What we collect, and why

1Who we are

Overbill Ltd is a company registered in England and Wales, number 16315639, with its registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. For anything on this page, write to [email protected]. We answer privacy requests ourselves; there is no ticket queue.

For the website and for enquiries we are the data controller. For the documents you send us as a customer you are the controller and we are your processor, acting on your instructions under a written agreement.

2This website

No cookies, no advertising trackers, no session storage, and therefore no consent banner — there is nothing to consent to. Page views are counted without cookies and without building a profile of you, by Cloudflare Web Analytics and by a counter of our own run on Joogoos’s servers in Germany, which keeps no identifier.

Cloudflare serves this site and, as with any web server, records the usual request information including IP addresses, for security and abuse prevention. We do not use it to identify you.

3If you email us or book a call

We keep your message and any attachments in order to reply, and to produce your audit report if you have asked for one. Our lawful basis is our legitimate interest in responding to someone who contacted us, and the steps taken at your request before entering a contract.

To book a call you pick a time in our booking calendar, run by Cal.com, which keeps your name, email, company and carrier spend to arrange the call and send the invite; the calendar is theirs, shown inside our page, and may set its own cookies. If you send the form on that page instead, your message reaches us by email through Resend.

• We do not add you to a mailing list.
• We do not pass your details to anyone else.
• Ask us to delete it and we will, and we will confirm when it is done.

4Signing in, and the free month

To sign in we keep your name, your email address and your company. When you ask us for a call, we keep what you tell us, to arrange it.

Invoices, rate cards and shipment exports sent during your free month or a subscription are stored in the EU — the database on our own server in Germany, the files in Cloudflare R2 under its EU jurisdiction — and used to produce your report and to match the carrier’s credits to your claims, and nothing else. They are never shown to or shared with another customer, never sold, and never used to train any model. What we learn about how a carrier lays out its files or names its charges — never your amounts, names or shipments — may, once several customers have confirmed it, help us read other customers’ files.

We delete them on request at any point. If you do not subscribe, your company, its documents and its findings are deleted 90 days after your report is sent.

5Personal data inside your files

We process your carrier invoices, shipment records and rate agreements to check your billing. You are the controller; we act on your instructions under a data processing agreement, which we sign before you send anything if you ask.

Shipment records usually contain personal data — recipient names, delivery addresses, sometimes phone numbers or email addresses. We do not need it and do not use it, but it arrives inside your export, so:

• It is used only to match an invoice line to a shipment and to support a finding.
• It is kept while you subscribe, and deleted with your company: 90 days after your subscription ends, or sooner if you ask.
• When your company is deleted, its findings go with it. We keep one line saying which company was deleted, when and why, and nothing from its files.
• You can ask for a copy of your data, or for its deletion, at any time, and we confirm when a deletion is done.

6Where it is, and who else touches it

The database is on our own server in Germany, and your documents are in Cloudflare R2 under its EU jurisdiction: both inside the EU. We do not say "UK hosted", because it would not be true.

Everyone who could touch your data, and why. We will tell customers before adding a new one.

• Hetzner, Falkenstein, Germany: the server the product and its database run on.
• Cloudflare, EU / global network: your documents (R2, EU jurisdiction), DNS, this website, the tunnel, email routing.
• Resend, United States: sign-in and notification email, and the Book a call form’s message to us.
• Cal.com, United States: the booking calendar on Book a call, which takes your name, email, company and carrier spend, to arrange the call.
• Joogoos, Germany: a page-view counter for this website, without cookies or any identifier.
• Google, United States: sign-in with Google, if you choose it.
• GitHub, United States: our work tracker. A request to read a new kind of file is logged there as counts and column names, never your amounts, names or the file.
• Anthropic, United States: public facts about a new company (its name and website) when its setup is prepared, if we switch that on; and, only for a company that has turned on AI reading its files, a file Overbill cannot read with its own code, so that its model can draft how to read it.

7AI processing

Models are used to read documents at setup, and every reading is confirmed by a person before it counts. A model never decides that a charge is wrong.

Each customer chooses whether its documents may be shown to an external model provider, with the setting AI reading your files in Setup, Company. It is off for every company until an owner or an admin of that company turns it on, and you can leave it off and still use the product: a file Overbill cannot read with its own code is then kept, and you are asked about it. Nothing is sent while it is off. When it is on and Overbill meets a file it cannot read, that file is shown to Anthropic's Claude, which drafts how to read it, never the amounts, and a person confirms before anything is used. Your documents are never used to train anyone's model.

8How long we keep things

• Enquiry emails: until you ask us to delete them, or two years, whichever is sooner.
• A free month that does not lead to a subscription: 90 days after the report is sent, or sooner on request.
• Anything we invoice, including a fee under the earlier look back terms: what supports our invoice, for as long as the law requires us to keep accounting records.
• Invoices, shipment data, the files they came from and your rate cards and contracts: kept while you subscribe, then deleted with your company. You can ask us to delete any of them sooner.
• A subscription that ends: your company is deleted 90 days after it ends, and we email you seven days before.
• Findings and audit records: as long as the documents they come from, and deleted with your company.
• Backups: the encrypted nightly backups are not edited; deleted data leaves them as those snapshots expire, within six months.

9Your rights

You can ask what we hold, ask for a copy, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, or object to it. Write to [email protected] and we will answer within 30 days, free of charge.

If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, but it is your right either way.

10If something goes wrong

If your data is affected by a security incident we tell you without undue delay and within 24 hours of becoming aware, with what we know at the time rather than waiting until we know everything. Where you are the controller, the deadline for reporting to the ICO is yours, and we give you what you need to meet it.

11Changes

If we change this policy in a way that matters, we will say so on this page and tell customers directly. Older versions are available on request.