Billi

Generated 17 Sept 2026 from the authoritative document in the Billi repository. If this page and the copy inside the app ever differ, they are both rendered from the same file — report it to hello@billi.work.

Billi Privacy Policy

Version: 2026-09-21

Effective date: 2026-09-21

Last updated: 2026-09-21

Plain-language summary (not legally binding)

1. Who this Policy covers and who is responsible

1.1 This Policy is issued by Collice Rodrigues, an individual carrying on business as a sole proprietor in India under the name "Billi" ("Billi", "we", "us"). Our contact address for all privacy matters is hello@billi.work; a postal address is provided on written request to that address and to any authority that requires it. It explains how we handle personal data in connection with the Billi service ("Service"). Terms defined in the Terms of Service have the same meaning here.

1.2 Two roles. For the personal data of the people who hold Billi accounts (Owners, Admins, Accountants) and of people who contact us, we decide why and how the data is processed: under the DPDP Act we are the Data Fiduciary. For the personal data you enter or import about your own clients, vendors, staff and customers, and the data your customers submit through your Online Store or Client Portal, you decide why it is collected and we process it on your instructions: you are the Data Fiduciary and we are your Data Processor (clause 10).

1.3 This Policy is part of the Terms of Service. Accepting the Terms includes acknowledging this Policy. Where we rely on your consent for a specific optional feature, we ask for that consent separately in the app (clauses 3.3 and 12).

2. What we collect

2.1 Account data. Name (where given), email address, company name, role, the Company Code, a one-way hash of your password (we never store the password itself), the version and time at which you accepted the Terms, your referral code, and the time of your last sign-in and of failed sign-in attempts.

2.2 Mobile number and verification data. Your mobile number in international format, the time it was verified, one-way hashes of one-time codes sent to it (never the codes themselves), and, if you turn on SMS two-factor authentication, that setting and one-way hashes of trusted-device tokens with a cosmetic device label and expiry.

2.3 Google sign-in data. If you use "Sign in with Google", the Google account identifier and the verified email address Google reports at the time of linking. We do not receive your Google password and do not access Gmail, Contacts or any other Google data through sign-in.

2.4 Business data you enter or import. Client and vendor records (including names, contact details, addresses, PAN and GSTIN where you enter them), product catalogues and images, invoices, credit notes, quotations, purchase orders, expenses and bill photos, payment records, bank or payment-account details you record for printing on invoices, budgets, reminders, notification templates, company documents you upload (for example GST or MSME certificates, stored as files in our database), and your company logo. This data belongs to you; we process it to run the Service.

2.5 Payment records from Razorpay. Subscription payments are made at Razorpay's checkout. We do not receive or store your full card number, CVV, PIN, net-banking password or UPI PIN. We store the Razorpay customer, subscription and payment identifiers, amounts, dates and status, and the payment record Razorpay sends us by webhook, which can include the payment method type and identifiers Razorpay chooses to include (for example a UPI ID, the last four digits and network of a card, a bank name, or the email and phone number given at checkout).

2.6 Backup connection data. If an Owner connects Google Drive, an encrypted refresh token that lets us upload backup files to that Drive, and the folder chosen. We request only the permission needed to create files in Drive.

2.7 Online Store and Client Portal data. Details a customer submits with an order (company name, contact person, phone, email, delivery address, city or district, state, PIN code, and the items ordered), which channel they verified (email or mobile, clause 11.3), the order's fulfilment, payment and stock history with who changed it and when, and the client-specific prices, approvals and portal links you set up.

2.8 Activity, audit and communication logs. A per-company audit log of who created, changed or deleted what and when; a log of automated messages sent on your behalf (recipient, type, sent or failed); notifications; and support tickets you raise, including any attachments.

2.9 Technical data. Your IP address is used in memory to rate-limit sign-in and public order submissions and is not stored in our database. Server logs held by our hosting provider may record IP addresses, request paths and timestamps for a limited period. The Service stores a sign-in token, a trusted-device token (if you chose to trust the device) and display preferences in your browser's local storage (clause 15).

2.10 Data we ask you not to enter. The Service is not designed for health, biometric, caste, religious, sexual-orientation or similar sensitive data, or for data about children beyond an ordinary business contact. Please do not enter such data into free-text fields. If you do, it is processed as business data under clause 10 on your responsibility.

3. Why we use data and on what basis

3.1 To provide the Service: creating and securing accounts; verifying your mobile number; sending one-time codes; running invoicing, reporting, reminders, backups and imports; recording orders from your store; notifying you of activity; and providing support.

3.2 To run our business: processing and reconciling subscription payments; enforcing trial, plan and seat limits; preventing fraud, abuse and unauthorised access; investigating security incidents; keeping records required by tax, company and other law; and defending legal claims.

3.3 Optional features that we enable only with your action or consent: connecting Google Drive; turning on SMS two-factor authentication; trusting a device; using an AI feature (clause 12); receiving optional product or referral communications. Today Billi sends transactional email only — sign-in and reset links, notifications, and documents you send. If we ever start sending product or marketing email, we will ask for your consent first and every such message will carry an unsubscribe link.

3.4 Legal basis. Under the DPDP Act we process personal data of account holders for the purposes above on the basis of consent given when the account is created and the Terms are accepted, and, where the Act permits, for certain legitimate uses such as providing a service you have asked for, complying with law, and responding to a medical or security emergency. Where consent is the basis, you may withdraw it (clause 9), after which we will stop the processing that depended on it, which may mean closing the account.

3.5 We do not sell personal data, do not share it with advertisers, and do not use business data to train machine-learning or AI models. The app contains dormant advertising placeholders that are switched off; if we ever enable advertising we will update this Policy under clause 17 and will not target advertising using your business data.

4. Who we share data with

4.1 Service providers (processors). We share data only with providers that help us run the Service, each under contract or published terms that restrict them to processing on our behalf:

4.2 Platform administrators. Our own staff use an administration console to manage subscriber accounts (for example disabling, deleting, recovering or adjusting limits, and answering support tickets). Each administrator has an individual login with a second factor, and administrative actions are logged.

4.3 Legal and safety disclosures. We may disclose data where required by law, court order or a lawful direction of a government authority; to establish or defend legal claims; or to protect the security of the Service or the safety of any person. Where the law allows, we will tell you first.

4.4 Business transfer. If our business or the Service is sold or merged, data may be transferred to the successor on the same terms as this Policy, and you will be notified.

4.5 Your own recipients. When you email an invoice, reminder or confirmation through the Service, the content goes to the recipient you chose. WhatsApp sharing works by opening WhatsApp on your own device with a pre-filled message; our servers do not send anything to WhatsApp or Meta.

5. Where data is stored and cross-border transfers

5.1 The application servers and the database are located in Singapore, which is outside India. The DPDP Act permits this (see clause 5.2). If we move them to a different region we will update this Policy before the move.

5.2 Some providers listed in clause 4.1 (Google, Twilio, Resend, Anthropic) process data on infrastructure outside India, principally in the United States. The DPDP Act permits transfer of personal data outside India except to countries the Central Government restricts by notification; we will not transfer personal data to any restricted country.

6. Security

6.1 Measures. We use encrypted connections (HTTPS) between your browser and our servers; one-way hashing (bcrypt) for passwords; one-way hashing for one-time codes, password-reset tokens and trusted-device tokens; field-level encryption in the database for clients' and vendors' PAN and GSTIN and for bank account numbers you record; encryption of stored Google Drive refresh tokens; integrity signing of backup files so that a tampered file is refused on restore; temporary lockout after five failed sign-ins; optional SMS two-factor authentication; sign-in sessions that expire after seven days and can be revoked; role-based access controls enforced on our servers; security headers; and individual, second-factor-protected administrator logins with audit logging.

6.2 What encryption at rest does and does not mean. Field-level encryption protects specific values from someone who obtains a copy of the database without our application's key. It does not mean we cannot read your data: as operator we hold the key and have technical access to all data in order to run the Service. The Service does not offer end-to-end encryption.

6.3 Your part. Keep passwords and Company Codes private, turn on two-factor authentication, remove team members who leave, treat Client Portal links as confidential, and secure any device or account that holds a backup.

6.4 Backups you make. A backup downloaded to your device is protected by a password only if you set one; we never store that password and cannot recover it. A backup uploaded to Google Drive is not encrypted by Billi and can be read by anyone with access to that Drive; the Owner must acknowledge this before connecting Drive. Once a backup leaves our systems its security is your responsibility.

6.5 No system is perfectly secure. We cannot guarantee that unauthorised access will never occur, but we will act as described in clause 14 if it does.

