Billwox
Privacy & Security

Privacy Policy

How we collect, protect, and respect your business and customer information.

Last revised: October 3, 2026

Zero Data Selling

We never sell, rent, or trade your personal or business data to advertisers or third parties.

Bank-Grade Security

All invoices, client lists, and payments are encrypted with TLS 1.3 in transit and AES-256 at rest.

Full Data Portability

You own your data 100%. Export invoices, receipts, expenses, and reports as PDF anytime.

Your Privacy Rights

Access, correct, or delete your data at any time. We honor GDPR, CCPA, and NDPR rights.

01

Information We Collect

We collect only what is needed to deliver our invoicing, POS, and billing services.

Account Information: When you create a workspace, we collect your name, email address, and password (stored as a secure hash). You may also provide company details such as business name, address, tax ID, logo, and currency preferences.
Business & Transaction Data: We store the data you enter into the platform — invoices, estimates, receipts, products, client contact details, expenses, payment records, tax rates, and storefront content.
Payment & Billing Data: When you subscribe to a paid plan or purchase tokens, your payment is processed by PCI-DSS certified gateways (Paystack, Flutterwave, or Stripe). We never store raw card numbers, CVVs, or bank login credentials on our servers. We receive only confirmation of payment status and transaction references.
Team & Access Data: If you invite team members, we store their email addresses, assigned roles, permissions, and activity within your workspace.
Device & Usage Data: We collect IP address (used for automated currency detection, such as NGN vs USD), browser type, device type, pages visited, and general usage patterns to diagnose issues and improve the platform.
Communications: If you contact support or submit feedback, we retain those messages to resolve your inquiry and improve our service.
02

How We Use Your Information

Your data is used to operate the platform, process payments, and provide support — nothing else.

Service Delivery: Generating and sending invoices and estimates, processing POS checkout transactions, hosting your online storefront, creating receipts, tracking expenses, producing reports, and managing team access.
Payment Processing: Coordinating with Paystack, Flutterwave, or Stripe to process payments made through your invoices, payment links, or storefront. Displaying your bank account details on invoices when you choose to include them.
Communications: Sending transactional emails (invoice delivery, payment confirmations, payment reminders, estimate notifications), account notifications (subscription renewals, plan limit warnings), and essential service updates.
Customer Support: Diagnosing technical issues, resolving billing inquiries, and answering help center questions.
Fraud Prevention: Monitoring for suspicious activity, unauthorized access, and chargeback manipulation to protect your workspace and your clients.
Platform Improvement: Analyzing aggregate, anonymized usage patterns to fix bugs, improve performance, and develop new features. We do not build advertising profiles from your data.
04

Information Sharing & Third Parties

We do not sell your data. We share information only with essential service providers.

Payment Processors: Invoice amounts and client details are shared with Paystack, Flutterwave, or Stripe solely to process payments. Each processor operates under its own privacy policy and PCI-DSS compliance.
Cloud Infrastructure: Your data is hosted on secure cloud infrastructure. Our hosting provider processes data under strict contractual obligations and industry-standard security certifications.
Email Delivery: We use email service providers to send invoices, receipts, reminders, and notifications on your behalf to your clients.
Your Clients: When you send an invoice, estimate, or receipt, the recipient sees the information you chose to include (your business details, line items, amounts, bank account details if attached, and payment links).
Legal Compliance: We will disclose information if compelled by a valid legal subpoena, court order, or regulatory requirement. We will notify you unless legally prohibited from doing so.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity under equivalent privacy protections.
No Selling or Renting: We never sell, rent, trade, or share your data with advertisers, data brokers, or unrelated third parties.
05

Data Security

We protect your data with encryption, access controls, and secure infrastructure.

Encryption in Transit: All connections use HTTPS with TLS 1.3 encryption. Data transmitted between your browser and our servers is always encrypted.
Encryption at Rest: Stored data, including database contents and backups, is encrypted using AES-256.
Access Controls: Your workspace uses role-based permissions with 6 team roles and 66 granular capabilities. Internally, our team accesses production data only when necessary for support or maintenance.
Password Security: Passwords are hashed using industry-standard algorithms. We never store or have access to your plain-text password.
Payment Security: Card details and bank credentials are handled exclusively by PCI-DSS certified processors. No raw payment credentials are stored on our servers.
Regular Backups: We perform automated backups to protect against data loss.
No security system is perfect. While we implement strong safeguards, we encourage you to use strong, unique passwords, keep your browser updated, and promptly report any suspicious activity.
06

Data Retention

We keep your data only as long as needed to deliver our services or meet legal requirements.

Active Accounts: Your business data (invoices, receipts, clients, products, expenses, team data) is retained for as long as your account is active.
After Cancellation: When you cancel your account, we retain your data for a reasonable period to allow reactivation. After that period, your data is permanently deleted from our active databases.
Backups: Deleted data may persist in encrypted backups for a limited period before being automatically purged through our backup rotation cycle.
Legal & Tax Records: We may retain certain financial and transaction records beyond account closure where required by applicable tax, accounting, or financial regulations.
Support Records: Communications with our support team may be retained for quality assurance and dispute resolution purposes.
07

Your Rights

You have full control over your data. Access, correct, export, or delete it at any time.

Access: You can view all the data stored in your workspace at any time through the platform dashboard.
Rectification: You can update or correct any records — client details, business information, invoices — directly in the platform.
Deletion: You can delete individual records or request full account deletion. Upon account deletion, your data will be permanently removed from our active systems.
Data Portability: Export your invoices, estimates, receipts, and reports as PDF files at any time from the platform.
Objection & Restriction: You may object to or request restriction of certain processing activities. Contact us and we will address your request promptly.
Withdraw Consent: Where processing is based on consent (e.g. marketing emails), you can withdraw at any time by updating your notification preferences or contacting us.
Non-Discrimination: We will not deny service, charge different prices, or provide a different level of quality because you exercised your privacy rights.
To exercise any of these rights, contact us at support@billwox.com or through our contact page. We will respond within 30 days.
08

Cookies & Local Storage

We use only essential cookies to keep you logged in and remember your preferences.

Authentication Cookies: Session cookies that keep your account securely authenticated. These are strictly necessary for the platform to function.
Preference Storage: Local storage of your POS till settings (barcode sound volume, held carts), interface preferences (theme, language), and session state.
No Advertising Trackers: We do not use third-party advertising cookies, behavioral tracking pixels, or cross-site tracking technologies.
Analytics: We may use minimal, privacy-respecting analytics to understand aggregate usage patterns. No personal profiles are built from this data.
09

International Data Transfers

If your data crosses borders, we ensure it remains protected under appropriate safeguards.

Our cloud infrastructure may process data in regions outside your country of residence. Where data is transferred internationally, we rely on recognized transfer mechanisms such as Standard Contractual Clauses (SCCs) or equivalent safeguards to ensure your data remains protected.
Payment processors (Paystack, Flutterwave, Stripe) may process payment data in their respective operational jurisdictions in accordance with their own privacy policies and applicable data protection frameworks.
10

Children's Privacy

Our platform is designed for business use and is not directed at children.

Billwox is a business invoicing and billing platform intended for use by individuals aged 18 or older, or the age of majority in their jurisdiction.
We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will take steps to delete it promptly. If you believe a child has submitted data to us, please contact us at support@billwox.com.
11

Changes to This Policy

We may update this policy as our platform evolves. Material changes are communicated to you.

We may revise this Privacy Policy from time to time to reflect new features, changes in our practices, or legal requirements. When we make changes, we update the "Last revised" date at the top of this page.
For material changes that significantly affect how we handle your data, we will notify you via your registered email address or through a prominent notice in the platform before the changes take effect.
Your continued use of the platform after a policy update constitutes acceptance of the revised terms. If you disagree with the changes, you may close your account and export your data.
12

Contact Us

Reach out with any privacy questions, data requests, or concerns.

For privacy inquiries, data access requests, or to exercise any of your rights, email us at support@billwox.com or reach out through our contact page at billwox.com/contact.
We aim to respond to all privacy-related requests within 30 days. If you are unsatisfied with our response, you may have the right to lodge a complaint with your local data protection authority.

Have a privacy question?

Contact us for any questions about how we handle your data, or to exercise your privacy rights.

Contact Us