Privacy Policy

Last updated: October 7, 2026

EasyBill Flow is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services (the "Service"). Please read this policy carefully. By using the Service, you consent to the practices described herein.

1. Information We Collect

1.1 Personal Information

When you register for an account or use the Service, we may collect the following personal information:

Identity data: Full name, email address, and account credentials.
Social sign-in data: If you register or sign in using Google or Apple, we receive your name, email address, profile picture (where available), and a unique account identifier from that provider. We do not receive your password for those services.
Billing data: Billing name, billing address (street, city, state, postal code, country), and business information (company name, business address, tax ID) if applicable.
Profile data: Phone number and time zone (if you provide them), account preferences, notification preferences, workspace memberships, and role assignments.
Invitation data: When you invite someone to a workspace, we collect their email address in order to send and manage the invitation.

1.2 Payment Data

We use Stripe as our third-party payment processor. When you add a payment method:

We never store your full card number, CVV, or complete card details on our servers.
Your card details are collected directly by Stripe through their secure, PCI DSS-compliant infrastructure (Stripe Elements).
We store locally: A Stripe token reference, card brand (e.g., Visa, Mastercard), last four digits, expiration month/year, and a Stripe customer identifier. This is used solely for display and transaction management purposes.
Stripe stores: Your full tokenized card details, customer record, and transaction history on their secure servers. Stripe's handling of your data is governed by Stripe's Privacy Policy.

1.3 Transaction Data

We maintain records of all payment transactions including: amounts charged, currency, transaction status, gateway charge identifiers, receipt URLs, payment type (subscription, plan change, credit top-up, etc.), any tax invoices or credit notes issued, and associated metadata. We also keep a history of your subscription plan and of credits granted, used, and expired. This data is necessary for billing, accounting, dispute resolution, and regulatory compliance.

1.4 Uploaded Content

When you upload documents to the Service (such as bills, invoices, receipts, and other files), we store those files and the information they contain — for example vendor names and contact details, account numbers, property or service addresses, amounts, dates, line items, and other billing details. This content is stored so we can provide the Service's core features, including document management, data extraction, bill splitting, categorization, and reporting.

Uploaded documents may contain personal information about other people (for example, the person a bill is addressed to). The workspace that uploads a document decides what is uploaded and why; we process that content on the workspace's behalf and on its instructions. The workspace owner and the uploader are responsible for having the right to share that information with us, and for giving any notice to, or obtaining any consent from, the people it concerns.

1.5 Claims & Reimbursement Data

If you use the claims feature, we collect the details of the expense, mileage, and toll claims you submit, including:

Claim details: Amounts, dates, categories, comments, and the supporting documents you attach (such as receipts and toll statements).
Trip details (mileage claims): Where a trip started and ended, its date, distance, and purpose.
Payout details: If you ask to be reimbursed to your own account, the bank or e-wallet provider, the account holder's name, and the account number. Account numbers are stored encrypted.
Review history: Who reviewed a claim, when, the decision, and any remarks.

1.6 Data from Connected Integrations

If a workspace connects a third-party platform (see Section 3.2), we receive and store data from that platform that is needed to operate the integration — for example the organization name, chart of accounts, tax rates, contacts, stock items, properties, and existing purchase bills.

1.7 Usage Data

We automatically collect information about how you interact with the Service, including:

Credit consumption and balance history.
Feature usage patterns and an activity log of actions taken in your account and workspaces (such as uploads, edits, approvals, and deletions).
Browser type, IP address, device information, and session data.
Pages visited, timestamps, and referral sources.

1.8 Visitors Using a Public Share Link

If you open a public share link without signing in, we do not ask for your name or email address. We process the files you upload through the link, together with your IP address and a session identifier, in order to deliver the files to the workspace, to let you remove a file shortly after uploading it, and to prevent abuse.

2. How We Use Your Information

We use the information we collect for the following purposes:

Service delivery: To operate, maintain, and provide the features of the Service.
Document processing: To extract and organize billing data (such as vendor, amounts, dates, and line items) from documents you upload, to detect duplicates and unusual amounts, to suggest accounting codes, and to generate spending insights — including through AI-powered processing as described in Section 3.
Claims handling: To route the claims you submit to the workspace's approvers and to record their decisions.
Integrations: To send data to, and read reference data from, the third-party platforms a workspace has connected.
Payment processing: To process transactions, manage subscriptions, issue credits, and handle billing-related communications.
Authentication & security: To verify your identity, protect against fraud, and secure your account. This includes sending payment verification emails when your bank requires additional authentication (3D Secure / SCA).
Communication: To send transactional emails and in-app notifications (payment receipts, verification requests, renewal reminders, credit-expiry and storage alerts, claim updates, workspace invitations, and account notifications), and service-related announcements.
Improvement: To analyze usage patterns and improve the Service's functionality and user experience.
Legal compliance & protection: To comply with applicable laws, regulations, and legal processes, to enforce our Terms of Use, and to establish, exercise, or defend legal claims.

