Article 9(2)(h) GDPR subject to the conditions and safeguards required by law. The customer must confirm the appropriate legal bases with its legal adviser.

6. Data storage and retention

6.1 BillZi

We store your data for as long as your account is active and you use BillZi.

If you request deletion of your BillZi account or data, we will delete or anonymize your personal data, except where we are required by law to keep it longer, for example accounting or tax-related records, or where an independent third-party provider retains data under its own policy.

6.2 AIron

AIron application data and LLM processing remain on MATHCODE-controlled infrastructure in Zagreb, Croatia. MATHCODE applies the technical retention behavior described below on the customer’s instructions.

The standard AIron behavior is:

original attachment files are fetched when needed and are not permanently stored in the AIron database;
temporary attachment files are deleted after processing;
unprogressed messages classified as other or unclear are normally purged from AIron shortly after classification, subject to workflow-retention and safety conditions;
encrypted LLM prompt and response audit entries are retained for 30 days by default; and
scheduling threads, general enquiries and related workflow records have no fixed automatic expiry in the standard service and remain until an authorized user deletes them, a configured retention rule deletes them, or the AIron service for that customer ends;
non-LLM audit records remain for the lifetime of the customer deployment unless an authorized retention or deletion procedure removes them; and
RAG documents, their text chunks and embeddings remain until an authorized administrator updates or deletes the source document.

Encrypted backups are retained for no longer than 30 days and are then overwritten or securely deleted under MATHCODE’s backup retention schedule. Data that becomes part of a medical record is retained by the healthcare provider under its applicable legal retention obligations.

When the AIron service ends, personal data is returned or deleted as agreed in the data processing agreement and subject to applicable law and backup retention.

7. Data sharing and recipients

We do not sell personal data and do not share it with third parties for their own marketing or advertising.

Service providers — BillZi

Our servers/hosting provider, where invoice and account data is stored.
Firebase Analytics (Google) — anonymized/aggregated usage analytics.
Firebase Crashlytics — crash reporting.

AIron recipients and processors

MATHCODE hosts the AIron application, database and LLM on its own computer in Zagreb and processes customer-controlled data as a processor under the applicable data processing agreement.
No external cloud AI/LLM provider receives prompts or mailbox content.
The email, calendar and business systems selected by the customer receive the data necessary to perform the configured operation. These may include Google, Microsoft, an IMAP/SMTP provider, MCS or another customer-selected destination.
MATHCODE personnel may access customer-controlled data only as necessary to operate, secure, maintain or support AIron.

Authentication providers — BillZi

Google and Apple, where you choose to sign in to BillZi using those providers.

Processors engaged by MATHCODE are bound by appropriate data processing and confidentiality obligations. Customer-selected services process data according to the customer’s agreement with them and their applicable privacy terms.

8. International data transfers

Some BillZi service providers, including Google services, may process data outside the European Economic Area (EEA). Where MATHCODE is responsible for such a transfer, we use an applicable transfer mechanism and appropriate safeguards as required by law.

AIron application, database and LLM processing takes place on MATHCODE-controlled infrastructure in Zagreb, Croatia, within the EEA, and is not transferred to an external cloud AI provider. However, data sent to a customer-selected email, calendar or destination provider may be processed in other countries under the customer’s agreement with that provider. The customer, as controller, is responsible for assessing those transfers and implementing any required safeguards, with MATHCODE’s assistance where required under the data processing agreement.

9. Security

We and, for its AIron deployment, the customer use appropriate technical and organizational measures designed to protect personal data, including:

physical access to the AIron computer restricted to authorized MATHCODE personnel;
HTTPS or other encrypted transport for supported data transmissions;
encryption at rest for AIron message content, workflow content, LLM audit content, authentication secrets and connected-service credentials;
password-free AIron authentication, mandatory TOTP, recovery codes, role-based authorization and additional authentication for sensitive administrative actions;
hashing of AIron session bearer tokens;
restricted temporary storage and cleanup of attachment files;
access controls, audit records, rate limits and operational security practices; and
safeguards intended to prevent sensitive message and provider content from being written to ordinary application logs.

No system can be completely secure, and we cannot guarantee absolute security. MATHCODE is responsible for securing the hosted AIron computer and its MATHCODE-managed infrastructure. Customers are responsible for their users, access assignments, connected accounts and the third-party providers they choose to connect.

10. Your rights

Depending on applicable law and the circumstances, you may have the following rights:

Right to information and access — to receive information about processing and a copy of your personal data.
Right to rectification — to correct inaccurate or incomplete data.
Right to erasure — to request deletion of data, subject to legal exceptions and retention requirements.
Right to restriction of processing — to request that processing be limited in certain circumstances.
Right to data portability — to receive data you provided in a structured, commonly used, machine-readable format where the legal requirements apply.
Right to object — to object to processing based on legitimate interests or a public task.
Rights concerning solely automated decisions — to the extent Article 22 GDPR applies.
Right to withdraw consent — where processing is based on consent.

For BillZi or data for which MATHCODE is controller, contact info@mathcode.hr.

For mailbox, scheduling or other workflow content processed through a customer’s AIron deployment, contact the customer identified in its privacy notice. If MATHCODE receives a request concerning customer-controlled data, we will direct it to the relevant customer or assist that customer as required by our data processing agreement.

You also have the right to lodge a complaint with a competent supervisory authority. In Croatia, this is the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka — AZOP), www.azop.hr.

11. Children’s privacy

BillZi and AIron are not consumer services directed at children. We do not knowingly create BillZi or AIron staff accounts for children. If you believe a child has provided personal data directly to us, contact us so that we can take appropriate action.

A healthcare provider may process information about a minor or a minor’s appointment through its own AIron deployment where permitted by law. The healthcare provider is responsible for explaining that processing in its own privacy notice and applying the safeguards required for minors and health data.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Effective date” at the top and make the updated version available in the app and/or on our website. Where required by law, we will provide additional notice or obtain consent before a material change takes effect.

13. Contact

MATHCODE d.o.o.
Hrvatskih branitelja 116A
44320 Kutina
OIB: 02570890421
Croatia
Email: info@mathcode.hr