Privacy policy

What we collect

Account data: your email address, a bcrypt hash of your password (never the password itself), your name if you give one, your language, and your workspace name and timezone.

Invoice data: the files sent to a Telegram chat you linked, and the fields read out of them — supplier name and TIN, invoice number and date, currency, taxable value, VAT, total and line items.

Connection data: the Telegram chat id of each linked group or channel, and your QuickBooks company id and access tokens. Tokens are encrypted at rest with AES-256-GCM.

Technical data: the IP address and user agent recorded with each sign-in, so you can tell your own sessions apart.

What we do not collect

No analytics, no advertising, no tracking pixels, no third-party cookies. BillFlow sets three cookies, all first-party: two httpOnly session cookies and one that remembers whether you want English or Khmer.

We do not read any Telegram chat that has not been linked to one of your clients, and we cannot see chats the bot has not been added to.

Who else processes it

We use a small number of providers, each for one job:

• DigitalOcean — hosting, the PostgreSQL database, and Spaces object storage for invoice files (private objects, never public).
• DigitalOcean Gradient AI — reads each invoice and returns the extracted fields. The invoice image, or its text, is sent for this purpose.
• Telegram — delivers the files you send to the bot.
• Resend — sends account email (verification, password reset). It receives your email address, nothing else.
• Intuit (QuickBooks Online) — receives the approved invoice data you choose to sync, as Bills in your own company.

We do not sell your data, and we do not share it with anyone outside this list.

How long we keep it

Invoice files and extracted data stay until the workspace is deleted. Deleting a workspace removes its clients, its invoices, the stored files behind them, and the QuickBooks connection.

You can delete your own account from Settings. While your workspace still holds invoices, write to us instead and we will delete the whole workspace — files included — for you.

Anything already written to your QuickBooks company stays there — it is your accounting record, in your own Intuit account, and we cannot remove it for you.

Your rights

You can read and correct everything in the portal, export your ledger as CSV at any time from Reports, and delete your account from Settings. If you would rather we did it, write to us and we will.

Security

Traffic is HTTPS only. Passwords are bcrypt-hashed. QuickBooks tokens are encrypted at rest. Sessions use short-lived access tokens with rotating refresh tokens, and reusing a revoked token signs out every session for that account.

No system is perfect. If you find a problem, tell us before you tell anyone else and we will fix it.

Contact

Questions about this policy, or about data we hold: write to us at the address below.