Privacy Policy

This explains what BatBill does with data. The short version: your business's data is yours,
your clients' data is theirs, and we don't sell any of it.

What we hold. Your account details (name, email), your business settings, and the records you
create — clients, vendors, quotes, invoices, payments, documents. Some of this is your clients'
and vendors' information, which you provide.

Your role and ours. For the information you enter about your own clients and vendors, you are
the controller and Vorperian Cyberarts is a processor acting on your instructions. We use it to run the
service for you — not for our own marketing, and we never sell it.

Payments. Card and bank details are handled by Stripe; BatBill never stores full card
numbers. Tax filing data, when you use it, is handled by our filing provider.

Linked bank accounts. If you choose to link a business bank account, we use Stripe Financial Connections to read that account's balances and transactions, so we can match incoming payments to your invoices and keep your books reconciled. We never see or store your bank login; you sign in to your bank through Stripe. We store the transactions and balances in the United States, use them only to provide this service to you, and never sell or share them with third parties. Our infrastructure providers (RackNerd and AWS for hosting, Cloudflare for network delivery and encrypted backups) process this data solely on our behalf to operate the service, and may not use it for any other purpose. You can disconnect a linked account at any time in Settings, and doing so stops all further access.

Email. We send email on your behalf (to your clients) and to you (sign-in links, receipts,
notices). Sending providers process the message to deliver it.

Security. We use reasonable safeguards, including encryption of sensitive fields at rest.
No system is perfectly secure; see the Alpha notice.

Retention and deletion. Deleted items go to a recoverable wastebasket and are purged after a
period you control. You can delete your team, which removes its data (some records may be retained
where the law requires).

Your requests. Email Vorperian Cyberarts to access, correct, or delete your personal data. For your
clients' data, direct their requests to you — we'll assist you as processor.

Changes. Material changes will be re-presented for your acceptance.