Privacy Policy

1. Who we are

bills.ph is operated by SmartTools Technologies Inc., of National Road, Concordia, Bolinao, Pangasinan (“we”, “us”). This policy explains what personal data we process through the bills.ph website and service, why, and the choices and rights you have. We follow the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission.

For the data in this policy that we decide to collect — your account, your visits to the website, demo requests and our own mailing list — we are the personal information controller.

2. Data in a customer’s workspace

A business that uses bills.ph puts its own records into its workspace: suppliers and their contact people, employees who request cash advances, colleagues who approve, and the documents and attachments that go with them. For that data the business is the personal information controller, and we are its personal information processor: we store and process it on the business’s instructions, to provide the service, and for no purpose of our own.

If your details are in a workspace because you are, say, a supplier or an employee of one of our customers, please send requests about them to that business first. If you write to us instead, we will pass your request on and help the business answer it.

3. What we collect

When you visit the website

• Like any website, our servers and the network service in front of them receive technical information with each request: your IP address, browser type, the page asked for, and the time.
• If you type your name and email into a “Start free” form, your browser keeps them in its session storage only to fill in the signup form for you. They are removed when the signup form reads them, and nothing reaches us until you submit the signup form itself.

The website uses no analytics, advertising or tracking cookies, and loads no third-party analytics scripts. Its fonts are served from our own servers.

When you ask for a demo

Your name, company, work email, the number of business customers you invoice, which module you are interested in, and, if you give them, a phone number and a message. The request is sent by email to our sales team so we can reply; it is not added to our mailing list. Joining the order-to-cash waitlist asks for the same details except the module, and sends them the same way; we use them only to tell you when order-to-cash opens.

When you create a workspace

The workspace name and address (its subdomain), your name, your email, any referral code you enter, and whether you asked to receive product news by email. We also record the IP address and browser the request came from. Nothing else is created until you follow the confirmation link we email you, which expires after 72 hours.

Your account

• Your name and email, given by you at signup or by the administrator who invited you, and your position and roles in each workspace you belong to.
• Your password, which we store only as a one-way scrypt hash, never as the password itself.
• If you turn on two-factor sign-in: your authenticator secret, stored encrypted, and your recovery codes, stored only as hashes.
• If you enter it: your TIN, which you enter yourself and which must be on file before your workspace can name you as the person who signs its BIR forms. It is stored encrypted, and printed on the forms you are named to sign — the withholding tax certificates (BIR Form 2307) and the monthly and quarterly withholding returns (0619-E and 1601-EQ).
• If you choose to add one: an image of your signature, which only you can upload or replace, stored encrypted, and printed only on the PDF of the BIR forms you are named to sign.
• For each sign-in session: when it started, when it was last used, and the IP address and browser it came from. We also count failed sign-in attempts so we can lock an account for a short time after too many.

What you do in a workspace

The service keeps an audit trail of changes in each workspace: who made the change and their position, what changed, when, and the IP address and browser it came from. This audit trail belongs to the workspace, like its other records.

Bill AI and support

When you use Bill AI, the support assistant in the service, we keep the conversation: what you asked, what it answered, which help articles it used, and whether you said it solved your problem. Before a message is kept, a run of nine or more digits — a TIN, a bank account or a card number — is masked to its last four. We also keep a short record of what the service refused you or failed on, the sentence you were shown and the screen it was on, so that Bill AI and our support team can tell you why. When you ask for a person, our support team sees the conversation, and when they look at your workspace’s information to help you, that is recorded in your workspace’s own activity log.

Protecting our forms from abuse

To slow down automated abuse, we count attempts on the sign-in, two-factor, signup, password-reset and demo forms. These counters store the IP address, email or account as a hash rather than in readable form, and are deleted once their time window closes.

Our mailing list

We add your name and email to our mailing list only with your consent: by ticking the box at signup (and then only once you have confirmed your email by following our link), or if you ask us to. Each entry records where it came from. We do not add you because you asked for a demo, and we do not add you back after you unsubscribe.

4. Why we use it, and on what basis

• To provide the service you signed up for: creating your workspace and account, signing you in, sending the emails the service needs (confirmation links, invitations, password resets, and the approval notices and documents your workspace sends). Basis: performing our contract with you or your business.
• To keep the service and your data secure: sessions, two-factor sign-in, rate limits, lockouts, audit trails and backups. Basis: our legitimate interest, and yours, in a service that is hard to break into, and our duty under the Data Privacy Act to protect personal data.
• To answer a demo request, or tell you when order-to-cash opens if you joined its waitlist. Basis: steps you asked us to take before a possible contract, and our legitimate interest in replying.
• To send product news, only if you opted in. Basis: your consent, which you can withdraw at any time.
• To credit a partner who introduced you, if you entered a referral code. Basis: our legitimate interest in paying the partners who refer customers.
• To meet legal obligations, such as tax and accounting rules that apply to our own business, or a lawful order. Basis: legal obligation.

Some workspace data can be sensitive personal information under the Act, such as a Taxpayer Identification Number. We process it only as part of the service our customer uses it for, and we encrypt suppliers’ TINs and bank account numbers and account names in our database.

We do not sell personal data, and we do not use it for advertising.

5. Who we share it with

We use a small number of service providers, who process personal data for us under their agreements with us and only to provide their service:

• DigitalOcean, which hosts our servers, database and stored files.
• Cloudflare, which carries traffic between your browser and our servers and protects the site from attacks.
• SendGrid (Twilio), which delivers the email the service sends.
• Apple and Google, only if you use the bills.ph mobile app and allow notifications: Apple’s push service (on an iPhone) or Firebase Cloud Messaging (on Android) carries each notification to your phone. See “The mobile app” below.
• Microsoft (Microsoft 365), which hosts our company email, including the mailboxes that receive demo requests and privacy enquiries.
• Anthropic, whose Claude model writes Bill AI’s answers. Your question, the help articles Bill AI reads, and only the information about your workspace that your own access lets you see are sent to it to write each answer, and Anthropic does not use them for anything else.
• Anthropic also reads a document when you ask bills.ph to extract the details from one you upload. This happens only when you use that feature, and only for the document you chose: the file is sent, the details come back, and Anthropic does not use it for anything else. Most PDF invoices are read on our own servers without leaving them — a scan or a photograph is what needs reading this way. Whichever way it is read, the file is kept with the invoice as one of its attachments when you save the invoice, unless you remove it first.

If you entered a referral code, we record which partner introduced you, and we may tell that partner your workspace’s name, when it was created, and the subscription amount their commission is based on. We never share anything from inside your workspace with a partner.

We may also disclose personal data when the law requires it, for example to comply with a lawful order of a court or government agency, or to establish or defend a legal claim.

6. Where your data is stored

Our servers are currently in DigitalOcean’s Singapore data centre. Our email providers process messages outside the Philippines, and a document you send for extraction, or a question you ask Bill AI, is processed outside it too. Where personal data leaves the Philippines, we remain responsible for it under the Data Privacy Act, and our providers are bound by their agreements with us to protect it.

7. How long we keep it

• Sign-in sessions end 12 hours after you sign in, or when you sign out. The record of each session is kept as a security record.
• Signup confirmation links expire after 72 hours. The signup request is kept as a record.
• Abuse counters are deleted once their time window closes.
• Nightly copies of the database are kept for 14 days. Backups of attached files are kept longer, because each one holds the files that arrived that day and may be the only copy.
• Our hosting provider’s backups of the whole server are kept for four weeks.
• Workspace records are not deleted in normal use: the service is built so a business record is corrected, superseded or marked rather than erased, and the audit trail cannot be edited. This is what makes the records reliable as evidence.
• Bill AI conversations are kept for one year after the last message, then deleted. The record of what the service refused you or failed on is kept for 90 days.
• Mailing-list entries are kept with their unsubscribed status after you unsubscribe, so that we never add you back by mistake.

We have not yet set fixed retention periods for accounts, for workspace data after a subscription ends, for demo-request emails, or for server logs. Until we do, we keep them only as long as we need them for the purposes in this policy or as the law requires. A customer whose subscription ends may ask us to return or delete its workspace data.

8. How we protect it

• Encrypted connections. The site is served only over HTTPS, with TLS 1.2 or later, and your sign-in cookie is sent only over HTTPS.
• Each workspace is kept apart by row-level security in the database: in ordinary use, the application reaches workspace data through a database role that can reach only the workspace it is acting for.
• Two-factor sign-in with an authenticator app is available to every user. On the Enterprise plan, a workspace can require it of all its members, and it can also ask for a fresh code before large approvals.
• Passwords are hashed with scrypt, and repeated failed sign-ins lock the account for a short time.
• Sensitive fields are encrypted in the database: bank account numbers and account names, suppliers’ TINs, the TIN of the person who signs BIR forms, and two-factor authenticator secrets.
• An append-only audit trail: the application cannot change or delete an audit entry, and an approval cannot be altered once it is given.
• Daily backups of the database and of attached files.

No system is perfectly secure. If a breach affecting personal data occurs, we will notify the National Privacy Commission and the people affected where the law requires it.

9. Cookies and browser storage

bills.ph sets only the cookies it needs to work. None is used for analytics or advertising.

Our administration console, which only our own staff can sign in to, uses separate sign-in cookies limited to that console. Cloudflare, which carries traffic to the site, may set its own cookies needed for security.

Two things are kept in your browser rather than in a cookie, and neither is sent to us: the “Start free” details described above, and the ticks on the workspace setup checklist.

10. The mobile app

The bills.ph app for iPhone and Android uses the same account as the website. On top of what is described above, it handles the following, and nothing else:

• Your device. When you sign in, the app records your phone’s model name, whether it is an iPhone or Android, and the app’s version, so you can recognise it in your list of devices and remove it from the website. We also record when the phone was last used. The app keeps its sign-in on the phone, in the phone’s own secure storage.
• Documents opened on the phone. When you open a document waiting for your approval, we record that it was opened on that phone, and when, because the app accepts a decision only on a document that has just been opened.
• Files you open in the app are downloaded to a private folder on the phone so the phone can show them, and are deleted from the phone when you sign out.
• Face ID and fingerprints are checked by your phone. bills.ph never receives them. The app creates a signing key on the phone that only your face or fingerprint unlocks; when a large approval asks you to confirm it, the phone signs with that key, and we keep the signature and the key’s public half so the approval can be shown to have come from your device.
• Notifications. If you allow them, the app gives us a notification address for your phone, which we send to Apple or Google with each notification. A notification says what is waiting for you, such as a document’s number and amount. If you can see your workspace’s BIR forms, it also reminds you before a withholding return or certificate falls due, naming the form and its due date.
• The camera and your photos are used only when you take or choose a photo to attach — a delivery note, a receipt, an invoice. Before it leaves the phone, the photo is reduced in size and its hidden details (such as the place it was taken) are removed. It is then kept with the document, exactly like a file uploaded on the website, and read as described under “Who we share it with” if you ask the app to read it.
• Crash reports. If the app hits an error, it sends bills.ph a short report: whether the phone is an iPhone or Android, the app’s version, the name of the screen, and the text of the error with its technical trace. It does not say who you are: no name, email, workspace or document is in it. It goes only to bills.ph’s own servers, never to an advertising or analytics company, and we use it only to find and fix faults.
• Work saved without a signal stays on the phone until it can be sent, and is removed from the phone once it has been accepted. If it is refused, it stays on the phone, with the reason, until you discard it. Signing out asks you first to send or discard anything still waiting, and if a different person signs in on that phone, anything left by the previous person is deleted without being sent.

The app contains no advertising, analytics or tracking, and does not share anything with other apps. Profile › Delete my account in the app writes us a request to close your account, handled as described under “Your rights”. The request is raised as a support ticket in each workspace you belong to, so that workspace’s administrators and sub-administrators can see it, with your name, sign-in email and the workspaces you belong to.

11. Your rights

Under the Data Privacy Act, you have the right:

• to be informed whether and how your personal data is processed;
• to access your personal data, and how it was obtained and used;
• to object to processing, including for direct marketing;
• to erasure or blocking of personal data that is incomplete, outdated, false, unlawfully obtained, used for unauthorised purposes, or no longer needed;
• to rectification of inaccurate data;
• to data portability: to obtain your data in a commonly used electronic format;
• to damages for harm suffered because of inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your personal data;
• to file a complaint with the National Privacy Commission (privacy.gov.ph).

To use these rights for data we control, write to us (see below). We may need to confirm your identity first. For data in a customer’s workspace, see section 2. Some rights are limited by law, for example where a record must be kept for tax purposes; if we cannot do what you ask, we will tell you why.

12. Unsubscribing

Every product-news email carries a link that unsubscribes you at once, with no need to sign in. Unsubscribing does not stop the emails your workspace needs to work, such as approval notices and password resets.

13. Children

bills.ph is a service for businesses and is not directed at children. We do not knowingly collect personal data from them.

14. Changes to this policy

We will update this policy when what we do with personal data changes. When a change is material, we will tell workspace administrators by email or in the service before it takes effect.

15. Contact us

For anything about your personal data, including a request to use any of the rights above, write to us at [email protected].

Our Data Protection Officer is Dino Calundan, reachable at the same address.

By post: SmartTools Technologies Inc., National Road, Concordia, Bolinao, Pangasinan.