1. Provider and contact
Biro is provided by SP10 DOO NOVI SAD, Stanka Paunovića 10, 21000 Novi Sad, Serbia, company number 21075027, tax ID 108825672. Contact [email protected] for privacy, support and requests. This policy covers Biro accounts, business features, communications and AI processing.
2. Roles and applicable rules
SP10 is a controller for account administration, support, billing and security of its service. Where an agency contracts Biro to serve its client, the agency is a controller or processor according to that client relationship, and SP10 is its processor or subprocessor. Where a client contracts Biro directly, SP10 processes that client's business records as processor. Serbian personal data protection law applies; the GDPR applies when its territorial and material conditions are met. This policy alone is not a certification of full compliance.
3. Data and sources
We process names, email addresses, account information, organizations, roles and permissions; business and contact information; submitted documents, invoices, bank statements, tax, legal, employment and other records for enabled services; messages, attachments, AI suggestions and professional decisions; and login, IP address, device, error and audit information. Sources include users, their companies or agencies, authorized collaborators, connected services such as SEF and email, and registers used for a particular task. Documents may contain data about employees, representatives, partners and other individuals. Do not submit unnecessary sensitive information.
4. Purposes and legal bases
We use data to provide contracted services, manage access and offer support. Contract performance or pre-contractual steps apply where the individual is a contracting party; employee business contacts and security rely on legitimate interests subject to a balancing assessment. Statutory records are processed to meet legal obligations. Optional processing requiring consent has a separate choice. For client records, the controller determines the legal basis and issues lawful instructions; a company's AI authorization does not replace a legal basis for each individual's data. Account and authorization data are needed for access; a task may be unavailable without the necessary documents.
5. AI processing and decisions
Biro supports Anthropic, OpenAI and Google Gemini; code support does not mean all providers are used. The active route, permitted recipient and required authorizations determine a particular operation. Depending on the feature, a provider may receive minimized/redacted text, business context or an authorized document. Redaction does not guarantee anonymization. AI outputs may be wrong. Posting and other supported automation use business controls and permissions; legal advice, business decisions and required signatures remain with responsible people. Request human review and challenge results through your agency or support.
6. Recipients and international transfers
Access is limited to authorized users within their assigned scope and engaged infrastructure, storage, backup, email and enabled AI providers. Data may be disclosed to competent authorities where required by law. The application and database run on the Hetzner server in Nuremberg, Germany. Cloudflare R2 stores active documents and backups in the EEUR region. Active AI recipients are Anthropic and OpenAI, and Resend transmits service emails. Google Gemini is supported but is not enabled. The Hetzner DPA was concluded on 4 August 2026. The Cloudflare, Resend, Anthropic and OpenAI DPA terms include the applicable Standard Contractual Clauses for restricted transfers. Cloudflare, Resend and active AI providers have recipients in the US and other countries as described in their DPAs and subprocessor lists. EEUR is not a contractual guarantee that all processing occurs exclusively in the EU. You can request a copy of applicable safeguards at [email protected]. We do not claim that all data remains in Serbia/the EU, that zero retention applies or that every provider prohibits training. Before enabling a new recipient, its processing agreement, subprocessors and lawful international transfer basis must be verified, including GDPR standard contractual clauses and supplementary measures where applicable.
7. Retention and security
Accounts and business records are retained for the necessary business relationship, then according to controller instructions, legal duties and justified protection of legal claims. Closing an account does not automatically erase statutory archives. A 30-day data retrieval window applies after contract termination; active data without a basis for further retention is deleted by day 60 after termination. Statutory records are retained according to their category and applicable law, with restricted access. Where the retention duty belongs to the client, handover and further custody follow its documented instructions; SP10 is not presumed required to retain every copy. Private chat attachments have a 24-hour access period; physical removal depends on scheduled cleanup. Backup snapshots use a rolling 60-day cycle; after removal from active systems, residual data may remain in isolated backups for up to 60 further days. Backups are for recovery; erasure decisions are reapplied before restored data returns to ordinary use. Conversations, logs and audit records are retained while needed for the contracted service, security, action evidence or legal claims, then deleted or anonymized when the purpose ends and no retention duty remains. Controls include company/role access restrictions, authentication, event records and production transport protection; no system is absolutely secure.
8. Your rights and contact
Email [email protected] to request information, access and a copy, rectification, erasure, restriction, applicable portability, an objection to legitimate-interest processing or withdrawal of consent for future processing. Rights depend on the legal basis and statutory exceptions; erasure does not include others' data or mandatory records without review. We verify identity proportionately and do not routinely request ID copies. Where we are a processor, we refer requests to the controller and assist it. We respond within the statutory period (30 days under Serbian law; one month under the GDPR), with a reasoned extension where permitted. You may complain to the Serbian Commissioner (poverenik.rs), or the competent EU supervisory authority where the GDPR applies, without contacting us first.
9. Connecting a Google / Gmail mailbox
Connecting a mailbox is optional and initiated by an authorized user. Biro requests gmail.readonly access: this permission can cover the entire mailbox, while date, sender, subject and Gmail label selections limit processing in Biro. We read the connected account address, labels, message identifiers and headers (sender, subject, date), message structure and selected PDF/XML attachments to find business documents, check their company association and import them. Biro does not send or delete Gmail messages or change their read status. OAuth tokens are stored encrypted; import records contain message details, outcomes and attachment details, and accepted documents enter the company's private archive. You can pause imports or disconnect under Company settings → Connected mailboxes. Disconnecting removes stored access tokens and stops new imports; you can also revoke access at https://myaccount.google.com/connections. Disconnecting does not delete previously imported documents or records: section 7 retention rules apply. Send deletion requests to [email protected].
10. Google data and Limited Use
Use of data received through Google APIs and transfers to other applications are subject to the Google API Services User Data Policy, including its Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy) Biro's use of raw or derived user data received from Workspace APIs adheres to the Google User Data Policy, including the Limited Use requirements. For Google data and data derived from it, these narrower rules take precedence over this policy's general processing descriptions. We use it for visible user-facing business document import, archiving and processing features. We do not sell it or use it for advertising, creditworthiness assessment or training general-purpose AI/ML models. Connecting Gmail is not, by itself, consent to AI transfers. An allowed AI transfer for a specific user-facing feature requires separate authorization and a recipient whose terms exclude training general-purpose models on that data. Sharing is limited to providers needed for authorized features with user consent, security, legal obligations, or a business transfer with prior explicit consent. Humans may read specific data with your affirmative agreement, for security, to comply with law, or in an allowed aggregated form for internal operations.
Provider data processing terms
Privacy and support: [email protected]