3. Third-Party Services

We share your information with the following third-party service providers for the purposes described in this policy. The providers we use may change from time to time, and we will update this list when they do:

Provider	Purpose	Data Shared
Stripe	Payment processing	Name, email, billing address, payment method details
OpenAI	AI-powered data extraction, account suggestions, and insights	Content of documents and images you upload for processing; bill line descriptions and summarized spending figures
Google / Apple	Sign-in authentication (only if you use social sign-in)	Account identifier exchanged during sign-in
Xero / Bukku	Accounting integrations (only if you connect them)	Bill details, line items, supplier contact details, and bill documents you choose to push
EasyRenz	Property management integration (only if you connect it)	Expense details and bill documents for the properties you link
Alibaba Cloud	Cloud hosting and file storage	Uploaded files and application data
Email service provider	Transactional emails	Name, email address, and the content of the email

3.1 AI Processing

When you upload a document for data extraction, its content (including images of document pages) is transmitted to OpenAI for processing via their API. Depending on the features you use, we also send bill line descriptions and amounts together with your chart of accounts (to suggest accounting codes), and summarized spending figures such as monthly totals and top merchant names (to generate insights). This processing is governed by OpenAI's API data usage policies, under which, at the time of writing, OpenAI states that API content is not used to train its models by default. We do not control OpenAI's practices, and its policies may change. We aim to send only the content needed to perform the processing you requested.

Text recognition used to locate and highlight values on scanned documents runs on our own servers and is not sent to a third party.

3.2 Connected Integrations

If you choose to connect a supported third-party platform (such as Xero, Bukku, or EasyRenz), data flows in both directions:

What we send: The bill data you select — or, where you have enabled automatic sending, bills that match your configured rules — including the bill document. When you change or delete a bill in the Service, we may update or remove the corresponding record on that platform.
What we read: Reference data such as your chart of accounts, tax rates, contacts, stock items, properties, and existing purchase bills, which we use to map your bills and to learn how similar bills have been recorded.
What we store: The authorization tokens needed to maintain the connection, stored encrypted.

Once data has been sent to a connected platform, it is held by that platform under its own privacy policy and is outside our control; disconnecting an integration does not remove data already sent. You may disconnect an integration at any time from your workspace settings.

3.3 Legal & Business Disclosures

We may also disclose your information:

Where we are required to do so by law, regulation, court order, or a lawful request from a government or regulatory authority.
Where we reasonably believe disclosure is necessary to protect our rights, property, or safety, or those of our users or others — including to investigate fraud, security incidents, or violations of our Terms of Use.
To our professional advisers, such as lawyers, auditors, and accountants, under a duty of confidentiality.
In connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, in which case your information may be transferred to the successor.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4. Workspace Sharing & Public Links

Workspace members: Content you upload to a workspace (documents, bills, and related data) is visible to other members of that workspace according to their assigned roles and permissions.
Claims: Claims you submit to a workspace — including supporting documents, trip details, and the payout details you choose for reimbursement — are visible to the members of that workspace who are permitted to review claims.
Public share links: The Service allows you to create public share links for folders of uploaded files. Depending on the options you choose, anyone who has the link can view and download the shared content, upload files to the folder, or both, without signing in. Only share links to content you intend to make accessible, set an expiry date where appropriate, and disable links you no longer need.

You decide who is invited to a workspace and who receives a share link. We are not responsible for how workspace members or link recipients use, copy, or further share content that you have made available to them.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

Account data: Retained while your account is active. When you close your account, sign-in is disabled and linked social sign-in accounts are removed; remaining account records are kept for a reasonable period afterwards for dispute resolution, fraud prevention, and legal compliance.
Payment and billing records: Retained for as long as required by the financial recordkeeping and tax laws that apply to us, which is generally at least 7 years.
Uploaded files: Retained until you delete them or the workspace that holds them is deleted. If your subscription plan ends and is not renewed, stored files are kept for 90 days so that you can resubscribe without losing them, after which they may be permanently deleted.
Notifications: In-app notifications are deleted after 365 days.
Activity logs: Retained for at least 12 months for security, audit, and troubleshooting purposes, and deleted within 24 months.
Deleted payment methods: Soft-deleted records (retaining only the token reference and basic metadata) are kept for audit trail purposes.

