Billune — Build invoice your wayBuild invoice your way
← Back home
Back
Legal

Privacy Policy

Last updated: February 2026
Draft — review before real-world launch. This document is a good-faith working draft written to describe how Billune actually operates. It is not a substitute for legal advice. Before you rely on it in production, please have it reviewed by counsel qualified in your jurisdiction.

This Privacy Policy explains what personal information Billune collects, why we collect it, how we handle it, and the rights you have over it. It applies to the Billune web application and related services (the "Service").

1. Data We Collect

a. Account & profile

  • Name, email address, and (if you register with a password) a bcrypt-hashed password.
  • If you sign in with Google, your Google profile display name, email, and profile picture.
  • Your business profile (business name, address, tax IDs, phone, website) — only what you enter in Settings.
  • Uploaded brand assets, e.g. your logo.

b. Invoicing data

  • Clients you add (name, email, address, tax ID).
  • Items/services you save to your library.
  • Invoices you create and their line items, tax, currency, dates, and status.

c. Payments

Payment cards and bank accounts are handled entirely by Stripe. Billune does not store card numbers, CVCs, or bank credentials. We keep a Stripe customer ID and metadata (subscription plan, renewal date, invoice payment status) so we can grant you access to the plan you paid for.

d. Email delivery & tracking

When you send an invoice or reminder from Billune, we use Resend to deliver the email. To help you know whether your client received and opened it, we include a 1×1 tracking pixel and log Resend's delivery/open/click webhook events (timestamp, user agent). You can disable open tracking on request.

e. AI Studio inputs

Prompts you submit to AI Studio are sent to the third-party model provider (currently Google for image generation, Anthropic for template style generation). We do not use your prompts to train models. See those providers' policies for their retention practices.

f. Technical data

  • Access logs (IP address, user agent, request URL, timestamp) for security and abuse prevention. Retained ~30 days.
  • Session cookies (see Cookie Policy).

2. Why We Use Your Data

  • To provide the Service: authenticate you, save invoices, send emails, process payments, generate AI outputs.
  • To bill you and prevent fraud.
  • To send transactional notices (receipts, password resets, subscription renewals).
  • To improve the product — aggregated, non-identifying usage stats only.
  • We do not sell your data. We do not use it for advertising.

3. Sub-processors

We rely on a small set of trusted vendors:

  • Stripe, Inc. — payments processing.
  • Resend — transactional email delivery.
  • Google (Gemini) — AI image generation, only when you use AI Studio.
  • Anthropic (Claude) — AI template style generation, only when you use AI Studio.
  • Cloud hosting provider (MongoDB Atlas / Kubernetes cluster in a region we disclose on request).

4. Data Retention

  • Account and invoicing data is retained while your account is active.
  • If you delete your account, we permanently delete your business profile, clients, items, and invoices within 30 days, except records we must retain for legal/tax reasons (e.g. Stripe payment records typically retained ~7 years).
  • Email tracking events are retained for 12 months.

5. Your Rights

Depending on your jurisdiction (GDPR, UK GDPR, CCPA, etc.), you may have the right to access, correct, export, or delete your personal data, to object to certain processing, and to lodge a complaint with a supervisory authority. To exercise any of these, email us at info@billune.com. We respond within 30 days.

6. Security

Passwords are hashed with bcrypt. Sessions use httpOnly, secure, SameSite cookies. All traffic is TLS-encrypted. We keep the attack surface small: no third-party analytics trackers, no ad networks, and only the integrations listed above. That said, no system is 100% secure — please use a strong unique password.

7. Children

Billune is not directed to children under 18 and we do not knowingly collect their data.

8. Changes

If we materially change how we handle personal data we will notify you at least 14 days before the change takes effect.

9. Contact

Questions or requests: info@billune.com. All Billune email lands in one shared inbox — please include the topic (e.g. "data request", "privacy question") in the subject line so we can route it quickly.