1. What this policy covers
This policy covers BillNest at billnest.org, including invoices, expenses, contacts, backups, direct cloud sync, and BillNest Scan. BillNest’s operator is responsible for the personal information it controls and can be reached through Contact us below for privacy or security concerns. You can use a local profile without connecting a cloud account.
2. Information you choose to use
BillNest processes the information you enter or import: business details, invoices and payments, quotes, orders, expenses, receipts, logos, saved items, and contact information. If you use those sections, this can also include contractor or employee details. Enter only information you are authorized to hold.
The app also uses your profile username, device label, settings, file and folder identifiers, timestamps, and sync history to operate. Connecting Google Drive allows BillNest to read the connected account’s email and account identifier to identify the destination and avoid syncing to the wrong account.
3. Your device and password
Your main business profile and encrypted recovery backups use password-derived AES-GCM encryption. The BillNest password is used on your device; it is not sent to Google or the BillNest web server. Records are available in memory while your profile is unlocked. The main workspace does not upload your complete business profile to the BillNest web server. Optional Telegram delivery uses temporary server metadata and file transfer as explained below.
Browser storage holds the encrypted profile and sync checkpoints, as well as operational information such as language, profile names, folder connections, and app cache. This operational information is not all encrypted. An agreement receipt records the username and profile identity, agreed policy version, acceptance time, language and affirmative statement. It is saved inside the encrypted profile and included in subsequent backups and optional cloud sync to your own drive. A separate unencrypted browser receipt may also be retained for this profile; the scanner receipt is browser-only. Receipts are not sent to BillNest and do not form an owner-accessible register. You may download your receipt and the archived policies you accepted. Clearing site data removes local copies. BillNest has no online password reset for encrypted profiles.
4. Optional Google Drive connection
Direct Cloud sync and scanner delivery currently connect to Google Drive. BillNest requests the drive.file permission to create, find, read, and update files and folders created with the app or explicitly opened with it. It does not request general access to every file in your drive. This access is used to send and retrieve your chosen records, restore profiles, check sync history, and deliver or retrieve scans.
Direct sync uploads encrypted snapshots from your browser to your own Google Drive. Business records and included receipt or logo attachments are inside the encrypted snapshot. Profile names, file and folder names, timestamps, device labels, identifiers, and sync lineage metadata remain visible to the provider. Google access tokens are held in memory during the connection, not saved to browser storage or BillNest servers.
Google processes its sign-in and permission flow under its own privacy policy. Your Google password belongs in Google’s sign-in screen. Disconnecting stops the current connection; it does not delete files already saved. Revoke ongoing authorization through your Google Account’s third-party connections controls.
5. Exports and scanner files
An encrypted BillNest backup protects the full profile with its password. Folder backups and ZIP exports also contain readable PDFs, receipts, CSVs, and record files. These exported files are not protected by your BillNest password. Keep their folders private and manage sharing in your device or cloud provider. A folder synced by another drive app is separate from BillNest’s direct two-way sync.
BillNest Scan stores pending documents, drafts, inbox settings, and delivery history in its own browser storage. Pending scanner files are not encrypted with your main profile password. Sending a scan uploads a readable document directly to your own Google Drive. Text recognition and review run locally; financial records are created only after your approval. See the scanner privacy notice for more detail.
Snap Receipt privacy notice →Earlier online records
An earlier online version used a server database. A read-only recovery endpoint remains for the authenticated owner of those earlier records; this review has not established whether that database still contains records. Current workspace uploads to the old record endpoints are disabled. If you used the earlier version, contact us about access, export or deletion; clearing browser storage or deleting a cloud file does not remove a separate legacy server copy. We will handle any retained legacy information under applicable privacy obligations.
7. Keeping and deleting information
Local records remain until you remove them or clear the site’s browser storage. Files and backups saved outside the browser remain in their saved locations. Deleting an invoice PDF does not delete its invoice record, and deleting a record does not remove that record from older backups.
Direct sync retains encrypted versions and their history in your drive; it does not automatically prune them. Do not delete individual history files during normal use, because missing history can prevent sync. If you want to remove the cloud workspace entirely, disconnect the affected devices first, then delete its files and use your provider’s trash controls. Manage local copies, exports, scanner files, and other backups separately.
For questions about personal information held through support correspondence or website operations, contact us. We will review applicable access, correction, deletion and consent-withdrawal requests, and explain any legal retention requirement or limit on what we can access. Support correspondence and operational information are retained only for service, security, legal or dispute purposes for as long as needed for those purposes; hosting providers control their own operational log schedules. You can complain to the privacy regulator with jurisdiction over your situation; contacting us does not remove that right. We cannot recover a forgotten profile password or decrypt your backup for you. Provider deletion and retention rules apply to information held by that provider.
8. Your security choices
Use a strong, unique profile password, keep your device protected, and lock or log out of BillNest on shared devices. Keep private exports out of shared folders and keep a separate recovery backup. Encryption does not protect readable exports or information visible while your profile is unlocked. No storage or security method guarantees against every loss or unauthorized access. These limits do not remove BillNest’s legal duties to safeguard information it controls or to assess, record, report and notify about breaches when applicable law requires.
Only store information appropriate for your business and the permissions you hold. Availability of employee fields is not a certification that BillNest meets a particular regulated recordkeeping standard.
9. Questions and changes
Use Contact us for privacy questions, requests, or concerns. We aim to provide an initial response within 24–48 hours; this is not a guaranteed response time or emergency service. We may update this policy when the app changes; the date on this page identifies the latest update. Changes to Google data use will be disclosed before requesting any new access.
Optional Telegram receipt delivery
If you link Telegram, Telegram receives and stores messages and files sent to the bot under its own policies. Bot chats are not Secret Chats. Each linked Telegram account routes to one private BillNest inbox. BillNest stores the chat identifier, hashed access and pairing credentials, temporary pairing display name, delivery identifiers, file reference, filename, caption, size and timestamps. Do not send receipts for a different business to a linked account.
BillNest retrieves originals from Telegram through its server when your browser imports them. The server does not persist the original file or extracted text. Text recognition happens on your device; the original and suggestions are saved in your encrypted profile before the delivery is acknowledged. You must review and approve before creating an expense or contractor invoice. No paid AI or external OCR service is used.
Imported file references, names and captions are cleared from the delivery queue. Delivery entries expire after 30 days and are deleted during subsequent service activity. Linked account identifiers remain until disconnected. Expired pairing details and old unused inboxes are cleaned up during subsequent activity. Disconnecting stops new delivery; it does not delete Telegram messages, pending receipts or saved records. Manage Telegram messages in Telegram and saved business records in BillNest.
Your private inbox access key is stored inside your encrypted profile and encrypted backups. Readable record exports omit this key. Restore or synchronize the same profile to use saved receipts on another device; Telegram delivery alone does not synchronize your records. Keep backups and your password private. Service and file limits apply; keep originals until safely saved and backed up.