We may retain information for longer than the periods above where we are required to by law, or where it is reasonably needed to resolve a dispute, prevent fraud or abuse, or enforce our agreements. Deleted information may also persist in backups for a limited period before it is overwritten. Information that has been anonymized or aggregated so that it no longer identifies you may be kept indefinitely.

6. Data Security

We use reasonable technical and organizational measures designed to protect your personal information, including:

Encryption of data in transit (TLS/SSL).
Encryption at rest of sensitive data such as integration credentials and reimbursement account numbers; passwords are stored only in hashed form.
Payment card handling through Stripe's PCI DSS-compliant infrastructure.
Role-based access controls within workspaces, and authentication requirements for administrative access.
Monitoring of our systems and periodic review of our safeguards.
Webhook signature verification for payment gateway communications.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security, and you provide your information at your own risk.

Your part. You are responsible for keeping your password confidential, for the security of the devices you use, for the people you invite to your workspaces, and for the share links you create. Please notify us promptly if you suspect unauthorized access to your account.

Incidents. If we become aware of a security incident affecting your personal information, we will notify you and the relevant authorities where we are required to do so by applicable law.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete information. You can update most of your account details yourself from your profile and billing settings.
Deletion: Request deletion of your personal information, subject to our legal retention obligations. You can delete bills, files, and workspaces you own, and close your account from your profile settings.
Portability: Request a machine-readable copy of your data.
Objection: Object to, or ask us to limit, certain processing of your personal information.
Withdrawal of consent: Where processing is based on consent, withdraw your consent at any time.

To exercise any of these rights, please contact us using the information provided below. We will respond within 21 days of receiving a valid request, or within any longer period that applicable law allows. We may need to verify your identity before acting on a request, and we may charge a fee for it, or decline it in whole or in part, where applicable law permits — for example, where it would affect the rights of another person or where we are required to keep the information.

If your request concerns content that someone else uploaded to a workspace (for example, a bill or claim that mentions you), we may refer it to the owner of that workspace, who decides how that content is used.

8. Cookies & Tracking Technologies

We use cookies and similar technologies, such as your browser's local storage, for the following purposes:

Essential cookies: Required for the Service to function (session management, CSRF protection, authentication).
Functional storage: To remember your preferences and settings on your device (such as your current workspace and layout choices).
Payment security: When a payment form is displayed, Stripe may set cookies that are necessary for fraud prevention.

We do not currently use third-party advertising or analytics tracking cookies. If this changes, we will update this policy and provide appropriate notice and consent mechanisms.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States (where Stripe processes payments and OpenAI processes content submitted for AI processing). When we transfer data internationally, we take reasonable steps to ensure that appropriate safeguards are in place, such as Standard Contractual Clauses or the service provider's certification under applicable data protection frameworks. By using the Service, you acknowledge that your information may be transferred to and processed in those countries, whose data protection laws may differ from those of your own.

10. GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR). Our legal bases for processing your information include:

Contract performance: Processing necessary to fulfill our contractual obligations to you (account management, service delivery, payment processing).
Legitimate interests: Processing for fraud prevention, security, service improvement, and internal analytics, where our interests do not override your rights.
Consent: Where you have given explicit consent for specific processing activities.
Legal obligation: Processing required to comply with applicable laws.

You have the right to lodge a complaint with your local data protection supervisory authority if you believe your rights have been violated.

11. Malaysian Users (PDPA)

If you are located in Malaysia, your personal data is processed in accordance with the Personal Data Protection Act 2010 (PDPA). Providing the personal data marked as required at registration and checkout is necessary for us to supply the Service; without it we may be unable to create your account or process your payments. Subject to the PDPA, you have the right to access and correct your personal data, to withdraw your consent, and to limit the processing of your personal data, by contacting us using the details in Section 14. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

12. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will endeavour to notify you by email or through the Service at least 14 days before the changes take effect. Changes that are required by law, or that are needed to address a security or fraud risk, may take effect immediately. Your continued use of the Service after the effective date constitutes your acceptance of the revised policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: [email protected]

Back