Privacy Policy

1. Who we are and how to read this policy

This policy covers the FreeMe.bg website (the “Site”) and the app.freeme.bg application (the “App”) through which we provide the accounting service. It has two main parts: Part A - the Site and Part B - the App; the affiliate program is covered in Part C. The common sections after them - retention, rights, transfers, data protection officer - apply to both.

The controller of personal data for the Site and for your account in the App is “FreeMe” OOD (FreeMe.bg), company ID (EIK) 123432567, Sofia, Sofia Business Park 9, email: [email protected]. For the personal data of third parties that you enter in the App for your company, we are the processor and you are the controller (see Roles and responsibilities).

We do not sell your data and do not share it with third parties for their marketing.

Part A - The FreeMe.bg website

What happens when you browse the Site or write to us through it.

2. Contact form

If you write to us through the form on the Contact page, we process the name, email and message you enter in order to reply to you. The Site does not store the message in a database: the form sends it as an email to our team ([email protected]) through SendGrid. To avoid sending the same message twice and to protect against spam, the server keeps your IP address and email in memory for about an hour; this record is not stored permanently.

The bases are your request before entering into a contract (art. 6(1)(b) GDPR) and our legitimate interest in replying and protecting the form from abuse (art. 6(1)(f)). We do not use form data for advertising or marketing lists. How long we keep the mail we receive - see the retention periods.

3. Cookies, Google Analytics and consent

Without asking for consent, the Site sets only two cookies, fm_ref and fm_vid, and only when you open it through an affiliate link (see below). There are no other cookies or trackers by default. Only if you explicitly consent via the cookie banner do we enable Google Analytics 4, to understand how the Site is used, and Google reCAPTCHA on the contact form (see section 4) - no request is ever sent to Google before you click “Accept”. One consent covers both. You can change your choice below at any time. The basis is your consent (art. 6(1)(a) GDPR), which you can withdraw at any time without affecting the processing before the withdrawal. Your choice is stored only in your browser.

Google Ireland Limited processes the data on our behalf; data may be transferred outside the EEA under GDPR safeguards, including standard contractual clauses. The hosting infrastructure may temporarily process technical data (such as an IP address) solely to deliver the content and protect against abuse.

The fm_ref cookie (affiliate program). When you open the Site or the App through an affiliate link (an address with a “ref” parameter and an affiliate's code), we remember the affiliate's code in the fm_ref cookie, so that the affiliate can be credited if you create a new account in the App. It is our own (first-party) cookie, for the freeme.bg domain and its subdomains, including app.freeme.bg. It holds only the affiliate's code and expires after 30 days; a newer affiliate link overwrites it. We set it without waiting for your choice in the cookie banner; it does not involve Google Analytics and is not used for advertising. The basis is our legitimate interest in crediting referrals under the affiliate program (art. 6(1)(f) GDPR). You can delete it at any time in your browser settings. What happens to the code if you create an account is described in Part C.

Visits through an affiliate link and the fm_vid cookie. Affiliate links go through aff.freeme.bg/go/…. When you open such a link, we record the visit: date and time, IP address, browser and device details (user agent), the page you came from (referrer), your browser language and the country derived from the IP address. The visit gets a random identifier, which we keep in the fm_vid cookie (same domain and lifetime as fm_ref), so that we can tell repeat visits apart and, if you create an account, trace which visit it came from. We use this data to count visits under the affiliate program and to detect abuse (such as artificially generated clicks). The affiliate sees only the number of visits, never your IP address or any other data about you. The basis is our legitimate interest (art. 6(1)(f) GDPR).

Change your cookie choice

4. Google reCAPTCHA

The Contact page loads Google reCAPTCHA v3 (Google Ireland Limited / Google LLC) to tell humans from automated programs. Google receives your IP address, browser and device data and your behaviour on the page in order to score the request; the score is checked by our server. The service is loaded only on that page and only after your consent via the cookie banner (or the “Allow and send” button under the form). The basis is your consent (art. 6(1)(a) GDPR), which you can withdraw at any time. If you do not consent, you can write to us directly at [email protected].

5. Cloudflare and hosting

The Site sits behind the Cloudflare network (DNS, abuse protection) and is hosted on a server at Amazon Web Services, with content delivered through CloudFront. With every request these providers and our server receive technical data - IP address, browser, requested page URL - that is needed to show you the page and protect the Site. The basis is our legitimate interest in a secure and working service (art. 6(1)(f) GDPR). We do not use this data for profiling.

6. Providers related to the Site

These providers process data in connection with the Site:

Part B - The app.freeme.bg application

What happens when you have an account and use FreeMe.bg.

7. Roles and responsibilities

• We are the controller of your account data - profile and sign-in, settings, the records of acceptance of the terms, security and support data. The bases are performance of the service contract (art. 6(1)(b) GDPR), compliance with legal obligations (point (c)) and our legitimate interest in the security of the App (point (f)).
• We are the processor of your company’s data - the personal data of your employees, owners, customers, suppliers and other individuals that you enter or upload. You are the controller, and we process it on your instruction under the Data Processing Agreement, which is part of the Terms and Conditions. If you want to exercise rights over such data, contact the company that entered it; we will forward any requests we receive to it.

8. What we process and why

What we process depends on how you use FreeMe.bg:

• Account and login in the App: your email address and, if you sign in with Google, your name and photo from your Google account (sign-in with Google or an emailed code, no passwords).
• Company and accounting data you enter or upload in the App: your company’s registration details (EIK, address), invoices, expenses, partners, bank statements and other accounting documents, and personal data of the individuals connected to them where the law requires it - for example a national ID number, tax ID, ID-document details, address and phone number of an owner, representative, employee or partner, and, if you use the Payroll module, the contract, pay, insurance and absence data of the people who work for the company.
• Messages forwarded to your company’s inbox in the service (if you set up this feature), which are read automatically to extract invoices and expenses.
• Support chat: the messages and files you send us in the chat.
• Invitations: the email addresses of the people you invite as viewers.
• Service emails (invitations, service notifications) through SendGrid. We do not send advertising or marketing messages.

The legal basis is performance of the service contract you enter into with us (art. 6(1)(b) GDPR) and compliance with a legal obligation to keep accounting and tax records (point (c)).

9. Artificial intelligence

• What it does. Artificial intelligence reads uploaded documents and bank statements, suggests bookings, helps search your documents and answers questions in the FreeMe AI assistant.
• Providers and purpose. Google (Gemini) - recognition and extraction of data from documents and the FreeMe AI assistant; Anthropic - reading statements and tables, matching bank transactions and proposing bookings; OpenAI - semantic search over your documents and our help materials; Cohere - re-ranking of search results. The location and transfer basis of each are in the providers table.
• No training. Your data is not used to train models, neither by us nor by the providers we use on our behalf.
• Human review. An accountant reviews all incoming documents and their correct booking, and the monthly VAT returns are checked and signed by an accountant before they are filed. Artificial intelligence never files anything with the authorities.
• Log. Every call to a model is recorded in an audit log; the periods are in the table.

10. Providers related to the App

We use the following providers as processors on our behalf (the same list as in the Data Processing Agreement):

Card payment through Stripe is not live yet. When we launch it, Stripe will be added to the list; your card details are handled directly by Stripe and never pass through our systems.

If we become aware of unauthorized access to personal data in your account, we will notify you without undue delay and give you information about what happened and the steps taken.

Part C - The affiliate program (aff.freeme.bg)

What happens when you take part in the FreeMe.bg affiliate program through the aff.freeme.bg portal, or when you create an account through an affiliate link. The program rules are in the Affiliate program terms.

Affiliates' data

• Sign-in: the email, name and photo of the Google account you use to sign in to the portal.
• Profile: your full name, phone number, whether you take part as an individual or a company and, for a company, its name, company ID (EIK) and VAT number; optionally a short note on how you plan to promote FreeMe.bg.
• Payouts: IBAN and account holder, and the commissions earned and paid.
• Acceptance of the terms: which version of the terms you accepted and when.

We process this data to run the program: to give you a personal link, track referrals, and calculate and pay commissions. The basis is the contract for taking part in the program (art. 6(1)(b) GDPR) and, for the records of amounts paid, also the legal obligation to keep accounting records (point (c)). The data is stored on the same infrastructure as the App's data (Amazon Web Services, Ireland region, EU). Retention is set out in section 11.

Referred customers' data

If you create a new account in the App while the fm_ref cookie is in your browser (see section 3), we record the affiliate's code against your account (together with the visit identifier from the fm_vid cookie, if there is one) and the companies you add, so that we can calculate the affiliate's commission when a company pays for the first time. The basis is our legitimate interest in running the affiliate program (art. 6(1)(f) GDPR).

Your identity is not shared with the affiliate: in the portal they see only the number of visits, registrations and paying companies, the dates, the plans and their commission amounts, with no names, emails or company names. The link between your account and the affiliate is visible only to the FreeMe.bg staff who calculate and check commissions.

11. How long we keep the data

Retention periods by category:

An erasure request is carried out to the extent it does not conflict with the statutory retention obligation - we may refuse or defer deleting accounting records while the legal period runs, but we delete everything not subject to it (e.g. contact-form data).

12. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object, as well as the right to withdraw your consent at any time (for cookies, with the button in section 3) - or by writing to [email protected]. We reply within one month. The right to erasure may be limited where we have a legal obligation to retain accounting data (see the retention periods).

You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP): Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., cpdp.bg.

13. Transfers outside the EEA

Data in the App is stored on Amazon Web Services infrastructure in the Ireland (EU) region. Some providers (in particular for artificial intelligence, email and network protection) may process data outside the EEA, mostly in the US. This happens only under GDPR safeguards - standard contractual clauses (SCC) and/or the EU–US Data Privacy Framework where the provider is certified; the basis for each provider is in the tables above.

14. Data protection officer

For any question about your personal data and to exercise your rights, write to [email protected].

15. Changes to this policy

When changes occur, the current version is published on this page with its number and effective date.

The Bulgarian version of this document is legally binding.