Privacy policy
Billix Evo processes only the data needed to provide, secure and bill the service, in accordance with the Swiss Federal Act on Data Protection (FADP) and, where it applies, the General Data Protection Regulation (GDPR).
The entire site is backed up once a day. Data entered between two backups may be lost in an incident; we are not liable for it. Export your data regularly.
Controller
For account data (users, subscription), the controller is the operator shown at the bottom of this page. Any data protection request can be sent to the e-mail address shown.
Roles
For the data of its own customers (invoice recipients), the client company is the controller and the operator acts as processor, on instruction and solely to provide the service. For account data (users, subscription), the operator is the controller.
Data processed
Users’ identity and contact details, company data (address, IBAN, VAT), clients, invoices, payments, e-mails sent, acceptance proofs (date, IP address, browser), security and audit logs, subscription data. Card data is processed exclusively by Stripe and never seen or stored by Billix Evo.
Purposes
Authenticating users, providing invoicing functions, sending requested e-mails, securing the platform and preventing abuse, ensuring backups, managing the subscription and complying with legal obligations.
Hosting and subcontractors
Data and backups are hosted in Switzerland. Subcontractors, depending on the functions used:
• Infomaniak Network SA, Geneva (Switzerland): hosting of the site, the database and the backups;
• SMTP e-mail provider configured by the operator: sending e-mails (documents, reminders, notifications);
• Stripe (Ireland, United States): subscription payment; card data are processed by Stripe only and are never seen or stored by Billix Evo;
• Cloudflare (United States): Turnstile anti-bot protection of public forms, when enabled.
Transfers outside Switzerland rely on appropriate safeguards (standard contractual clauses, Swiss-U.S. Data Privacy Framework).
Retention periods
The entire site is backed up once a day. Data are kept for the following periods:
• company data (clients, documents, templates, files): as long as the account exists, then during the grace period after closure (14 days by default), then deleted;
• user accounts: as long as the account exists; after closure, during the grace period, then anonymised;
• daily site backups: normally 15 days, then deleted;
• security log (sign-ins): 365 days; audit log: 730 days (adjustable by the operator);
• register of closed accounts: indefinitely, limited to the account name, the dates and the requester;
• operator’s accounting records (subscription, payments): 10 years (art. 958f CO).
Invoices issued by the company must be kept by the company itself for 10 years (exports). Data entered between two backups may be lost in an incident (see the general terms, section 7).
Closing the account
Each user can close their account from “My account”, and an administrator the whole company from “Settings → Export and deletion”, after confirming their password. Access is closed immediately. An archive is kept offline during the grace period, during which the account can be restored on request; then everything is deleted (general terms, section 16).
Cookies
Billix Evo uses only strictly necessary cookies: the technical session cookie, required to sign in. No advertising trackers, no audience measurement, no third-party tracking cookies; no consent is therefore requested. An invoice’s view link records only the first and the last opening.
Security
Encrypted connections, hashed passwords, encrypted secrets, per-company access control, logging, sign-in attempt limits and daily backups. No measure guarantees absolute security.
Operator access
For support, security and legal compliance, the operator may view customer companies’ data in read-only mode through a dedicated administration account. Every view is logged (date, company, item viewed, masked IP address) in a log that cannot be changed or deleted from within the application (art. 8 nFADP: data security).
Your rights
Under the FADP (and the GDPR where it applies) you may request access to your data, their rectification or erasure, restriction of or objection to processing, and receive your data in a common format. In “My account”, “Download my data” provides your personal data at any time (JSON and CSV), and account deletion is available directly. Requests about data on an invoice must be sent to the company that issued it; other requests to the operator. You may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC, Bern, www.edoeb.admin.ch).
Portability
The company can export all its data at any time (CSV and full ZIP with JSON data, PDFs and files), including on the free plan. Each user can download their personal data.
Operator
Ikos sàrl
Champs-Colnats 7
2745 Grandval
CHE-115.804.108
admin@nexikos.ch
Hosting
Infomaniak Network SA, Geneva, Switzerland.
Last updated: 14 October 2026 (cancellation, account deletion and data protection; previous version of 10 October 2026). · Version 2026-10-14