Privacy Policy

Billflow provides invoicing, payment tracking, collections and business-administration software. For questions or privacy requests, contact hello@billflowinvoicing.com.

Billflow can have different data-protection roles for different activities. Billflow generally acts as a controller for its own account administration, subscription billing, security, support and legal obligations. When a business uses Billflow to process information about its own customers on its instructions, that business will generally determine the purpose of that processing and Billflow will generally act as its processor. The exact role depends on the specific processing activity.

Depending on how the service is used, this may include:

• account and business details such as name, email, phone number, business name and onboarding information;
• customer/contact details entered or synchronised by an authorised business;
• invoices, jobs/bookings, payment status and related accounting/collections information;
• transactional email, customer-reply and support communications;
• AI/automation settings, actions, conversations, tasks, approvals and audit information;
• subscription, connected-payment-account and provider status identifiers; and
• technical, security and service information needed to authenticate users, detect abuse and operate the application.

Payment-card details are handled by the relevant payment provider; Billflow is not designed to store raw card numbers or card security codes.

Information may come directly from an account holder, from people a business is authorised to add to its workspace, from customer communications sent to Billflow addresses, from payment/email service providers, and later from third-party systems a business explicitly connects to Billflow.

Where Billflow acts as controller, typical purposes and lawful bases include:

• Contract: creating and administering an account, providing purchased services and handling subscription billing/support;
• Legitimate interests: securing the service, preventing misuse, maintaining reliability, resolving disputes and improving business operations where those interests are not overridden by individual rights;
• Legal obligation: retaining or disclosing information where applicable law requires it; and
• Consent: where we introduce processing that legally requires consent, such as certain non-essential tracking or marketing choices.

Where Billflow acts as processor for customer content, it processes that data to provide the configured service on the business customer's documented instructions, subject to the applicable Data Processing Addendum.

Where a business enables AI or automation features, relevant workspace information may be used to classify messages, prepare or send configured communications, recommend actions, create tasks and support invoicing/collections workflows. Billflow provides controls such as AI enablement, approval requirements and blocked actions.

Billflow does not currently use customer data to make solely automated decisions that are intended to produce legal or similarly significant effects on an individual. Customer text alone is not treated as proof that an invoice has been paid.

Billflow uses specialist service providers to operate the application, including cloud/database and authentication infrastructure, payment services and transactional email. The current list is available at Subprocessors.

Personal data may also be disclosed where required by law, to protect legal rights or service security, or in connection with a legitimate corporate transaction subject to appropriate safeguards. Billflow does not sell customer personal data.

Some service providers may process personal data outside the UK. Where UK rules treat that processing as a restricted transfer, Billflow assesses the applicable mechanism, which may include adequacy regulations or approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum.

Billflow keeps personal data only for as long as reasonably necessary for the purpose for which it is processed. Retention depends on factors including the active customer relationship, the type of record, security/fraud needs, outstanding disputes, deletion instructions, backup cycles and legal/accounting obligations. Customer-content deletion requests are reviewed against those requirements rather than applying an indiscriminate immediate wipe.

Depending on the circumstances, UK data-protection law may give individuals rights of access, correction, erasure, restriction, objection and portability, and rights concerning consent and certain automated decisions. Rights are not absolute and can depend on the lawful basis and context.

If your information is held in Billflow by one of our business customers, that business is normally the best first contact because it controls why the information is in its workspace. We will assist that customer where required. Billflow account holders can also use Settings → Privacy & data to export workspace data or record a request.

You can contact us at hello@billflowinvoicing.com. You also have the right to complain to the UK Information Commissioner's Office; information about complaints is available at ico.org.uk.

Billflow uses technical and organisational measures intended to protect personal data, including authenticated access, tenant-scoped database controls and server-side secret handling. No internet service can guarantee absolute security. More detail is available in the Trust Centre.

Billflow is a business service and is not directed at children. It is not intended to be used as a general repository for special-category data, health records, government identifiers or other sensitive information that is unnecessary for invoicing and business administration. Businesses should avoid importing such information merely because it exists in another connected system.

We may update this notice as Billflow, its integrations or legal obligations develop. The current version and update date will be published on this page. Material changes will be communicated where appropriate.