weBiller Privacy Policy

Who is responsible for what

Two kinds of data pass through weBiller, and the law treats them differently. Your account — your email address, your password hash, your business profile, your settings — is ours to answer for. In GDPR terms we are the controller.

Everything you enter about the people you bill is yours to answer for. You decide who goes in the client list and why; we store it and act on your instructions, and we never use it for anything of our own. There we are the processor and you are the controller.

If your own obligations need a signed data-processing agreement, write to legal@webiller.com and we will put one in place.

What weBiller collects

Nothing is collected sideways. Every item below is either something you entered or something the app cannot run without.

• Account data — your email address, an optional name and avatar, a bcrypt hash of your password (never the password itself), your language and theme preferences, and the sessions you have open.
• Business data — business name, address, VAT and registration numbers, logo, bank details and invoice numbering. The things that have to appear on an invoice.
• Client data — whatever you enter about the people you bill: name, company, email, phone, postal address, VAT number, currency, payment terms, and your own notes.
• Documents — invoices, quotes, credit notes, subscriptions, payments, expenses and time entries, with their line items and their history.
• Files — logos, avatars, receipts and anything else you attach, plus the PDFs generated from your documents.
• Device tokens — if you turn on push notifications in the mobile app, the notification token for that device and the platform it runs on.
• Technical data — the ordinary request logs our hosting providers keep: IP address, timestamp and which endpoint was called, for security and debugging.

What weBiller does not collect

Worth stating plainly, because several of these are the default elsewhere.

• No card numbers. weBiller does not process payments — it records that a payment happened — so there is no payment provider in the stack and no card data to store. The bank details on your invoices are the ones you chose to print there.
• No advertising or analytics trackers. No Google Analytics, no pixels, no third-party script watching you read this page.
• No sale or sharing of your data. Not to advertisers, not to data brokers, not to anyone.
• No profiling, and no automated decision-making that has a legal effect on anybody.
• No special-category data. weBiller is not built to hold health, biometric or similar data — please keep it out of the client notes.

Why we hold it

To run the account you asked us to run: rendering your documents, delivering them, tracking what has been paid, and letting you sign in from more than one device. That is performance of a contract.

To keep the service working and safe: fixing bugs, investigating abuse, and sending the emails an account needs — verification, password resets, and notice of changes. That is our legitimate interest, and yours.

weBiller sends no marketing email. Every message it sends is either a step you started (verify your address, reset your password) or a document you or your client acted on (an invoice, a reminder, a receipt).

Contacts on your phone

The mobile app can read your device address book, and for exactly one purpose: filling in the new-client form. Android asks for the contacts permission when you tap the import button; iOS asks in its own way. Decline and the rest of the app behaves identically.

When you pick someone, the app copies that one person’s name, company, email, phone and postal address into the form, on your device. Nothing leaves the phone until you save the client, and then only the fields you kept. Your address book is never uploaded, never read in the background, and never stored anywhere but your phone.

Every other company that can touch it

weBiller runs on other people’s infrastructure. This is the complete list of sub-processors and what each one does.

• Neon — the PostgreSQL database. Everything except files lives here.
• Vercel — hosting for the web app and the API.
• Resend — outbound email: verification, password resets, the invoices and quotes you send by email, payment reminders and receipts.
• Cloudinary — file storage: logos, avatars, attachments and generated PDFs.
• Google, via Firebase Cloud Messaging — delivering push notifications to the device tokens described above.
• No one else. There is no analytics vendor, no CRM, no support tool holding a copy of your data.

Client portal links

When you send a document to someone who has no weBiller account, weBiller mints a signed link to a read-only page for that one document. The link carries a 256-bit random token and only its hash is stored, so nobody at weBiller can reconstruct a link from the database.

The practical consequence matters more than the cryptography: whoever holds the link can read that document and report a payment against it. Treat a portal link the way you would treat the invoice PDF. Links expire after 30 days, minting a new one revokes the old one, and you can revoke a link yourself at any time from the document it belongs to.

Cookies, and what the browser keeps

weBiller sets no advertising or analytics cookies. The web app keeps four things in your browser’s local storage, all of them needed to work:

• your access and refresh tokens, so you stay signed in
• your theme choice, so the page does not flash the wrong colours on load
• your interface language, for the same reason
• a cache of data the app has already fetched, so screens you have visited open instantly

How long it is kept

Account, business, client and document data stay for as long as your account exists. weBiller does not expire or archive your invoices on its own.

You can delete your account yourself, from the Account page, by confirming your password. That removes the account and everything hanging off it — businesses, clients, invoices, quotes, payments, attachments, notifications and sessions — immediately, with no grace period and no undo. Export first.

Deleted rows can survive a short while longer in our database provider’s routine backups before those roll off. Verification, password-reset and portal tokens are stored only as hashes and expire on their own. Request logs roll off on our hosting providers’ schedules rather than ours.

Getting your data out

Before you delete anything, take it with you. Every invoice downloads as a PDF and as UBL 2.1 XML, which is the format accounting software imports without retyping.

From Settings you can also export invoices, clients and payments as CSV, and pull a full account export: one JSON file with your business profile, settings, clients, catalog items, invoices with their line items and payments, quotes, expenses and subscriptions.

Your rights

If the GDPR applies to you, you have the right to see the data we hold about you, correct it, delete it, take it elsewhere in a portable format, restrict or object to how we use it, and withdraw any consent you gave.

Most of that you can do faster than we could: the app already lets you read, edit, export and delete everything in it. For anything the app cannot do, or if you would rather we did it, email privacy@webiller.com. We will answer within 30 days.

If we hold data about you because one of our users invoiced you, they are the controller and we are only the processor. Ask them first — and if they come to us, we will help them answer.

If you think we have handled your data badly, you can complain to the data protection authority in the country you live in. We would rather you told us first, but that is your call, not ours.

Where the data lives

The database is hosted by Neon and files sit with Cloudinary. Email goes out through Resend and push through Google. Several of those are United States companies, so some of your data is processed outside the European Economic Area.

Those transfers run on the data-processing terms each of those providers publishes, which is where their standard contractual clauses are set out. We have not built anything custom on top of them, and we are not going to pretend otherwise.

Security, and what we are not claiming

Passwords are stored as bcrypt hashes, never in plain text, and we cannot read yours. Sessions use a short-lived access token plus a refresh token that is stored hashed and can be revoked; changing your password revokes every session on the account. Portal, reset and verification tokens are random, stored as hashes, and expire. Everything travels over HTTPS.

What we are not claiming: weBiller holds no ISO 27001 certificate, no SOC 2 report and no third-party penetration test. It is a young product built carefully, which is not the same thing as an audited one, and you should not read it as such.

Children

weBiller is a tool for running a business and is not directed at children. You need to be old enough to enter into a contract to hold an account — see the Terms. If you believe a child has signed up, email us and we will delete the account.

Changes to this page

When this policy changes, the date at the top changes with it. Anything material gets an email to account holders rather than a quiet edit at two in the morning.

Contact

Privacy questions, data requests, or a correction to something written here: privacy@webiller.com. Anything else legal: legal@webiller.com.

weBiller is operated by weBiller, in Sweden.