Privacy policy
Last updated 14 October 2026 · 4 minute readThis policy explains what BillingEase collects when you use the website and the app, why, who else sees it, how long it’s kept, and what you can ask us to do with it. It’s written for the UK GDPR and the Data Protection Act 2018, and for Sri Lanka’s Personal Data Protection Act, No. 9 of 2022.
Draft, to be reviewed by a lawyer. This document isn’t in force yet and will change before BillingEase launches.
On this page · 10 sections
In short
- We use your information to run your books and your account, and nothing else. We never sell it and don’t show ads.
- We don’t connect to your bank and never see your bank login.
- Each business’s data is kept apart from every other business’s.
- Questions and requests go to privacy@billingease.app. They’re free, and a person answers.
1. Who we are
BillingEase (“we”) makes the BillingEase website and app. The name of the legal entity, its registered address and, in the UK, its registration number with the Information Commissioner’s Office will be added here before launch.
For your account and our website, we decide how your information is used: we’re the controller. For the books you keep in BillingEase, which may include your customers’, suppliers’ and employees’ details, your business decides what goes in and we process it for you: we’re the processor, under the data processing terms.
2. What we collect
- Your account. Your name, email address, password (stored scrambled, never readable) and your country.
- Your business. Its name, address, type, tax references (UTR, VAT number, TIN), invoice settings and logo.
- Your books. Invoices, quotes, customers, suppliers, expenses, bills, payments, payroll entries, and photos or PDFs you attach.
- Questions to Ask. What you ask, and the answers, so you can see them again.
- Messages. Anything you write to us.
- Technical information. Basic logs (time, page, browser, IP address) kept to run the service securely and fix errors.
We don’t receive bank or card data: BillingEase has no bank feeds and takes no card payments.
3. Why we use it, and our lawful basis
- To provide BillingEase to you (our contract with you): keeping your books, sending the invoices and reminders you ask us to, producing summaries and estimates.
- To keep it secure and working (our legitimate interests): preventing misuse, fixing problems, keeping logs.
- To answer you (our contract with you, or legitimate interests): replying to messages.
- To meet legal duties (legal obligation): for example keeping records a regulator requires.
- With your consent only for optional cookies (see the cookie policy). You can withdraw consent at any time.
Under Sri Lanka’s PDPA, we rely on the matching grounds: performance of a contract, legal obligations, legitimate interests and, where needed, consent.
4. Who sees it
- You, and anyone you give access to, such as your accountant or tax practitioner.
- Your customers, who see the invoices, quotes and reminders you send them.
- Our service providers, who host the service, deliver email and, when you use Ask or send a receipt or bill to be read, run the AI model (Google’s Gemini, on Vertex AI). They act on our instructions under written contracts. The current list is in the data processing terms.
- Apps you connect, such as an AI assistant or your own software, see what you allowed when you connected them (reading your books, suggesting changes). They are yours to choose, not our providers: their own terms apply to what they do with it. You can disconnect any of them in Settings → Apps and API.
- Authorities, only when the law requires it.
Nobody at BillingEase looks at your books unless you ask us to help with something specific, or the law requires it.
5. How long we keep it
We keep your books while your account is open. Tax law asks businesses to keep records for years: in the UK, at least five years after the 31 January deadline for the tax year; in Sri Lanka, the period the Inland Revenue Act sets. When you close your account, we’ll tell you how to take what you need first. The exact periods we keep closed accounts’ data for are still to be set and will be stated here before launch.
6. Your rights
Under the UK GDPR you can ask us to: give you a copy of your personal data; correct it; delete it; restrict or object to how we use it; and give it to you in a format another service can use. Under Sri Lanka’s PDPA you can ask for access, correction, completion or erasure, withdraw consent, object to processing, and ask for a review of a decision made only by automated means.
Write to privacy@billingease.app. It’s free, and we answer within the time the law sets (one month in the UK). If you’re unhappy with our answer, you can complain to the Information Commissioner’s Office in the UK, or to the Data Protection Authority of Sri Lanka.
7. How we protect it
Passwords are stored scrambled. Each business’s data is kept apart from every other business’s. The books are an append-only ledger: entries are never silently changed or deleted, so changes can be traced. Connections to BillingEase are encrypted.
8. Where your data lives
Hosting is being decided before launch: a UK or EU region for UK businesses, and a region chosen under the PDPA’s cross-border rules for Sri Lankan businesses. Where data is transferred out of the UK, we’ll use the safeguards UK law requires (such as the UK International Data Transfer Agreement). This section will name the regions once they’re fixed.
9. Changes to this policy
If we change this policy in a way that matters, we’ll tell you by email or in the app before the change takes effect.