Privacy policy

Last changed 27 October 2026 · På norsk: bilago.no/personvern

Bilago is accounting software for Norwegian sole proprietorships and limited companies. This policy explains what personal data we process, why, how long we keep it, who we share it with and what rights you have. The Norwegian version, bilago.no/personvern, applies if the two differ.

Who we are

Bilago is provided by BlackValley Software AS, Norwegian organisation number 938 576 149. Send questions about privacy to post@bilago.no.

Two roles

• We are the controller of the data about you as a Bilago user: your account, your subscription, what you send us and how the service is used.
• We are a processor of what your company keeps in Bilago: customers, suppliers, employees, shareholders, vouchers and payroll. Your company decides over that data, and we process it only to provide the service, under the data processing agreement that is part of the terms.

What we process, and why

We never sell personal data, and what you keep in your accounts is never used for advertising.

Cookies and ad measurement

Bilago.no and the app use Meta Pixel and the Google tag (Google Ads and Google Analytics) to measure which ads on Facebook, Instagram and Google lead people to try Bilago. Meta Pixel only loads if you say yes when we ask. With a yes, Meta and Google use cookies, and the legal basis is your consent (Art. 6(1)(a) and the Norwegian Electronic Communications Act § 3-15).

The Google tag also loads before you have answered, and if you say no. It then stores and reads no cookies, and only sends Google simple signals: that a page was viewed or an account created, with the time, IP address and your browser's technical details, but no cookies or advertising IDs. Google uses the signals to estimate how many people came from the ads. The legal basis is our legitimate interest in knowing whether the ads work (Art. 6(1)(f)).

We collect usage statistics with PostHog, stored in the EU. Without consent nothing is stored on your device and each visit is counted on its own. If you say yes, PostHog remembers your browser with a cookie, so we can see how Bilago is used over time.

• Meta learns which of our pages you visit and whether you create an account, start the trial or buy a subscription, along with your browser's technical details and Meta's cookies. From our server we also send your e-mail, name and user ID as hashed values (SHA-256), and your IP address, so Meta can match the event to the right ad. This only happens if you have said yes. We never send your accounts.
• Meta Platforms Ireland is a joint controller with us for the collection. What Meta does with the data is in Meta's privacy policy.
• Google learns the same: which of our pages you visit and whether you create an account or buy a subscription, along with your browser's technical details and Google's cookies. Google Analytics processes the data on our behalf as a processor. For ad measurement in Google Ads, Google Ireland is an independent controller under Google's privacy policy.
• Your answer is kept in the cookie "bilago_samtykke" for one year. You can change your mind at any time under "Informasjonskapsler" at the bottom of bilago.no, or under Innstillinger → Min konto in the app.

Shopify

When a company connects a Shopify store to Bilago, the «Bilago» app reads the store's orders to book the sales: line items, prices, VAT, shipping, discounts, payments, refunds and the shipping country. We do not read customers' names, e-mail addresses, phone numbers or addresses, only the country, which decides between Norwegian VAT and export.

• The app stores only the store's address and its access token (encrypted), not the orders.
• Bilago attaches the orders to the voucher as documentation, as Norwegian bookkeeping law requires, and keeps them with the rest of the accounts.
• When the app is uninstalled, the access token is deleted and Bilago reads nothing more. Shopify's privacy requests (customers/data_request, customers/redact, shop/redact) are answered; booked vouchers must still be kept as long as the law requires.

Who we share data with

We use these subprocessors. All have a data processing agreement with us.

Transfers to the USA rely on the EU–US Data Privacy Framework or the EU standard contractual clauses. When you ask it to, Bilago sends data to public authorities such as the Norwegian Tax Administration, the Brønnøysund Register Centre and Altinn (VAT returns, payroll reporting, annual accounts, shareholder register, beneficial owners), and to a store or bank you connect.

How long

• The accounts and their documentation are kept for five years after the end of the financial year (Norwegian Bookkeeping Act § 13).
• Your account is deleted when you ask, except what the law requires us to keep.
• Technical logs are kept briefly and deleted automatically.

Security

All traffic is encrypted (TLS). National identity numbers and access tokens for other services are also encrypted in the database. Each company is kept apart from the others, and you decide who has access to yours.

Your rights

You can ask for access, correction, deletion, restriction and data portability, and object to processing based on legitimate interest. Write to post@bilago.no and we answer within a month. If it concerns a company's accounts, we refer you to the company, which decides over them. You can take your accounts with you as SAF-T at any time.

If you believe we process data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet.

Changes

When we change this policy, we update the date at the top. We tell you of significant changes by e-mail.