Privacy Policy

This Privacy Policy explains how Byllar AI ("Byllar," "we," "us," or "our") collects, uses, discloses, and protects information when you use the Byllar platform, including our website, web application, and any related services (collectively, the "Service").

By accessing or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

---

1. Who We Are

Byllar AI is an AI-powered billing assistant for freelancers, shop owners, consultants, and small businesses. Byllar helps you create invoices, track payments, and manage financial records through simple conversation.

For any privacy-related questions, you can contact us at:
contact@byllar.com

---

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information From AI Features

If you use Byllar's AI assistant (for generating invoices, suggestions, or conversational features), the text you input is processed by our AI service provider (for example, Google Gemini) to generate responses. We only send the minimum data necessary to produce the requested output. See Section 6 (Subprocessors) for details.

---

3. How We Use Your Information

We use collected information to:

• Provide, operate, and maintain the Service
• Create and manage your account and company workspace
• Process transactions and send related information, including confirmations
• Generate quotations, reports, and AI-assisted responses
• Send administrative communications (service updates, security alerts, expiry alerts for documents you've uploaded)
• Respond to support requests and customer inquiries
• Monitor and analyze usage trends to improve the Service
• Detect, prevent, and address technical issues, fraud, or abuse
• Comply with legal obligations

We do not sell your personal data to third parties. We do not use your fleet, operator, or client data to train AI models beyond what is necessary to generate your requested output in real time.

---

4. Legal Basis for Processing (Where Applicable)

Where data protection law requires a legal basis for processing (e.g., under Saudi PDPL or GDPR for applicable users), we rely on:

• Performance of a contract — to provide the Service you've signed up for
• Legitimate interests — to improve, secure, and market the Service
• Consent — where you've explicitly given it (e.g., certain cookies, marketing emails)
• Legal obligation — where processing is required by applicable law

---

5. How We Share Information

We do not sell personal data. We may share information in the following circumstances:

• With your organization's other users — data you enter is visible to authorized users within your company account, according to their assigned role
• With service providers (subprocessors) — see Section 6 below
• For legal reasons — if required by law, subpoena, or other legal process, or to protect the rights, property, or safety of Byllar, our users, or the public
• Business transfers — if Byllar is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to standard confidentiality arrangements

---

6. Subprocessors & Third-Party Services

We use the following categories of third-party service providers to operate Byllar. We only share the minimum data necessary for each provider to perform its function.

A current list of subprocessors is available upon request at contact@byllar.com.

---

7. Data Storage, Location & Security

• Data is stored on Google Cloud infrastructure.
• All data is encrypted in transit (TLS) and at rest.
• Each company's data is logically isolated at the application and database layer — no company can access another company's data.
• Access to production systems is restricted to authorized personnel on a need-to-know basis.
• We implement industry-standard security measures, but no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

If you become aware of a security vulnerability, please report it to contact@byllar.com.

---

8. International Data Transfers

If your data is transferred to or processed in a country other than your own, we take steps to ensure appropriate safeguards are in place consistent with applicable data protection laws, including Saudi Arabia's PDPL cross-border transfer requirements where applicable.

---

9. Data Retention

• Account data: Retained for as long as your account is active.
• After account deletion: Retained for up to 90 days to allow for account recovery, after which it is permanently deleted, unless a longer period is required by law (e.g., financial or tax records).
• Backups: May persist in encrypted backups for a limited period after deletion, in line with standard backup rotation cycles.

You may request earlier deletion by contacting contact@byllar.com, subject to any legal retention obligations.

---

10. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your personal data ("right to be forgotten"), subject to legal exceptions
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at contact@byllar.com. We will respond within the timeframe required by applicable law.

---

11. Children's Privacy

The Service is intended for business use by adults acting on behalf of their employer. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected such data, we will take steps to delete it.

---

12. Cookies

We use cookies and similar tracking technologies. Full details are available in our Cookie Policy.

---

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a notice on the Service prior to the change becoming effective. The "Last Updated" date at the top of this page indicates when this policy was last revised.

---

14. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at: