Privacy Policy

When you create an account: your email address and (optionally) your name and phone number. When you use the app: the invoices, clients, products, services, payments, templates, and settings you create. We don't collect anything we don't need.

Your data lives in Supabase (Postgres), encrypted at rest and in transit. We use row-level security so your data is logically isolated from other users at the database level — not just at the application level. The Inbill server never has plain-text access to your password; Supabase Auth handles credential storage.

We use browser localStorage for: your currency preference, theme, autosave drafts of in-progress invoices, and a one-time setup-wizard flag. We use cookies only for the authentication session managed by Supabase. We don't run any third-party analytics or tracking pixels.

• Supabase — primary database and auth provider.
• Resend — when you choose to email an invoice from inside the app, we pass the recipient address and rendered email content to Resend so they can deliver it.
• Google AdSense / AdMob — on the marketing pages and (on Android) for the rewarded-ad fallback past the free-invoice limit. Google may use cookies and device identifiers per their privacy policy.
• AI model provider — only when you actively use the Inbill AI Assistant. Your prompt is sent from your browser to the Inbill server, then forwarded to a third-party frontier-grade language-model provider so it can generate a response, and the response is returned to you. Inbill logs only the call kind, prompt length, response length, and success/failure for usage analytics — never the prompt content or the response. The provider's contractual commitment (and the only basis on which we use them) is that API traffic is not used to train their models. We do not control the provider's infrastructure — see "AI Assistant" in our Terms for what that means for your responsibility. You can opt out of the AI Assistant by simply not using it.

The AI Assistant is optional. Anything you type into the AI prompt window leaves your device, transits the Inbillserver, and reaches the model provider. By using the AI:

• You confirm you have the right to share the content of the prompt (your own client names, business details, work descriptions). Don't paste secrets, passwords, sensitive personal information about third parties, or anything you're not comfortable being processed by an external API.
• You review every drafted field before saving. The AI drafts; you decide. Inbill is not responsible for incorrect line items, wrong tax categorisation, mis-extracted client details, or any downstream outcome of an invoice you sent without checking.
• Inbill is not responsible for the model provider's handling of the request beyond the contractual commitments they make to us. We pick providers whose terms say "no training on API traffic", but we do not have visibility into their internal storage, retention, or operational practices.
• If you're uncomfortable with any of the above, do not use the AI Assistant. Every other Inbill feature — invoicing, templates, recurring schedules, payment tracking — works without a single AI call.

• Sell your data.
• Share your invoice contents or client lists with third parties for marketing.
• Read your invoices or notes for any purpose other than rendering them to you.
• Track you across other websites with cookies or fingerprinting.

You can export all your data, edit any of it, or delete your entire account at any time from Settings or by emailing asadtechlead@gmail.com. Account deletion is a hard delete — backups are purged within 30 days. EU/UK users have additional rights under GDPR; we honour them on request.

Inbill is for adults running businesses. We don't knowingly collect data from anyone under 16. If you believe a child has signed up, email us and we'll delete the account.

When you generate a public link to an invoice (the /i/<token> URL), anyone with that URL can view the invoice — that's the point. Treat the link like a shared document. You can regenerate it from the invoice view if it's been forwarded somewhere it shouldn't have been; the previous URL stops working immediately.

When we update this policy we'll post the new version here with a fresh "last updated" date and notify active users by email if the change is material.

Privacy questions go to asadtechlead@gmail.com.