Privacy Policy

When you create an account: your email address and (optionally) your name and phone number. When you use the app: the invoices, clients, products, services, payments, templates, and settings you create. We don't collect anything we don't need.

Your data lives in Supabase (Postgres), hosted in Tokyo, Japan, encrypted at rest and in transit. We use row-level security so your data is logically isolated from other users at the database level — not just at the application level. The Inbill server never has plain-text access to your password; Supabase Auth handles credential storage.

We use browser localStorage for: your currency preference, autosave drafts of in-progress invoices, assistant voice settings, and one-time onboarding flags. They are cleared when you sign out. If you arrive from one of our links (for example a social post tagged utm_source) or from another website, we keep which link or site it was, and save it on your account when you sign up, so we know which posts bring people in. It is never shared with anyone. We use cookies only for the authentication session managed by Supabase. We don't run any third-party analytics or tracking pixels. Crash reports are described below.

• Supabase — primary database and auth provider.
• Resend — when you choose to email an invoice from inside the app, we pass the recipient address and rendered email content to Resend so they can deliver it.
• Paddle — our merchant of record for Pro. Paddle collects your name, email, country and payment details directly and handles tax and receipts; we only receive your subscription status and the email you paid with.
• Google Sign-In — only if you choose "Sign in with Google"; Google shares your name and email with us.
• Sentry — crash and error reports (stack trace, browser or device model, page address) so we can fix bugs. Session replay is off and form contents are not recorded.
• Hostinger — serves the website; like any web host it keeps standard request logs (IP address, time, page).
• Google AdSense / AdMob — only when ads are switched on: banners on the marketing pages and, on Android, an optional rewarded video past the free-invoice limit. Google may use cookies and device identifiers per their privacy policy.
• Google (Gemini API) — only when you use the Inbill AI Assistant. Your typed message, or your voice in live voice mode, goes from the app to the Inbill server and on to Google's Gemini API, and the reply comes back to you. Inbill logs only the call kind, message length, and success or failure — not the content. Google processes the request under its Gemini API terms.
• ElevenLabs — only when your device can't turn speech into text itself. The short voice clip is sent through the Inbill server to ElevenLabs for transcription and the text comes back. On Android and in Chrome, speech recognition normally runs through the device's or browser's own speech service instead.

The AI Assistant is optional. Anything you type into the AI prompt window leaves your device, transits the Inbillserver, and reaches the model provider. By using the AI:

• You confirm you have the right to share the content of the prompt (your own client names, business details, work descriptions). Don't paste secrets, passwords, sensitive personal information about third parties, or anything you're not comfortable being processed by an external API.
• You review every drafted field before saving. The AI drafts; you decide. Inbill is not responsible for incorrect line items, wrong tax categorisation, mis-extracted client details, or any downstream outcome of an invoice you sent without checking.
• Inbill is not responsible for the model provider's handling of the request beyond the commitments in its API terms. We do not have visibility into its internal storage, retention, or operational practices.
• If you're uncomfortable with any of the above, do not use the AI Assistant. Every other Inbill feature — invoicing, templates, recurring schedules, payment tracking — works without a single AI call.

• Sell your data.
• Share your invoice contents or client lists with third parties for marketing.
• Read your invoices or notes for any purpose other than rendering them to you.
• Track you across other websites with cookies or fingerprinting.

You can export all your data, edit any of it, or delete your entire account at any time from Settings or by emailing asadtechlead@gmail.com. Account deletion is a hard delete — backups are purged within 30 days. EU/UK users have additional rights under GDPR; we honour them on request.

Inbill is for adults running businesses. We don't knowingly collect data from anyone under 16. If you believe a child has signed up, email us and we'll delete the account.

When you generate a public link to an invoice (the /i/<token> URL), anyone with that URL can view the invoice — that's the point. Treat the link like a shared document. You can regenerate it from the invoice view if it's been forwarded somewhere it shouldn't have been; the previous URL stops working immediately.

When we update this policy we'll post the new version here with a fresh "last updated" date and notify active users by email if the change is material.

Privacy questions go to asadtechlead@gmail.com.