Privacy Policy

1. Information We Collect

Account information

When you register, we collect your name, email address, and organisation name. If you sign in via Google OAuth, we receive your name and email from Google.

Business data

We store the invoices, estimates, client records, expenses, and other business data you create within the service. This data belongs to you.

Payment information

Subscription payments are processed by Stripe. We do not store your card number, CVV, or full payment details. Stripe retains a customer ID that we use to manage your subscription.

Usage data

We collect standard server logs (IP address, browser, pages visited, timestamps) to operate, secure, and improve the service.

2. How We Use Your Information

• To provide, maintain, and improve BillCraft AI.
• To send transactional emails (invoice delivery, payment receipts, reminders).
• To process AI-powered features using your invoice and client data as context.
• To manage your subscription and send billing notifications.
• To detect and prevent fraud, abuse, and security incidents.
• To respond to support requests.
• To comply with legal obligations.

We do not sell your personal data or use it for advertising.

3. Third-Party Services

We use the following third-party processors. Each operates under their own privacy policy and data processing agreements.

4. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required by law to retain it (for example, billing records for tax purposes, which are retained for 7 years).

5. Data Security

All data is encrypted in transit (TLS 1.2+) and at rest. We use row-level security policies to ensure your data is never accessible to other organisations. Sensitive credentials are stored using industry-standard secret management. While we take reasonable measures to protect your data, no system is completely secure, and we cannot guarantee absolute security.

6. Your Rights

Depending on your location, you may have the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — request that we correct inaccurate data.
• Deletion — request deletion of your account and associated data.
• Portability — request an export of your data in a machine-readable format.
• Objection — object to certain processing activities.

To exercise any of these rights, email us at privacy@aakasa.dev.

7. Cookies

We use strictly necessary cookies to maintain your authenticated session. We do not use cookies for advertising or cross-site tracking. You can disable cookies in your browser settings, but this will prevent you from logging in.

8. International Data Transfers

Our infrastructure is hosted in the United States and European Union. If you are located outside these regions, your data may be transferred to and processed in countries that may have different data protection laws. By using the service, you consent to this transfer.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, where the changes are material, notify you by email. Your continued use of the service after any changes constitutes acceptance of the updated policy.

10. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at: