Privacy Policy

Last updated: March 8, 2026

BillSync ("we", "our", "us") operates the website bill-sync.com. This Privacy Policy explains how we collect, use, and protect your information.

1. Information We Collect

We collect information you provide directly:

• Account Information: Name, email address when you sign in with Google.
• Financial Documents: Invoices, receipts, bank statements, and credit card statements you upload for VAT declaration management.
• Email Data: If you connect your Gmail account, we access invoice-related emails and attachments in read-only mode. We do not read, store, or process personal emails unrelated to invoices.
• Transaction Data: Bank and credit card transaction records you import.

2. How We Use Your Information

• Extract and organize invoice data using AI for VAT declaration purposes.
• Match invoices to bank and credit card transactions.
• Generate VAT declaration reports.
• Send team invitation emails when you invite collaborators.
• Process subscription payments via Stripe.

3. Gmail Data Usage (Google API Services)

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We only request read-only access to Gmail (gmail.readonly scope).
• We only process emails that contain invoices, receipts, or financial documents.
• We do not use Gmail data for advertising or marketing purposes.
• We do not share Gmail data with third parties except as needed for AI-based invoice extraction.
• Gmail OAuth tokens are encrypted using AES-256-GCM before storage.
• You can disconnect your Gmail account at any time from the settings page.

4. Data Storage and Security

• Data is stored securely on Supabase infrastructure with row-level security policies.
• All data is scoped to your team — other users cannot access your data.
• Files are stored in encrypted cloud storage.
• OAuth tokens are encrypted at rest using AES-256-GCM.
• All connections use HTTPS/TLS encryption in transit.

5. Third-Party Services

We use the following third-party services:

• Supabase: Database, authentication, and file storage.
• Google Gemini / OpenAI: AI-powered invoice data extraction. Document content is sent for processing but not stored by these services beyond the request.
• Stripe: Payment processing for subscriptions.
• Resend: Transactional email delivery (team invitations).
• PostHog: Privacy-friendly analytics (no personal data shared).

6. Data Retention

We retain your data for as long as your account is active. You can request deletion of your account and all associated data by contacting us.

7. Your Rights

• Access, correct, or delete your personal data.
• Disconnect third-party integrations (Gmail) at any time.
• Export your data.
• Request account deletion.

8. Cookies

We use essential cookies for authentication and session management. We do not use advertising or tracking cookies.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification.

10. Contact Us

For questions about this Privacy Policy, contact us at: support@bill-sync.com