Privacy Policy

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, password, and business name when you create an account.
• Profile Information: Business address, phone number, logo, and branding preferences.
• Client Information: Names, email addresses, and billing addresses of your clients that you add to the Service.
• Invoice Data: Details of invoices you create, including line items, amounts, payment terms, and notes.
• Payment Information: Billr does not store bank account or card details. Card data for your Billr subscription is collected and held by Stripe, our payment processor, and never touches Billr's servers; we keep only Stripe's customer and subscription identifiers, the plan status, and the billing email. If you choose to accept online payments from your own clients, you connect your own third-party payment processor and that processor handles payment data under its own privacy policy.
• Communications: Any information you provide when you contact our support team or participate in surveys.

1.2 Information Collected Automatically

When you use our Service, we automatically collect certain information, including:

• Device Information: IP address, browser type, operating system, and device identifiers.
• Usage Data: Pages visited, features used, time spent on the Service, and other usage patterns.
• Cookies and Similar Technologies: Hosted Billr counts page views automatically on its public pages and inside the signed-in application. Google Analytics and Vercel use cookies or similar identifiers for that measurement. Section 7 describes exactly what is measured and what is left out.

1.3 Information from Third Parties

We may receive information about you from third parties, including:

• Authentication Providers: Basic profile information when you sign in with Google.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Send invoices and payment reminders on your behalf
• Respond to your comments, questions, and support requests
• Send you technical notices, updates, security alerts, and administrative messages
• Communicate with you about products, services, and events offered by Billr
• Monitor and analyze trends, usage, and activities in connection with the Service
• Detect, investigate, and prevent fraudulent transactions and other illegal activities
• Personalize and improve your experience

3. How We Share Your Information

We may share your information in the following circumstances:

• With Your Clients: Invoice details and your business information are shared with clients when you send invoices.
• Service Providers: We share information with vendors, consultants, and service providers who perform services on our behalf.
• Stripe, for Subscription Billing: Stripe, Inc. processes subscription payments for the hosted service as our subprocessor. We send Stripe your billing email, your subscription details, and the country and tax information needed to charge the correct amount. You enter your card details directly with Stripe; card numbers are never received or stored by Billr. Stripe processes that data under its own privacy policy.
• Legal Requirements: We may disclose information if required by law or in response to legal process.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred.
• With Your Consent: We may share information with your consent or at your direction.

4. Data Retention

We retain your information for as long as your account is active or as needed to provide you the Service. We also retain information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. Invoice records are retained for a minimum of 7 years to comply with tax and accounting requirements.

5. Data Security

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Encryption of sensitive data at rest
• Regular security assessments and penetration testing
• Access controls and authentication requirements
• Regular backups and disaster recovery procedures

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate personal information.
• Deletion: Request deletion of your personal information, subject to certain exceptions.
• Portability: Request a copy of your data in a portable format.
• Opt-Out: Opt out of marketing communications at any time.

To exercise these rights, please contact us at help@billr.cc. We may need to verify your identity before processing your request.

7. Cookies and Tracking

Hosted Billr measures page views automatically; there is no analytics acceptance prompt. The integrations are Google Analytics 4 and Vercel's anonymous page-view counts, and they cover the public site (home, features, pricing, blog, documentation, guides, support and legal pages) and the signed-in application.

What analytics receives, and what it does not:

• Sent: the page location reduced to the site origin plus a fixed path, where public pages report their own path and application pages report a static template such as /invoices/[id]; the referring Billr page template when there is one; on a public page opened from a campaign link, its standard campaign tags (utm_source, utm_medium, utm_campaign, utm_term and utm_content) when they are short plain labels; to Google Analytics, the name of a well-known public referring site such as a search engine or social network, reduced to the site itself with no page address; an external referring URL supplied by your browser to Vercel; a cookie or similar identifier that distinguishes visits; and standard technical details such as browser, device type and approximate region derived from the network address.
• Not sent: record identifiers, client names, invoice, estimate, payment, task or expense values, note or message contents, your account identity, any other query or fragment from Billr page URLs, campaign tags on application pages, and page titles from inside the application. Shared invoice and estimate documents, the sign-in and sign-up flows, the terms acceptance step, and API routes are never measured.
• Ads features: disabled. Advertising storage, ad user data and ad personalization are denied, Google signals are off, and IP addresses are not used for advertising.
• Controls: your browser can block or clear these cookies, and the measurement cookies are not required for the Service to work. The Terms agreement accepted when the account is created is a separate acknowledgement; it is not what enables this measurement.

Billr's own page-view counts: on the public pages listed above (never the signed-in application, sign-in and sign-up, shared documents or API routes), Billr also counts page views itself and keeps them in its own database. No cookie or browser storage is used for this, and it is never linked to your account.

• Stored per view: the time, the page path, the name of the referring site (no page address), the utm_source, utm_medium and utm_campaign tags when they are short plain labels, your country, and the device type (desktop, mobile or tablet).
• Visitor and visit codes: a visitor code is a one-way hash of your network address and browser identification string, salted with a secret that changes every day, so the same visitor cannot be linked from one day to the next. A visit code groups views within 30 minutes. Your network address and browser identification string are used only to compute the code and are not stored. Traffic recognised as automated is discarded.
• Retention: each view is deleted automatically after 400 days.
• Opting out: if your browser sends Global Privacy Control, nothing is recorded. Blocking JavaScript for billr.cc also prevents it.

Essential cookies and local storage entries that keep you signed in or remember interface preferences are separate from analytics.

When you create an account we store how you first reached Billr in that visit (the page you landed on, the referring site, and any campaign tags in the link) to understand which channels bring customers.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. When we transfer data internationally, we implement appropriate safeguards to protect your information.

9. Children's Privacy

The Service is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete such information.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

11. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

• Voyage Studios LLC, doing business as Billr
• Email: help@billr.cc

12. California Privacy Rights

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete personal information, and the right to opt-out of the sale of personal information. We do not sell personal information. To exercise your California privacy rights, contact us at help@billr.cc.

13. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the right to access, rectify, port, and erase your data, as well as the right to restrict and object to certain processing of your data. Our legal basis for processing your information includes performance of a contract, legitimate interests, and your consent where applicable.