7. How long we keep data

7.1 Account and business data: for as long as the Company is active or in read-only mode. After a Subscription lapses we keep data so that you can export it or resubscribe; we may delete it after notice if the account stays inactive for more than 12 consecutive months (Terms clause 11.2).

7.2 Deleted Companies: when a Company is deleted it enters a recoverable state in which nothing is physically removed. Permanent deletion follows only after future billing is confirmed stopped and removes business records, documents, images, audit logs, notifications, support tickets, memberships and, where a login belongs to no other Company, the login itself. Permanent deletion is irreversible.

7.3 Recycle bin: records you delete in the app are permanently removed after the period set in your Company settings (30 days by default).

7.4 One-time codes (including Online Store customer verification codes): kept until used, expired or replaced. Trusted-device records: 30 days from creation, or until revoked. Password-reset tokens: one hour.

7.5 Payment and subscription records: kept for 8 years after the end of the financial year in which the transaction falls, which is the longest period Indian tax and accounting law requires of us.

7.6 Server logs held by our hosting provider: retained by Render under its own terms, currently for a short rolling window measured in days, and not copied into our database.

7.7 Copies you hold: backups on your device or Google Drive, exported files and emailed documents are outside our control and are not deleted by any action we take.

8. Children

The Service is for businesses and their adult representatives. We do not knowingly create accounts for, or collect personal data of, anyone under 18. If you believe a child's data has been provided to us in a personal capacity, contact the Grievance Officer and we will delete it. Do not enter data about children into the Service beyond an ordinary adult business contact.

9. Your rights and how to exercise them

9.1 Subject to the DPDP Act and other applicable law, as a Data Principal you have the right to: (a) obtain a summary of the personal data we hold about you and how it has been processed and shared; (b) have inaccurate or incomplete personal data corrected or updated; (c) have your personal data erased where it is no longer necessary for the purpose for which it was collected or you withdraw consent, unless we must keep it under law; (d) withdraw consent to any processing based on consent; (e) nominate a person to exercise these rights if you die or are incapacitated; and (f) an accessible way to raise a grievance (clause 16).

9.2 Much of this you can do yourself in the app: update profile and company details, change your mobile number, disconnect Google Drive, turn off two-factor authentication, revoke trusted devices, and export your data. For anything else, email the Grievance Officer from the email address registered on the account. We will verify that the request comes from the account holder before acting.

9.3 We will respond within 30 days and will tell you if a request cannot be met in full and why. Deleting an Owner's personal data may require closing the Company; we will explain the consequences before proceeding.

9.4 If you are not satisfied with our response you may complain to the Data Protection Board of India in the manner the DPDP Act provides.

10. Data about your clients, vendors, staff and customers

10.1 For this data you are the Data Fiduciary and we are your Data Processor. You are responsible for having a lawful basis (for example, the data is needed to perform a contract with that person or to comply with tax law), for giving those people any notice the law requires, and for responding to their requests.

10.2 As your processor we will: process this data only to provide the Service and on your instructions given through the Service and the Terms; apply the security measures in clause 6; use only the sub-processors listed in clause 4.1 and update this Policy before adding one; assist you, using the export, correction and deletion tools in the Service, to respond to a request from one of those people; tell you without undue delay of a personal-data breach affecting this data; and delete or return the data at the end of the relationship as described in clause 7.

10.3 If one of your clients or customers contacts us directly about data you hold in the Service, we will refer them to you unless the law requires us to act.

11. Online Store and Client Portal

11.1 Online Store pages are public. A customer who places an order submits the details listed in clause 2.7 directly into your account. The order is recorded with its fulfilment, payment and stock status, you are notified, and where email is configured an order confirmation is emailed to the customer using the email address they gave, using a template you can customise. No payment is collected through the Service.

11.2 The Client Portal is a private link for a client you have approved. Anyone holding the link can see that client's prices and place orders; we treat possession of the link as authorisation. Regenerate a link if it has been shared beyond the intended client.

11.3 Customer verification on the Online Store. By default, a customer must confirm the email address or mobile number they give before an order is accepted: we send a six-digit one-time code to that address or number and accept the order only when the correct code is entered. We store a one-way hash of the code (never the code itself), the number of attempts, the time it was sent, its expiry and a one-way hash of the visitor's IP address, for rate limiting. When the confirmed address or number matches a customer already recorded in your account, that customer's name, company name, phone, email and delivery address are shown back to them to save re-typing, and the order is linked to that existing customer record; nothing is shown before the code is confirmed, and the page does not reveal whether an address or number is already known to you. You can switch this verification off for your store, in which case we apply rate limits only and do not verify the visitor's identity; orders accepted that way are marked as unverified in your account. The Client Portal does not verify identity beyond possession of the link.

11.4 You must give your own customers a privacy notice that covers what you collect through your store, and you must honour their requests. This Policy is our notice to you, not a notice to your customers.

12. Optional AI processing

12.1 What exists today. Where the operator of your Billi deployment has enabled it, the expense screen offers "Read bill with AI". When you upload a bill photo and click that button, our server sends the image and a fixed extraction instruction to Anthropic, PBC's API and receives suggested field values, which are shown to you for review and are saved only if you save the expense. Nothing is sent unless you click the button. We do not send any other part of your records with the image. The bill image itself is stored in your account whether or not you use the feature. Anthropic processes the image under its own API terms and privacy policy, which we do not control. We rely on the commercial terms Anthropic publishes for its API, which at the date of this Policy state that API inputs and outputs are not used to train its models and are retained only for a limited period for safety and abuse-detection purposes. Those are Anthropic's terms, not ours, and Anthropic may change them; the current version is published at anthropic.com. If you would rather nothing left your account, do not use the button — every other part of Billi works without it.

12.2 Future features. We may add further optional AI features, for example to suggest column mappings during an import or to flag likely duplicates. These may run through a provider account we hold, or through an account and API key that you connect (for example with OpenAI, Anthropic or another provider) so that your data is sent under your own agreement with that provider.

12.3 Consent first. Before any new AI feature sends your data to a provider for the first time, we will show a specific consent notice in the app naming the provider, describing what data is sent and for what purpose, stating whether the provider may retain or train on the data under its terms, and explaining how to turn the feature off. We will not send data until you accept, we will record your acceptance, and you may withdraw it at any time in Settings, after which the feature stops sending data. Declining does not affect the rest of the Service.

12.4 What you accept, and what we still do. By using an AI feature you accept that the data you submit is processed by a third party outside our direct control, possibly outside India, and that AI output may be wrong and is for your review. That acceptance does not remove our responsibilities: we will send only the data needed for the task; use encrypted connections; keep provider credentials we hold secret; limit the feature to signed-in users of your Company under the Service's role rules; not use your data to train models ourselves; prefer provider terms that prohibit training on your data where available; name every provider here; and maintain written terms with any provider whose account we hold. Where you connect your own provider account, the provider's terms, charges and data handling are between you and that provider, and we will use your key only for the feature you enabled.

13. Cookies and local storage

The Service does not use advertising or analytics cookies or third-party trackers. It stores in your browser's local storage: your sign-in token (removed when you sign out or when it expires after seven days), a trusted-device token if you chose "trust this device" (30 days), and display preferences such as compact view and install-prompt choices. Razorpay's checkout page and Google's sign-in and Drive consent pages set their own cookies under their own policies. If we add analytics in future we will update this Policy and, where required, ask for consent.

14. Personal-data breaches

If we become aware of a breach of security that leads to the unauthorised access, disclosure, alteration or loss of personal data, we will take reasonable steps to contain and investigate it, notify affected account holders without undue delay with the information the law requires, and notify the Data Protection Board of India in the form and time the DPDP Act and its rules require. Where the breach concerns data you hold as Data Fiduciary (clause 10), we will notify you so that you can meet your own obligations.

15. Changes to this Policy

Material changes are published as a new version with a new version identifier and, like the Terms of Service, must be accepted before continued use of the Service. Non-material corrections may be made without a new version. The current version is always available in the app and at /privacy.

16. Grievance Officer and contact

In accordance with the DPDP Act and the Information Technology Act 2000 and rules under it, our Grievance Officer is:

Name: Collice Rodrigues

Designation: Proprietor (Billi is operated by one person, who is also its Grievance Officer)

Email: hello@billi.work

Postal address: provided on written request to hello@billi.work, and to any authority that requires it

We aim to acknowledge grievances within 2 working days and resolve them within 30 days. For general privacy questions write to hello@billi.work.