Privacy Policy

Who we are

BillyBot is operated by BillyBot Ltd (company no. 16954137), registered office Unit 14 Bartlett Court, Sea King Road, Lynx Trading Estate, Yeovil, BA20 2NZ. For personal data processed to run your BillyBot account, we are the data controller. Contact us about privacy at info@billybot.ai.

This policy covers the BillyBot web and mobile apps. Our FloorCut floor-planning product has its own policy at /plans/privacy.

What we collect

Account and business data: your name, email, phone, business details, team members, and the settings you configure (pricing, branding, documents, business facts).

Email and calendar data: if you connect a mailbox, we receive and store the emails in it — including message bodies, attachments and metadata — so the assistant can classify them, link them to jobs, draft replies and act on your instructions. If you enable calendar sync, we read and create calendar events.

Content you provide: chat messages with the assistant, voice notes, uploaded files and photos, floor plans, quotes, invoices, jobs, stock records and supplier price lists.

Your customers' details: names, addresses, phone numbers, email addresses and correspondence that you add or that arrive in your connected mailbox.

Billing data: handled by Stripe. We store a Stripe customer reference and subscription status, never your full card number.

Technical data: device and usage information, push notification tokens, and cookies needed to keep you signed in.

Your customers' data

Businesses using BillyBot upload and receive personal data about their own customers. For that data, the business is the data controller and we act as a processor on its instructions, using the data only to provide the service to that business.

If you are a customer of a business that uses BillyBot (for example, you received a quote, an email, or a link to a customer portal), that business controls your data — please direct requests about it to them, and we will assist them in responding.

How we use data and our lawful bases

To provide the service — running the assistant, processing your email, generating quotes and documents, scheduling, billing (performance of a contract).

To secure, support and improve the service — monitoring for failures, preventing fraud and abuse, diagnosing problems (legitimate interests).

To tell you about the product and measure our own advertising (legitimate interests, or consent where required).

To comply with legal obligations, such as tax and accounting record-keeping.

We do not sell personal data.

AI processing

BillyBot's features are powered by AI models from Anthropic and OpenAI. Content needed for a feature — such as an email to classify, a document to analyse or a chat message to answer — is sent to these providers to generate the result. Our agreements with them do not permit your data to be used to train their models.

Email and calendar data (Google and Microsoft)

BillyBot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: data obtained through Google Workspace APIs (Gmail, Google Calendar) is used only to provide the user-facing features you have requested — reading and organising your email, linking it to jobs, drafting and sending replies on your behalf, and syncing your diary. It is never used for advertising, never sold, and never used to train generalised AI or machine-learning models. Humans do not read this data except with your explicit permission, where necessary for security or abuse investigation, or where required by law.

Data obtained through Microsoft APIs is handled to the same standard. You can disconnect a mailbox or calendar at any time from your account settings, which stops further access; stored tokens are removed on disconnect.

Who we share data with

We share personal data only with the service providers (subprocessors) we use to run BillyBot, listed below; with services you choose to connect; or where required by law.

• Supabase — Database, authentication and file storage
• Vercel — Application hosting
• Stripe — Subscription billing and customer payments
• Anthropic — AI language models powering the assistant
• OpenAI — AI models for document and plan analysis
• n8n — Workflow orchestration between our systems
• Google — Gmail and Google Calendar access, only if you connect them
• Microsoft — Outlook email and calendar access, only if you connect them
• Xero / Sage / QuickBooks — Accounting integration, only if you connect one
• Twilio — SMS notifications
• Expo — Mobile push notifications
• Resend — Transactional email from BillyBot itself
• PDF.co — PDF generation and document processing
• Railway — Floor-plan analysis service hosting
• Meta — Social media posting if you connect an account; advertising measurement for our own sign-up campaigns

International transfers

Some of our providers process data outside the UK, including in the EU and the United States. Where data leaves the UK we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum (IDTA) and standard contractual clauses.

Retention and deletion

We keep your data while your account is active. If you close your account, there is a 30-day grace period during which you can cancel the closure; after it, your account data — including messages, emails, files, quotes and customer records — is permanently and irreversibly deleted from our systems.

We retain limited records beyond deletion only where the law requires it (for example, billing records for tax purposes).

Security

Data is encrypted in transit and at rest. Access is controlled with row-level security so each business can only reach its own data, OAuth tokens for connected services are stored encrypted, and internal access is restricted to what is necessary to operate and support the service.

Your rights

Under UK GDPR you have the right to access, correct, delete or restrict the processing of your personal data, to object to certain processing, and to data portability. To exercise a right, contact info@billybot.ai — we respond within one month.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with how we handle your data.

Cookies

The app uses cookies that are necessary to keep you signed in, secure your account and remember preferences. Our marketing pages may additionally use advertising measurement tools (such as the Meta pixel) to understand how people find BillyBot.

Children

BillyBot is a business tool for users aged 18 and over. We do not knowingly collect data from children.

Changes to this policy

We may update this policy from time to time; the "Last updated" date above shows the current version. For material changes we will give notice in the app or by email.

Contact

Privacy questions or data requests: info@billybot.ai. BillyBot Ltd, Unit 14 Bartlett Court, Sea King Road, Lynx Trading Estate, Yeovil, BA20 2NZ.