Privacy Policy

What we collect

• Account details: your name, email and a securely hashed password (or your Google sign-in).
• Business data you enter: business details and logo, clients, items, estimates, invoices, payments, expenses and receipts.
• Usage records: sign-in times, important actions (like "invoice sent"), emails sent for your documents, and error logs, to run and improve the service.
• From your clients: when they open a link you sent, we record that it was viewed. When they accept an estimate we keep their name, signature, IP address and browser as a record of the acceptance.
• Feedback you send us, with the page you were on.

How we use it

• To provide Kitebill: store your records, create documents and PDFs, and send the emails you ask for.
• To send account emails (confirming your email, password resets, a welcome email) and the notifications you turn on.
• To keep the service secure, prevent abuse (for example limiting repeated sign-in attempts) and fix problems.
• To understand, in aggregate, how the product is used so we can improve it.

For your clients' details, you decide what to enter and we act on your behalf to process them.

Who else handles it

We use a few trusted providers to run Kitebill. They process data only for us:

• Vercel: hosting the app
• Our database provider (such as Neon or Supabase): storing your data
• Resend: sending emails
• Stripe: subscription payments, and card payments from your clients if you connect Stripe
• Google: signing in, only if you choose Continue with Google

We never sell your data or share it for advertising. We may disclose data if the law requires it.

Cookies and local storage

We use one essential cookie to keep you signed in, and short-lived cookies during Google sign-in. Your theme and sidebar choices are kept in your browser's local storage. We do not use advertising or tracking cookies, so there is no cookie banner.

How long we keep it

We keep your data while your account is open. Invoices and similar records may need to be kept for several years for tax purposes, so deleting a single document is not always possible once it is sent. When you ask us to close your account, we delete your data within 30 days, except where we must keep it by law. Security logs are kept for a short time and then deleted.

Your rights

You can see and correct most of your data in the app, and export your clients, invoices, estimates, expenses and reports as CSV. You can also ask us for a copy of your data, to correct or delete it, or to stop processing it, by writing to [email protected]. If you are in the EU or UK you can also complain to your data protection authority.

Security

Connections use HTTPS, passwords are hashed, sign-in links are single-use, client links use long random codes, and every business's data is kept separate. No system is perfectly secure; if something goes wrong that affects you, we will tell you.

Changes and contact

If we change this policy in a way that matters, we will tell you by email or in the app. Questions: [email protected].