Privacy Policy

Billinator ("Billinator", "we", "us", or "our") is a multi-tenant GST billing, inventory, and business management application developed by Medhā Labs. This Privacy Policy explains what information we collect when you use Billinator, how we use and protect it, and the choices you have. By creating an account or using Billinator, you agree to the collection and use of information as described here.

1. Information We Collect

Account and business information — when you register, we collect your business/tenant name, GSTIN (optional), address, city, state, pincode, phone number, business email, and the admin user's full name, username, email, and password (stored as a salted bcrypt hash, never in plain text).

Google Sign-In information — if you choose to sign in or register with Google, we receive your Google account's email address, name, and a unique identifier from Google, verified via Google's identity services. We do not receive or store your Google password, and Billinator does not request access to your Gmail, Drive, or other Google data.

Business data you enter — invoices, customers, suppliers, products, expenses, employees, payroll, projects, and other records you create while using the application, scoped to your tenant/business.

Technical and usage data — IP address, browser/device information, timestamps, and audit logs of actions taken within the app (e.g. who created or modified a record), used for security, rate-limiting, and troubleshooting.

2. How We Use Your Information

• To provide, operate, and maintain the billing, inventory, CRM, HR, and reporting features you use.
• To authenticate you and keep your account and business data secure and isolated from other tenants.
• To generate invoices, reports, and GST-related documents on your behalf, based on the data you enter.
• To send transactional communications (e.g. password reset emails, payment reminders you choose to send to your customers).
• To monitor for abuse, enforce rate limits, and maintain audit logs for security and accountability.
• To improve the application and diagnose technical issues.

3. AI Features

Billinator offers optional AI-assisted features (report summaries, dashboard insights, invoice item suggestions, and similar). These features run through Ollama and, depending on how your instance is configured, may process business data you provide to generate suggestions. AI-generated output is informational only and is not a substitute for professional accounting, tax, or legal advice.

4. Sharing of Information

We do not sell your personal or business data. We share information only in these limited circumstances:

• Google — if you use Google Sign-In, Google verifies your identity as part of the authentication flow.
• Email delivery (SMTP) — if configured, to send password resets and payment reminders you initiate.
• Legal requirements — if required by law, regulation, or valid legal process.
• Business transfers — in connection with a merger, acquisition, or sale of assets, with notice to affected users.

5. Data Storage & Security

Your data is stored in a PostgreSQL database with tenant-level isolation, so one business cannot access another's records. Passwords are hashed with bcrypt; access tokens are signed (JWT) and expire automatically. We apply standard security practices including HTTPS in production, rate limiting, and security headers. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your account and business data for as long as your account is active, or as needed to provide the service, comply with legal/tax record-keeping obligations, resolve disputes, and enforce our agreements. You may request deletion of your account and associated data, subject to statutory retention requirements (e.g. financial records required under applicable tax law).

7. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, export, or request deletion of your personal data, and to withdraw consent where processing is based on consent. To exercise these rights, contact us using the details below.

8. Cookies

We use a session cookie to keep you signed in. We do not use third-party advertising or tracking cookies.

9. Children's Privacy

Billinator is a business tool and is not directed at, or intended for use by, individuals under the age of 18.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of Billinator after changes take effect constitutes acceptance of the revised policy.

11. Contact Us

For questions about this Privacy Policy or your data, contact Medhā Labs at privacy@billinator.in or visit medhalabs.in.