BillFresh Labs Limited ("BillFresh", "we", "us") is committed to protecting the privacy of individuals and businesses that use our AI receipt tracking platform. This policy explains what data we collect, how we use it, and the rights you have over it.
1. What we collect
- Account data — name, email, mobile number, business name, role.
- Receipt data — photos, PDFs, extracted fields (vendor, total, tax, currency), categorisation, notes.
- Usage data — features used, timestamps, device info, IP address.
- Integration data — read-only access to Xero, Google Drive or other services you connect.
2. How we use it
- To power the BillFresh service — OCR, AI categorisation, search, reporting.
- To push approved receipts to the integrations you choose (Xero, Google Drive).
- To improve product reliability, security and support.
3. What we never do
- We never train foundation models on your receipts.
- We never sell your data to third parties.
- We never share your data except with the integrations you explicitly authorise.
4. Cookies
We use a minimal set of cookies for authentication and product analytics. You can opt out of analytics cookies from your dashboard at any time. We do not use advertising cookies.
5. Data residency
Choose where your data lives at signup — Hong Kong, Singapore, Frankfurt (EU) or US-East. We honour your choice and never replicate data across regions without consent.
6. Security
- AES-256 encryption at rest, TLS 1.3 in transit.
- SOC 2 Type II in progress (Q3 2026), ISO 27001 (Q4 2026).
- Annual third-party penetration tests.
- Bug bounty programme via HackerOne.
7. Your rights
You can export, correct or delete your data at any time from Settings → Data. To exercise rights you can't self-serve (portability, erasure, restriction), email privacy@billfresh.app. We respond within 5 business days.
8. Contact
BillFresh Labs Limited · Suite 1208, Two Pacific Place, 88 Queensway, Hong Kong.
Data Protection Officer: dpo@billfresh.app