In short:we collect what we need to run your billing, we never sell your data or show you ads, we name every company that handles it, and you can export or delete it at any time.
1. Who we are
BillZ is operated by[REGISTERED LEGAL NAME, exactly as on PAN/GST]("we", "us"),[registered address], Hosur, Tamil Nadu[PIN], India. GSTIN[GSTIN]. For your account data we are the Data Fiduciary under the DPDP Act and the body corporate under the IT Act.
2. Who this policy covers
- Account holders and their staff:people who sign up for or log in to BillZ.
- Website visitors: people who browse BillZ pages or contact us.
- Your customers and vendors:when you enter their names, GSTINs, phone numbers or addresses on invoices, you decide why and how that data is used. We process it only on your behalf and on your instructions, as set out in ourTerms & Conditions(Data processing).
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email, phone, role. Passwords are handled by Firebase Authentication; we never see or store them in plain text. | You |
| Business profile | Business name, GSTIN, PAN, address, state, UPI ID, bank details you choose to print, logo, signature. | You |
| Business records | Invoices, estimates, items, stock, customers, vendors, expenses, payments, uploaded bills. | You and your staff |
| Subscription payments | Plan, amount, Razorpay payment and subscription IDs, status, payment method type. We do not receive full card numbers, CVV or UPI PINs. | Razorpay |
| Technical | IP address, browser and device type, log-in times, error logs, essential cookies. | Automatically |
| Support | Emails, WhatsApp messages and call notes when you contact us. | You |
4. Why we use it
We use personal data only for these purposes, on the basis of your consent or for the legitimate uses the law allows:
- To create your account and provide BillZ: invoices, GST calculation, reports, stock and staff access.
- To run AI features when you choose to use them (section 5).
- To take subscription payments, issue GST invoices for them and send renewal notices.
- To keep BillZ secure, prevent fraud and misuse, and fix errors.
- To answer support requests and send essential service emails.
- To meet legal duties, such as tax record-keeping and lawful requests from authorities.
We never sell personal data, never use your business records for advertising, and never share them with other BillZ users.We send product news only if you opt in, and every such email has an unsubscribe link.
5. AI features
When you use AI invoice creation, bill photo/PDF reading, business insights or payment reminders, the text or file you submit and the minimum business data needed to answer are sent to our AI provider, OpenAI, L.L.C. (USA), through its API. Under OpenAI's API terms this data is not used to train its models and may be kept for up to 30 days for abuse monitoring, then deleted. AI output can be wrong, so always review it before saving. You can use BillZ without any AI feature.
6. Service providers we use
These companies process data for us under contract, only to provide their service:
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud / Firebase | Sign-in, app hosting, file storage (logos, signatures, uploaded bills) | Singapore (asia-southeast1) |
| Neon | Managed PostgreSQL database for business records | Singapore (ap-southeast-1) |
| OpenAI | AI features, only when you use them | USA |
| Razorpay | Subscription payments and auto-renewal mandates | India |
| [Email / WhatsApp provider] | Service emails, renewal notices | [Location] |
We may also share data where the law requires it, or with a buyer if BillZ is sold, in which case this policy continues to apply.
7. Where your data is stored
Your data is stored on servers in Singapore and, for AI requests only, processed in the USA. Indian law allows these transfers unless the Government restricts a country; we will follow any such restriction. Our providers are bound to protect your data to at least the standard in this policy.
8. How long we keep it
- Active accounts: for as long as your account is open.
- After you close your account:you have[30]days to export your data, after which we delete it from live systems within[90]days and from backups on their normal cycle.
- Our own records:invoices for your BillZ subscription are kept for[8]years as tax law requires.
- Security logs: at least one year, as the DPDP Rules require.
GST law requiresyouto keep your business records for at least 72 months. Please export them before closing your account.
9. Security and data breaches
We protect data with HTTPS/TLS in transit, encryption at rest at our hosting providers, role-based access, least-privilege staff access, audit logs and regular backups. Secrets and keys are kept in Google Cloud Secret Manager, never in code.
If a personal data breach affects you, we will tell you without delay: what happened, the likely impact, what we're doing and what you can do. We will also report it to CERT-In within 6 hours and to the Data Protection Board of India as the law requires.
10. Your rights
- Get a summary of the personal data we hold about you and who we've shared it with.
- Correct, complete or update it. Most of this you can do yourself in Settings.
- Ask us to erase it, unless the law requires us to keep it.
- Withdraw consent at any time, as easily as you gave it. This doesn't affect anything done before.
- Nominate someone to exercise these rights if you die or become unable to.
- Complain to our Grievance Officer, and then to the Data Protection Board of India.
Email[privacy@domain]from your registered email. We reply within[30]days, and always within the 90 days the law allows.
11. Cookies
We use only the cookies and local storage needed to keep you signed in and secure.[If you add analytics, list the tool here and ask for consent first.]
12. Children
BillZ is a business tool for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, contact us and we'll delete it.
13. Grievance Officer
We acknowledge every complaint within 48 hours and resolve it within one month. If you're not satisfied, you can approach the Data Protection Board of India.
14. Changes to this policy
If we make a material change, we'll email you and show a notice in BillZ at least[15]days before it takes effect. The version and date at the top always show the current policy.