Privacy Policy

This Privacy Policy explains what BillCrafter, operated by CCC STUDIO (“BillCrafter”, “we”, “us”), collects when you use billcrafter.com and our invoice tools (the “Service”), how we use it, and the choices you have.

1. Information we collect

We aim to collect as little as possible.

• Account data. When you create an account we store your email address and a hashed password (we never store passwords in plain text). If you request a magic-link sign-in, we temporarily store a one-time token tied to your email. If you sign in with Google (when enabled), we receive your basic profile email.
• Content you enter. The business details, clients, saved items, and invoices/estimates/quotes/receipts you create and choose to save to your account.
• Email send data. When you email an invoice, we record metadata such as your account email, the recipient address, subject line, attachment filename, delivery status, and any provider error message. We also process the message body and PDF you asked us to send.
• Usage data. Counts needed to enforce export limits (anonymous 1 export per month by IP, free 5/month, Pro unlimited), and basic, aggregated analytics about how the Service is used.
• Payment data. If you subscribe to Pro, payments are processed by PayPal. We receive your subscription status but do not store your card or PayPal account details.
• Contact form data. If you write to us via the contact page, we receive the name, email, and message you submit.
• Device & log data. IP address, browser type, and request logs, used for security and to operate the Service.

Before you create an account, drafts are kept in your browser’s local storage and are not sent to us.

2. How we use information

• Provide, maintain, and secure the Service and your account.
• Save and sync your business profile, clients, items, and documents.
• Send magic-link sign-in emails and deliver invoice PDFs you choose to email to clients.
• Enforce free/paid export limits and process Pro subscriptions.
• Detect, prevent, and respond to fraud, abuse, spam, and security incidents.
• Communicate with you about your account, security, and product updates.
• Improve the Service using aggregated, non-identifying insights.

Under the GDPR, our legal bases are performance of a contract (providing the Service), our legitimate interests (security and improvement), consent (where required), and legal obligations.

3. Your invoice content is yours

The documents and client details you create belong to you. We access them only to provide the Service (for example, to store, render, export, or email them at your request) or where required by law. We do not sell your personal information or your invoice content, and we do not use it for advertising.

4. Email & invoice delivery

Transactional email (magic links, contact form notifications, and invoice emails you send) is delivered through our email provider. When you email an invoice:

• The PDF and message are sent to the recipient address you provide.
• Your account email is typically used as the reply-to address so clients can reply to you directly.
• We keep an internal send log for support, abuse prevention, and service reliability. That log is available to authorized administrators of the Service.

5. How we share information

We share data only with service providers that help us run the Service, under contracts that protect your data:

• Cloudflare — hosting, database (D1), and sessions (KV).
• PayPal — subscription billing for Pro.
• Resend — transactional and invoice email delivery.

We may also disclose information to comply with the law, enforce our Terms, or in connection with a merger or acquisition (with notice where required). We do not sell personal data.

6. Cookies

We use a strictly necessary, secure session cookie to keep you signed in. We keep any analytics minimal and privacy-respecting. You can control cookies in your browser; disabling the session cookie will sign you out.

7. Data retention & deletion

We keep your account and content while your account is active. You can delete individual clients, items, profiles, and documents at any time, and you can delete your entire account, which removes your associated data (subject to limited retention for legal, security, or backup purposes). Email send logs may be retained for a reasonable period for security and abuse prevention.

8. Security

We protect data in transit and at rest, hash passwords, and scope every account’s data to that account. No method of transmission or storage is 100% secure, but we work to protect your information and to respond promptly to any incident.

9. Your rights

Depending on where you live (including the EU/UK under GDPR and California under the CCPA/CPRA), you may have the right to access, correct, delete, or export your data, to object to or restrict certain processing, and to withdraw consent. California residents may request disclosure of data practices and to opt out of “sale” or “sharing” — note that we do not sell or share personal information. We will not discriminate against you for exercising these rights. To make a request, contact us below.

10. International transfers

We operate on globally distributed infrastructure, so your data may be processed in countries other than yours. Where required, we use appropriate safeguards for such transfers.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date and, for material changes, provide additional notice.

13. Contact us

Privacy questions or data requests: privacy@billcrafter.com. For general help, contact support@billcrafter.com or visit our contact page.