Privacy Policy

1. Who this policy covers

IdeaBill operates the service described in this policy. This policy explains our handling of information when you visit our website, use the portal or mobile app, open a shared document, respond to a quote, or contact us.

For account administration and service operation, we decide how the relevant information is used. When a business enters customer information into IdeaBill, that business is responsible for its collection and its use in the business relationship. We process that document content to provide the service. Contact the issuing business about its own privacy practices.

2. Information we handle

• Account information: name, email address, account identifier, sign-in provider, and profile photo when provided through Google. Authentication is handled through Firebase Authentication.
• Business and document content: business profiles, logos, customer names and contact details, addresses, quotes, invoices, line items, prices, tax and discount settings, notes, terms, and imported records.
• Sharing and responses: published document versions, link activity, and the name, email, comment, action, time, and version associated with a quote response.
• Device and notification information: mobile or browser push tokens, platform, account association or shared-document subscriptions, notification preferences, browser installation identifiers, and registration timestamps.
• Technical information: IP addresses and request information processed by our hosting and cloud providers, security and error logs, and information used to prevent abuse and limit requests.
• Subscription payments: plan, amount, service fee, billing dates, payment status, transaction references, and payment-review records. Card details pass through our backend to OneLink for processing and are not saved by IdeaBill. OneLink receives card details, customer name and email, amount, and a payment description.
• Support communications: information you choose to send when asking for help or making a privacy request.

You can browse public pages without an account. Account details are needed to operate a workspace. Notification permission and optional profile details are not required to use the core portal.

3. Why we use information

We use information to authenticate accounts, save and display documents, manage customer and business records, generate PDFs, publish links, record quote responses, send enabled notifications, provide support, and protect the service from fraud or abuse.

Depending on the activity and applicable law, processing may be necessary to provide the requested service, meet legal obligations, protect legitimate service and security interests, or act on your consent. Where we rely on consent, you may withdraw it without affecting earlier lawful processing.

4. Shared documents and recipients

Publishing a link makes the published document available to anyone who has that link. A recipient can download a PDF and may forward the link or a copy. The sender controls whether a link remains active. Revocation does not remove copies already obtained by others.

If you respond to a quote, the sender can see the information you submit with your response. A link visit may be recorded as an opening, including visits caused by automated previews. The name and email submitted with a response are self-reported, not verified identity.

5. Camera and push notifications

The app requests camera access when you scan a sign-in QR code. Camera access is used for scanning; the sign-in code is sent to our backend to authenticate the device. Do not share a sign-in QR code with anyone else.

When you enable push notifications, we associate your device’s push token with your account. Firebase Cloud Messaging and, for Apple devices, Apple Push Notification service deliver the messages. Quote-response notifications route to the relevant account and document. IdeaBill announcements require an enabled announcement preference.

Quote alerts use a general summary; announcement text may be visible on the lock screen. You can turn push notifications off in app Settings or device settings. Signing out removes the active device registration when the sign-out completes. Uninstalling the app does not by itself delete your account or documents.

Browser notifications are optional. Signed-in users can enable workspace alerts in Account. Recipients without an account can subscribe to revisions and marked-paid updates for an individual shared document. Permission applies to that browser; it does not verify the recipient’s identity or subscribe them to unrelated documents. We store a browser registration and document subscription to deliver these alerts, and use local browser storage to remember choices. Browser registrations and subscriptions expire after 90 days without renewal and are removed through scheduled cleanup. Stop alerts from the document or Account page, or revoke notification permission in your browser. Disabling or replacing a shared link invalidates its existing subscriptions.

6. Cookies and local storage

The portal uses browser storage to maintain sign-in and preferences such as appearance. The mobile app stores preferences and notification registration information on the device. Blocking or clearing storage may sign you out or reset preferences.

The current website and portal do not include an advertising tracker or an activated analytics integration. The marketing website loads fonts from Google Fonts, which receives network information such as your IP address when those resources are requested. Following an App Store or Google Play link takes you to a separate service with its own privacy practices.

7. Service providers and disclosures

We use Google Firebase and Google Cloud for authentication, database storage, uploaded files, backend processing, and push messaging. OneLink processes subscription card payments and maintains its own transaction records. Our website and portal also use web hosting infrastructure. These providers process information needed to supply their services.

Information is disclosed to document recipients when you publish a link, to the sender when you submit a response, and to providers involved in operating the service. Authorized administrators can manage service announcements and operational records. We may also disclose information when legally required or reasonably necessary to investigate abuse, protect rights, or secure the service.

We do not sell personal information through IdeaBill. If the business operating IdeaBill is reorganized or transferred, information may transfer with the service subject to applicable law and appropriate notice.

8. Where information is processed

Cloud providers may process information outside your country, including in the United States. IdeaBill’s backend functions are configured in Google Cloud’s US Central region; other services and provider infrastructure may use additional locations. Data protection laws can differ between countries.

Where applicable law requires protections for international transfers, we must use appropriate arrangements with our providers. Contact us for questions about the handling of your information.

9. Retention and deletion

We retain account and document information to operate your workspace and preserve the records you use. Retention depends on the purpose of the record, your instructions, legal obligations, security needs, and the resolution of disputes. There is no automatic account deletion simply because you stop using the app.

Published document versions and response history can remain associated with the account even after a link is disabled. Sign-in QR codes expire quickly and cannot be reused after a successful claim. Expired technical records are subject to cleanup processes.

Device registrations older than 30 days are excluded from push sending; exclusion is not the same as deletion. Invalid push tokens are removed when identified. You can initiate permanent account deletion in Account → Delete account in the mobile app or portal. See our account deletion page for instructions or help if you cannot sign in. Deletion removes the account, workspace documents and customer records, uploaded files, shared links, and account-linked notification registrations. Access is blocked after acceptance and deletion runs in the background with retries. A minimal deletion job record is retained for 30 days to prevent stale access and retries from recreating deleted data. Technical notification delivery records expire within 90 days. Deleted uploaded files remain in our storage provider’s restricted recovery storage for 7 days before permanent expiry and are unavailable to users during that period; operational logs follow our cloud providers’ retention settings. Some records may need to be retained for lawful reasons, and copies held by document recipients are outside our control.

10. Your choices and requests

You may request information about your personal data, access to it, correction of inaccurate details, or deletion where applicable. Depending on applicable law and the circumstances, you may also have rights to object, restrict processing, withdraw consent, or receive data in a portable format.

Email us using the contact below. Tell us the account email or document context and the action you are requesting. Do not send a password, sign-in code, or unnecessary sensitive information. We may ask for proportionate information to verify your identity or authority before acting.

If you are a customer named in another business’s document, contact that business first where possible. You may also contact us about our processing or raise a concern with the relevant data protection authority.

11. Security and children

We use authentication, account access restrictions, and backend checks to protect information. No online system is completely secure. Protect your passwords, devices, and shared links, and contact us if you suspect unauthorized access.

IdeaBill is designed for adult business users and is not directed to children. If you believe a child has provided information through an account without appropriate authority, contact us so we can review it.

12. Policy updates

We may update this policy as features, providers, or legal requirements change. We will update the date above and provide additional notice where required. The latest version is available on this page.