Privacy
Updated 22 October 2026.
On what grounds
Running your account — reading bills, keeping the figures, reminders, the assistant — is the contract you made by signing up. Sending a photograph to AI unmasked is your consent, asked for each photograph and withdrawable at any time in the bill’s history. The security record, the limits that stop abuse and the letter about a sign-in from a new device are our legitimate interest in keeping the service safe, which we have weighed against yours and found the lighter of the two. Keeping payment records after an account is gone is a legal duty: the books must add up. Other people’s names on your bills and letters are handled because you, the account holder, have the right to keep your own bills — our legitimate interest and yours. You give an e-mail address and a password because an account cannot exist without them; everything else is up to you.
What is stored
Your email address and name, your properties, and the figures read from your bills: supplier, period, amounts, consumption and due dates. Beside them, what the account needs to work: your sessions with the device and address they came from, the notifications sent to you, a record of security-relevant actions, your subscription payments, a count of the documents taken for reading each month, a record of each AI request (which task, how many tokens, what it cost — not what was read), the names of your household remembered so that they are masked next time, and your questions to the assistant with its answers. To help you when something went wrong, an administrator can open your bill; every such look is written down. When you ask the help agent, what you wrote and what it answered is kept with your account; what is passed to a person is kept with that conversation.
Originals are not kept
The file is removed as soon as it has been read. What remains is its text with the personal details hidden, and the figures taken from it. On plans that include it, and only while you leave it switched on, a copy of the bill with the personal details covered is kept for you to download.
What the AI sees
Before any text goes to an AI provider, personal codes, bank accounts, email addresses, phone numbers and customer names are replaced with labels. Addresses, contract and meter numbers stay: they are what ties a bill to its property. The billing company’s own details stay too — a company is not a person. The provider today is Google (Gemini API), under its paid terms: it does not use what we send to train models, keeps requests for a limited time only to detect abuse, and does not promise where in the world they are processed — so this is a transfer, see below. What you type to the help agent goes to the same provider, masked the same way, together with codes and counts about your account — never anything off a bill.
Photographs
A photograph cannot be masked before it is read, so this is the one exception: it goes as it is. We ask before every photograph and record the moment of consent with the document. Photographs go only to a provider under paid terms that do not use them to train models.
Mail to your property
A message sent to your property’s address is kept whole for 7 days when a bill was read from it, and for 30 days when it was not — so you can see what arrived — and is then removed. A message waiting for something that can pass — your plan, your confirmed address, your return — waits up to 90 days.
Other people’s data
A bill names the household, not only you, and a letter forwarded to your property’s address carries its sender’s name and address. We do not write to these people to tell them: they are your family, your tenant, your supplier, and a letter from us to them would say nothing they do not know and reveal your account to them. Their data is used for nothing but reading your bill, is masked where it can be, and lives no longer than the bill or the letter it came with. If you upload a bill, you must have the right to: it must be for your household.
Who else sees it
Your data is not sold and not used for advertising. It is handled for us, and only to run the service, by: Google (AI) — masked text and, with your consent, photographs; Scaleway, France — the letters we send you, with your address; Stripe Payments Europe, Ireland — your subscription payments, which never reach us as card details and for which Stripe is a controller of its own; Cloudflare — the traffic to the site passes through it, and it stores our backups, encrypted with a key it does not have; netcup, Germany — the server. If you sign in with Google, Google learns that you signed in here; we keep only your Google account id and address. Nobody else. An administrator of the service may open a document's masked text and its copy without personal data — never the original — to check how a bill was read; every such look is recorded. Google Analytics (Google Ireland) counts visits to the public pages, and only for those who allowed it.
Where your data goes
The server is in Germany and the letters leave from France: inside the EEA. The company that runs the service is in the United Kingdom, whose protection of personal data the European Commission has recognised as adequate. Google and Cloudflare are in the United States: both are certified under the EU–US Data Privacy Framework, and our agreements with them include the EU’s standard contractual clauses as well. What reaches Cloudflare outside the EEA is traffic metadata and backups it cannot read; what reaches Google is described above. Google Analytics is the same case: Google is certified under the EU–US Data Privacy Framework, the data processing terms are accepted, and nothing of it is sent for anybody who has not allowed it.
How long it is kept
Bills and their figures — until you delete them. Sessions that ended — 30 days. Notifications — a year. The record of security-relevant actions — two years; the address typed at a failed sign-in — 90 days. The record of AI requests — a year. Your questions to the assistant — the last 200, and you can clear them. Backups — up to 90 days, encrypted. Payment records — ten years after the payment, as the books require, without your name once the account is gone. The site’s access log, with the address you came from and the page you opened — at most 30 days. A bill read on the public page without an account — 7 days, together with the guest record made for it. Your conversation with the help agent — 180 days. A question passed to a person, with its answer — a year after the last word in it. A conversation with somebody who has no account lives in memory for a day and is written down only if they ask for a person.
Cookies and tracking
Five cookies of our own: bc_session keeps you signed in (30 days); bc_device recognises your device so that we can tell you about a sign-in from a new one (a year); bc_locale remembers your language (a year, set when you choose one); bc_share remembers that you gave the password of a shared link (up to 12 hours); bc_analytics remembers whether you allowed the measurement below (six months, set when you answer). Google Analytics counts visits to the public pages — the landing, the prices, the rules, this page, the terms, help, the sign-up and sign-in pages and the one bill read without an account — and only if you allow it: it is not loaded until you do, it never runs where your bills are, and it is never given more of the address than the page itself. No advertising, no remarketing, no profiles built across other sites. Our letters carry no tracking pixels, and their links lead straight to bills.casa. The traffic passes through Cloudflare, which may set a cookie of its own to tell a browser from a bot; it identifies nobody.
Decisions made by software
Software places a bill on a property, points out an amount unlike the earlier ones, and puts a property to sleep when a plan holds fewer. None of this decides anything about you with legal or similar effect; every such step can be undone by hand.
Your rights
You can see everything we hold about you: it is in the application, and the whole account exports as one file from Settings → Security, behind your password. You can correct it — the figures in a bill, your name, your e-mail address — yourself. You can delete any bill, any property, or the account. You can withdraw your consent to reading photographs or bills, forget the names remembered for masking, stop the reminders by e-mail with one link, and object to what we do on the ground of legitimate interest. For anything you cannot do yourself, write to —; we answer within a month. You are not obliged to give us anything beyond an e-mail address and a password.
If you think we got it wrong
Write to us first — most things are put right in a day. You may also complain to the data protection authority of the country you live in: in Latvia the Datu valsts inspekcija (dvi.gov.lv), in Lithuania the Valstybinė duomenų apsaugos inspekcija (vdai.lrv.lt), in Estonia the Andmekaitse Inspektsioon (aki.ee) — or to the ICO in the United Kingdom (ico.org.uk), where the company is.
Deleting your account
A deleted account can be brought back for 30 days; after that everything in it is removed: properties, bills, documents, notifications, the remembered names. Two things stay without you: payment records, as amounts and dates without a name — the books must add up — and the security record, stripped of your address and device. Backups made before the deletion run out within 90 days.