Privacy Policy

Introduction

BillBooky UAE ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our invoice generation platform in compliance with UAE Federal Law No. 45 of 2021 on the Protection of Personal Data and the General Data Protection Regulation (GDPR).

By using BillBooky UAE, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Personal Information

When you register for an account, we collect:

• Full name and email address
• Business name and Tax Registration Number (TRN)
• Phone number and business address in UAE
• Trade license information (if applicable)
• Payment information (processed securely through third-party payment processors)

1.2 Business Data

• Customer information you input (names, addresses, TRNs)
• Invoice details, products, and services data
• VAT calculations and tax-related information
• Payment records and transaction history

1.3 Technical Data

• IP address and geographic location
• Browser type, device information, and operating system
• Usage data, timestamps, and feature interactions
• Cookies and similar tracking technologies

2. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: To provide invoice generation, VAT compliance, and business management features
• Account Management: To create and maintain your account, process payments, and provide customer support
• Legal Compliance: To comply with UAE VAT laws, Federal Tax Authority (FTA) requirements, and anti-money laundering regulations
• Communication: To send service updates, security alerts, and promotional materials (with your consent)
• Analytics: To improve our services, analyze usage patterns, and develop new features
• Security: To detect fraud, prevent abuse, and protect your account from unauthorized access

4. Data Sharing and Disclosure

We may share your information with:

• Service Providers: Cloud hosting (AWS/Supabase), payment processors (Razorpay), email services (for transactional emails only)
• UAE Authorities: Federal Tax Authority (FTA) when legally required for VAT compliance and audits
• Legal Requirements: When required by UAE law, court orders, or government requests
• Business Transfers: In case of merger, acquisition, or asset sale (with prior notice to you)

We do NOT sell your personal data to third parties.

5. Data Storage and Security

5.1 Data Location

Your data is stored on secure servers located in AWS data centers. While data may be processed outside the UAE, we ensure adequate safeguards through:

• Standard Contractual Clauses (SCCs) approved by UAE authorities
• GDPR-compliant data processing agreements
• ISO 27001 certified infrastructure

5.2 Security Measures

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• Multi-factor authentication (MFA) support
• Regular security audits and penetration testing
• Role-based access controls (RBAC)
• Automated backup and disaster recovery

6. Data Retention

We retain your data as follows:

• Active Accounts: While your account is active and for service delivery
• Tax Records: 5 years from the end of the tax period (as required by UAE VAT law)
• Financial Records: 6 years for accounting and audit purposes
• Marketing Data: Until you unsubscribe or withdraw consent
• Backup Data: Up to 90 days in encrypted backups

After the retention period, we securely delete or anonymize your data.

8. Cookies and Tracking

We use cookies and similar technologies for:

• Essential Cookies: Required for authentication and security
• Analytics Cookies: To understand usage patterns and improve features
• Preference Cookies: To remember your settings (theme, language)

You can manage cookies through your browser settings. Note that disabling essential cookies may affect functionality.

9. Children's Privacy

BillBooky UAE is intended for business use only. We do not knowingly collect information from individuals under 18 years of age. If we discover that a child under 18 has provided personal data, we will delete it immediately.

10. International Data Transfers

Your data may be transferred to and processed in countries outside the UAE. We ensure adequate protection through:

• European Commission approved Standard Contractual Clauses (SCCs)
• GDPR adequacy decisions for EEA countries
• UAE-approved transfer mechanisms under Federal Law No. 45 of 2021

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or through a prominent notice on our platform. Continued use after changes constitutes acceptance of the updated policy.