This Privacy Policy describes how bill.i.ng (“we”, “us”, or “our Service”) collects, uses, and shares information when you use our mobile apps and website. It applies to users in Nigeria, Canada, and everywhere else we are available. We designed this document to be readable; the section headings below are deliberately concrete.

1. Information we collect

1.1 Information you provide to us

Account details: your name, email address, password (stored hashed), and optionally your phone number and profile photo.
Business details you choose to add: business name, logo, address, tax ID, bank details shown on your invoices.
Customer and vendor records you create: names, emails, phone numbers, addresses. This data is yours; you are responsible for any permissions you need to process it.
Invoices, quotes, receipts, expenses, time entries, and other transactional records you create.
Photos you attach (for example receipt images), stored only in your account.
Support correspondence you send us.

1.2 Information we collect automatically

Technical data: IP address, device type, operating system version, app version, language, timezone, and the time of each request. Retained for 90 days for security and debugging.
Push notification tokens (Apple Push Notification service or Firebase Cloud Messaging) — only if you have enabled notifications. Tokens identify your device so we can deliver alerts; they do not reveal your identity to Apple or Google.
Usage analytics (screens viewed, features used) via our self-hosted PostHog instance. Respects your iOS App Tracking Transparency choice.
Crash and error reports via our self-hosted Sentry instance. Stack traces and device metadata only; no request bodies or personal data are forwarded.

1.3 What we do NOT collect

Payment card data — payments are processed by Paystack on their own infrastructure. We only see the outcome (paid / failed) and a reference number.
Your contact list or calendar.
Your precise location.
Any third-party advertising identifiers (IDFA, AAID) for ad targeting — bill.i.ng does not serve ads.

2. How we use your information

To provide and improve the Service, send transactional communications (invoices you send to your customers, account notifications, password resets), respond to support requests, detect and prevent fraud, and comply with legal obligations including tax law. We do not sell your data to third parties and we do not use it for advertising.

3. Mobile permissions

Camera: used only when you tap “Attach receipt” on an expense or scan a QR code. Photos stay on your account; we do not upload anything from your camera roll without your explicit selection.
Photo library: used only when you choose to attach an image.
Notifications: opt-in on first launch. Used for payment receipts, follow-up reminders, and weekly digests. Turn off at any time in Settings.
Face ID / Touch ID / biometric unlock: optional; authentication happens entirely on your device. We never see your biometric data.

4. Data storage and security

Data is stored on dedicated servers in Lagos, Nigeria (primary) and Frankfurt, Germany (backup). We use TLS 1.2+ for all data in transit and AES-256 for data at rest. Passwords are hashed using bcrypt. We retain daily backups for 30 days. Access to production systems is restricted, logged, and requires multi-factor authentication. No system is perfectly secure; we commit to notifying you within 72 hours of any breach affecting your account.

5. Data sharing

We share your data only with these categories of recipients:

Payment processors — Paystack (NG) for card and bank payments on invoice links you send. Paystack has its own privacy policy.
Infrastructure providers — our cloud hosts (self-managed servers) and Cloudflare (CDN and DDoS protection).
Push notification delivery — Apple Push Notification service (iOS) and Firebase Cloud Messaging (Android) carry only the device token and message payload.
Legal authorities — when required by a valid court order or subpoena. We publish a transparency report annually.

We never sell your data, share it with advertisers, or use it to train machine learning models outside our own Service.

6. Your rights

You have the right to access, correct, export, or delete your personal data at any time.

Access / export: Settings → Export data inside the app.
Correct: Settings → Profile / Business details.
Delete your account: inside the app (Settings → Delete account) or on the web at https://bill.i.ng/account/delete. Your data is removed within 30 days of the request, with the exception of records we are legally required to retain (e.g. financial transaction records under Nigerian tax law — 6 years).
Other requests: email [email protected]. We respond within 30 days.

7. Cookies (web only)

On our website (bill.i.ng and app.bill.i.ng) we use essential cookies for authentication and session management only. We do not use advertising or cross-site tracking cookies. The mobile apps use secure on-device storage instead of cookies.

8. Children's privacy

The Service is not directed at children. We do not knowingly collect personal information from anyone under 13 (or the equivalent minimum age in your jurisdiction — 16 in the EU, 14 in some regions). If you believe a child has provided us with personal information, contact [email protected] and we will delete it immediately.

9. Regional notes

Nigeria: we comply with the Nigeria Data Protection Act 2023 (NDPA). Our data protection contact is [email protected].

Canada: we comply with PIPEDA and applicable provincial privacy laws. Canadian user data may be processed in Nigeria or Germany; by using the Service you consent to this cross-border processing.

European Economic Area / UK: where applicable we rely on Standard Contractual Clauses for cross-border transfers and on legitimate interest or contract performance for processing.

10. Changes to this policy

We may update this policy. For significant changes we will notify you by email or an in-app banner at least 30 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.

11. Contact

Questions, concerns, or complaints? Email [email protected]. For general support, use bill.i.ng/support.