Privacy Policy

Last updated: July 11, 2026

This policy covers information handled when you use BillQuest. We do not sell your personal information. Please add only the details needed for the document you are creating.

What we collect

• Account information: your name, email address, profile image when provided by Google, and sign-in method.
• Business and customer information: business names, contact details, customer names, addresses, tax identifiers, items, amounts, dates, notes, and payment references entered on a document.
• Employment and salary information: employer and employee details, pay periods, earnings, deductions, and salary amounts entered in payroll documents.
• Medical information: patient, provider, treatment, medicine, service, amount, and insurance details entered in a medical document.
• Files and visual details: logos, images, signatures, and support attachments you choose to upload.
• Support information: ticket messages, replies, file names, attachment details, and status history.
• Purchase information: the credit pack, amount, currency, payment status, checkout identifier, and provider reference. We do not store your full card, bank, or wallet details.
• Technical information: browser and device details, page and product events, session identifiers, performance data, referral information, error logs, and a one-way hash made from an IP address for first-party analytics and security.

A document can contain information about another person. Only enter it when you have a proper reason and permission to use it.

Where your document data goes

Drafts are saved in your browser so you can return to them. When you create a final document, the submitted form data is also stored in our database for a limited time. An uploaded logo or signature becomes part of that stored form data if it is included in the final document.

The standard PDF download is created in your browser. We do not keep a separate server copy of that PDF as part of the normal download. If you ask us to email a PDF, the file is sent through our email provider.

How long we keep information

Drafts on your device

Browser drafts do not have a time limit. To control storage size, the app keeps the 12 most recently used document drafts. You can remove a draft with the generator reset option or by clearing this site's browser data.

Submitted document data

Data submitted to create a final document is scheduled for automatic deletion 90 days after it is saved. The database cleanup runs in the background, so deletion may happen shortly after the exact expiry time rather than at that exact second.

Analytics events

When analytics is enabled, limited product and performance events are kept for up to 365 days. These events help us find errors and understand whether important parts of the site are working. They are not intended to contain the full text of your document.

Account and payment records

Account, credit, and payment records currently have no automatic expiry date. They remain while the account is active or until they are removed through an approved deletion process. Some payment and credit records may be kept longer for accounting, fraud prevention, security, disputes, or legal duties.

Sign-in links and sessions

An email sign-in link expires after 24 hours. A signed-in session can remain valid for up to 30 days. The account record itself follows the account retention described above.

Support records

Support tickets and their attachments do not currently have an automatic expiry date. Attachment links are short-lived and are not public file links. You may ask us to delete a resolved support record, unless we need to keep it for security, a dispute, or a legal duty.

Technical logs

Hosting, email, database, payment, and security providers may keep technical logs under their own settings and policies. There is no single retention period that applies to every provider log.

Deletion and backups

You can clear browser drafts yourself. Submitted document data is removed automatically after 90 days. For account information or other records, email us to ask for access, correction, export, or deletion.

We do not currently publish a fixed app-level period for removing data from provider-managed backups. A deleted record may remain in a backup until that backup rolls off under the provider's configured schedule. Backups are kept for recovery and are not used as normal document history. If a backup is restored, deletion rules must be applied again.

Who can access your information

Access is limited to people and providers who need it to run the service. Support administrators can read support tickets and open their attachments. A small number of authorized operators may access account, payment, or stored document data when needed to solve a problem, investigate abuse, protect the service, or meet a legal duty. Reading document content is not part of routine product use.

Sensitive information

Salary, medical, identity, payment, and signature details can be sensitive. Avoid adding information that is not required for the document. Sensitive details in a submitted document follow the same 90-day deletion schedule described above; BillQuest is not a specialist medical-record or identity-storage service.

How we use information

• Run accounts, draft recovery, previews, and final downloads.
• Process credit purchases and confirm payment status.
• Send requested files and account messages.
• Answer support requests.
• Prevent spam, fraud, abuse, and security problems.
• Find errors and improve reliability and ease of use.

Providers and sharing

We share only what is needed to provide the service. The providers currently used or configured by BillQuest are listed below.

• Vercel. Application hosting and request delivery. May process request details such as IP address, browser headers, route, timing, and data sent to BillQuest server functions. Provider privacy information.
• MongoDB Atlas. Application database. Stores account records, credit and payment records, support text, limited analytics events, and submitted document form data during its retention period. Provider privacy information.
• Amazon Web Services. Private file storage, email delivery, and public asset delivery. Amazon S3 stores private support attachments, Amazon SES sends account and requested-document email, and Amazon CloudFront serves public site assets. CloudFront is not used as private document storage. Provider privacy information.
• Resend. Fallback email delivery. May receive recipient addresses, message content, and an attached PDF when Resend is used instead of Amazon SES. Provider privacy information.
• Dodo Payments. Checkout and payment processing. Receives checkout details such as customer contact information, selected pack, amount, currency, payment method, status, and payment identifiers. Dodo handles the full payment instrument details used at checkout. Provider privacy information.
• Google. Google sign-in and consent-based site measurement and advertising. Google sign-in may provide name, email address, profile image, and account identifiers. If analytics is allowed, Google Tag Manager, Google Analytics, and Google Ads may receive page, browser, device, session, and product-event details. BillQuest does not intentionally send document contents, customer names, medical details, salary details, signatures, or uploaded files to Google Analytics. Provider privacy information.

A provider may keep its own security, delivery, payment, or access logs under its contract and published policy. BillQuest's 90-day document rule does not automatically set the retention period of every provider log. We may also disclose information when required by law or needed to protect users and the service.

Security

We use HTTPS, access controls, private storage for support attachments, short-lived attachment links, and provider security features. No online service can promise perfect security, so keep a copy of important files and do not enter unnecessary sensitive information.

Your choices

You decide what document details and files to provide. You can clear browser drafts at any time and contact us about information linked to your account. The product does not currently offer instant self-service account deletion. Some deletion requests may be limited where records are needed for payments, security, disputes, or legal duties.

Children and international processing

BillQuest is not made for children. Information may be processed in countries where we or our providers operate, which may be outside your country of residence.

Changes and contact

We may update this policy when the product, providers, or legal duties change. We will change the date at the top when we do. For a privacy question or request, email [email protected].