Privacy Policy
Last updated: November 11, 2026
This policy explains how BillSmithy, operated from Serbia, handles personal information when you visit the website, create an account or use the service. We do not sell personal information or use your business records for advertising.
Our role and your client data
We determine how account, support and website usage information is used to operate BillSmithy. When you upload personal information about your clients or team for your business, you determine its purpose and we process it to provide the service. You are responsible for having the right to provide that information and for informing the people concerned. If you need a data processing agreement for your business, contact us before uploading that data.
What we collect
- Account and workspace information: email address, authentication information, business name, contact details, logo, team membership and invitations.
- Business records: client details, invoices, estimates, payment records, expenses, receipt images and records you choose to import.
- Demo and support requests: your name, email, company, team size, message and any information you send us.
- AI interactions: the question you submit and the workspace records used to answer it.
- Service diagnostics and security logs, which may contain request information such as IP addresses and error details. This is separate from the cookie-free visitor analytics described below.
Subscription checkout is not yet enabled, and BillSmithy does not currently collect subscription card details. Before paid checkout launches, this policy will be updated to identify the payment provider and the billing information exchanged with it.
How we use it
- To authenticate accounts, store business records, manage team access and provide invoices, reports and other available tools.
- To respond to demo and support requests and send account-related communications.
- To answer AI questions you choose to submit, maintain the service, investigate errors and prevent misuse.
- To comply with legal obligations and handle requests relating to your information.
Where a law such as GDPR requires a lawful basis, we rely on performance of our agreement for providing the service, legitimate interests for proportionate security, support and service improvement, and legal obligations where applicable. Where consent is required for a particular activity, we will request it, and you may withdraw it without affecting prior lawful processing.
Free invoice generator
The invoice fields in the free generator are processed in your browser and are not submitted to or saved on our servers. Printing or saving a PDF uses your browser. This does not prevent ordinary website requests, fonts, diagnostics or visitor analytics from being processed as described in this policy.
Bank statement imports
The bank CSV tool reads and previews the selected file in your browser. It does not upload the original bank statement file or ask for bank login credentials. When you confirm the import, the selected transactions are saved as expense records in your workspace. Review descriptions and suggested categories before saving, and avoid importing information you do not need.
AI processing
When an authorized owner or admin uses Ask AI, the question and selected workspace data are sent through our hosting provider's AI gateway to OpenAI. This includes business name and currency, recent invoices and client names, expenses and payment records. The request is limited to the most recent 300 records of each transaction type, so the answer may not reflect your entire history. Do not include bank credentials or other unnecessary sensitive information in your questions. AI processing is subject to the providers' applicable data handling and retention terms; it is not confined to your browser.
Browser storage, sign-in and fonts
Authentication uses browser local storage to maintain your signed-in session until it expires or is cleared. Team invitation information is temporarily kept in session storage during sign-in and is removed when the invitation flow completes or the browser session ends. Blocking this storage can prevent sign-in and invitation features from working.
If you choose Google sign-in, Google handles authentication and shares the account information needed to sign you in, such as your email address and account identifier, with our authentication service. Google's own privacy policy applies to its processing.
Pages load fonts from Google Fonts. Your browser sends Google the requests needed to retrieve them, which include your IP address and normal browser request information. Google's privacy policy applies. We have not added advertising pixels or embedded third-party media players.
Visitor analytics
On the published website, visitor analytics records the pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, and errors. These analytics use no cookies, store nothing on the visitor's device, do not keep IP addresses and do not identify visitors or recognize returning visitors.
These measurements are recorded for every visitor without a cookie choice. This site currently has no consent banner. Detailed analytics data is kept for 90 days and daily summaries for one year. The editor preview is not counted.
Lovable collects this data for us. Lovable's privacy policy explains how it handles it.
Who receives information
We use Lovable for hosting, managed authentication, business data storage and diagnostics; Google for fonts and optional sign-in; and OpenAI through the AI gateway for questions you submit. These providers receive the information needed for those activities. Authentication emails are processed by the configured authentication email service. We may also disclose information when legally required or reasonably necessary to protect the service or others' rights.
Workspace members can access records according to their role. Anyone with a public invoice link can view the business and client information shown on that invoice without an account. Share links only with intended recipients.
International processing
Our service providers may process information outside your country, including in the United States. Where applicable law requires safeguards for international transfers, the relevant transfer arrangements must apply. Contact us for information about the arrangements relevant to your use of the service.
Security and retention
We use encrypted connections, authentication and workspace-based access controls. No online service is completely secure; protect your credentials and review team permissions and public links.
Business records are retained while needed to provide your account. You may request account closure and deletion. Cancellation of paid access, if introduced, will not itself delete your records. Some information may need to be retained to meet legal obligations, address disputes or prevent misuse; residual copies may remain in backups until those backups are replaced. We do not promise a fixed 90-day account deletion schedule. Visitor analytics has the separate retention periods stated above.
Your rights
You can edit supported records and use available CSV exports. Contact us to request access, correction, deletion or a copy of other personal information; we may need to verify your identity and authority over a workspace. Depending on applicable law, you may also have rights to restrict or object to processing, portability, withdrawal of consent, and a complaint to your local data protection authority. If your information was uploaded by a business using BillSmithy, contact that business first; we can help it respond.
Changes to this policy
We will update the date above when this policy changes and provide notice of material changes as required by applicable law.
Contact
Questions? Email support@billsmithy.com.