1. Who we are

BillSend is operated by Arsalan Mohammad Arref (“we”, “us”), a sole trader based in the United Kingdom. You can reach us via our contact form.

2. What data we collect

Account data: your email address (used to send you sign-in links) and when you last signed in. If you subscribe to Pro, your Stripe customer and subscription IDs and your plan’s status and renewal date. Your card details go straight to Stripe — we never see or store them.
Business data you enter: your business details, logo, settings, customers, quotes, invoices and templates. This is your data — we process it on your behalf to provide the service. For the personal details of your own customers, you are the controller and we act as your processor.
When your customer opens a link: when someone opens a quote or invoice link you’ve shared, we record the time it was opened (so you can see it) and, for a quote, whether they accepted or declined. We don’t store their IP address or device details.
Usage counts and feedback: a count of the quotes, invoices and templates you create each month (for the free-plan limits), and any “Was this helpful?” feedback you choose to give.
Affiliate programme (only if you join it): who signed up through your link and the commission owed to you.
Contact form messages: what you send us, so we can reply.
Cookies and your browser: one essential cookie (__Host-billsend_session) keeps you signed in. Your browser also remembers a few preferences on your device, such as your language and whether you prefer the form or Paper view. No advertising or third-party tracking cookies.
Server logs: standard request logs (IP, user-agent, timestamp) for security and debugging, retained for 30 days.

3. Lawful basis

Contract — to provide the service you've signed up for.
Legitimate interest — to keep the service secure and operational.
Consent — where applicable (e.g. optional marketing emails, if any).

4. Third parties (sub-processors)

Cloudflare — hosting, DNS, edge compute. Data may be processed in any of their global regions.
Resend — transactional email (sign-in links, quotes and invoices you email to customers, account notices).
Microsoft 365 — human-facing email infrastructure for support correspondence.
Stripe — payment processing and subscription management for paid plans.
Sentry — error monitoring (Functional Software, Inc.; data stored in the EU). Receives technical error and performance data only (stack traces, browser/OS info, page URLs). We configure it not to send names, email addresses, IP addresses or form contents.

Each processes data only as needed to provide their part of the service. See each provider's privacy policy for their own practices.

5. How long we keep data

Account and business data: while your account is open. You can delete your account yourself at any time (Account → Delete account). It’s removed from our live database straight away.
Backups: we take a nightly backup of the database and keep each one for 30 days, so a deleted account is gone from our backups within 30 days too.
Inactive free accounts: if you’re on the free plan and don’t sign in for 12 months, we email you a warning and delete the account 30 days later unless you sign in. Pro accounts are never deleted for inactivity.
Server logs: 30 days.

6. International transfers

Some sub-processors are based outside the UK/EEA (notably US-based providers like Cloudflare, Stripe, and Resend). Where personal data is transferred internationally, we rely on the safeguards each provider has in place — typically the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an equivalent mechanism. We only use providers whose published terms commit to one of these safeguards.

7. Your rights

Under UK GDPR you have the right to:

Access the data we hold about you (subject access request).
Correct inaccurate data.
Erase your data (right to be forgotten).
Restrict or object to processing.
Receive a copy of your data in a portable format.
Lodge a complaint with the Information Commissioner's Office (ico.org.uk).

You can download your quotes and invoices as CSV from their pages, and delete your account from the Account page. For anything else, or a full copy of your data, submit a request via our contact form (use the “Data request (GDPR)” option).

8. Security

Data is encrypted in transit (TLS 1.2+) and at rest (Cloudflare D1 and KV use provider-managed encryption). Authentication uses passwordless magic links — we never store user passwords. Only you can see your business data; we look at it only when you ask us for support or to keep the service secure. Webhook payloads from third parties (e.g. Stripe) are signature-verified before being processed.

In the event of a personal data breach that's likely to affect you, we will notify you and (where required by law) the Information Commissioner's Office within 72 hours of becoming aware, in line with UK GDPR Articles 33 and 34.

9. Changes to this policy

We may update this policy. For material changes that affect how your data is handled, we'll notify you in advance — typically through an in-app notice the next time you sign in, or by email where the change requires it. The “Last updated” date at the top reflects the most recent revision.

10. Contact

Questions, complaints, or rights requests: use our contact form.

سياسة الخصوصية