Privacy Policy

SoftBillo is built and operated by MetaEdx Inc, incorporated in Delaware, United States, together with its United Kingdom subsidiary MetaEdx Technologies Ltd. We provide the SoftBillo invoicing, bookkeeping and business management software at softbillo.com and in our apps. "SoftBillo", "we" and "us" mean whichever of those two entities is your controller.

We act as a data controller for your account and billing data, and as a data processor for the financial records, documents and client information you create or upload — that material stays yours.

• United Kingdom, Ireland and the European Union — MetaEdx Technologies Ltd, which also acts as our UK/EU point of contact for data protection matters.
• United States and everywhere else — MetaEdx Inc (Delaware, USA).

Either way you reach us at the same address: info@softbillo.com. Your rights are the same whichever entity holds your data.

• Account data — name, email, password hash, workspace and role settings, two-factor enrolment.
• Business data — invoices, estimates, clients, contacts, expenses, projects, bookings, messages and documents you upload.
• Billing data — plan, subscription status, invoices and partial payment-method metadata held by our payment provider. We never store full card numbers.
• Connected accounts — tokens and metadata for services you connect, such as payment providers, calendars and email.
• AI data — the prompts you send to Vio and the outputs returned, plus the workspace records used to answer them.
• Usage and device data — IP address, device and browser information, pages viewed, feature usage, and error diagnostics.
• Support data — messages, attachments and audit records related to your requests.

• To provide the Service (account, workspaces, invoicing, AI features) — performance of a contract.
• To bill you and prevent payment fraud — contract and legitimate interests.
• To keep the Service secure and reliable (logging, abuse prevention, audit trails, backups) — legitimate interests.
• To improve product quality using aggregated or de-identified analytics — legitimate interests.
• To send transactional emails (receipts, alerts, security notices) — contract.
• To send product or marketing updates — consent, which you can withdraw at any time.
• To meet legal, tax and accounting obligations — legal obligation.

We do not sell or share your personal information for cross-context behavioural advertising, and we never have.

Vio only reads data inside your own workspace. Prompts and outputs are processed by our AI model providers strictly to return your result. Your data is not used to train third-party foundation models. We retain prompts and outputs for a limited period for abuse prevention, billing accuracy and support, and you can delete generated artefacts from inside the app.

We use a small set of first-party cookies and browser storage. They fall into three categories:

• Strictly necessary — sign-in and session tokens, request-integrity (CSRF) protection and your consent record. These always run because the product cannot work without them, and they do not require consent. Session data lasts until you sign out or up to 30 days; the consent record lasts 12 months.
• Preferences — country and currency, light/dark theme, sidebar layout and your last-used workspace. Typically 12 months, or until you clear your browser.
• Analytics and diagnostics — aggregated product analytics (which pages and features get used) and error monitoring. Analytics data is retained up to 13 months, diagnostics up to 90 days.

In the UK, Ireland and the EU, analytics and diagnostics run only after you consent. Everywhere else you can opt out at any time from the cookie banner or from Settings → Privacy, and we honour Global Privacy Control (GPC) signals for non-essential cookies. Blocking strictly necessary cookies in your browser will sign you out.

We do not run third-party advertising trackers, do not use cross-site pixels for ad retargeting, and do not sell or share personal information for cross-context behavioural advertising. The full per-cookie table — name, purpose, type and lifetime — is on our Cookie Policy page, which forms part of this policy.

Manage cookie settings

We share personal data only with service providers who process it on our instructions, under contract, in these categories:

• Cloud hosting and managed database/storage
• Payment processing and subscription billing
• Transactional and campaign email delivery
• AI model providers powering Vio
• Error monitoring, logging and product analytics
• Customer support tooling

A current, named subprocessor list is available on request from info@softbillo.com. We may also disclose data where legally required, to protect our rights or users' safety, or in connection with a merger or acquisition (you will be notified).

Because our two entities operate one platform, data may be transferred between the UK, the EU and the United States. Those transfers rely on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, plus supplementary technical measures such as encryption in transit and at rest and access controls.

• Account and business data — kept while your account is active; 30 days after cancellation for export or reactivation, then deleted or anonymised.
• Backups — purged within 90 days of deletion.
• Billing and invoice records — retained up to 7 years where tax and accounting law requires it.
• Security and audit logs — typically 12 months.
• Support correspondence — typically 24 months.

You can export your data at any time from inside the app, and request full deletion from Settings or by email.

You can access, export, correct or delete your data from inside the app. You may also request portability, restriction, or object to processing based on legitimate interests, and withdraw consent at any time. Email info@softbillo.com — we respond within 30 days. If you are unhappy with our response you may complain to your supervisory authority (in the UK, the Information Commissioner's Office; in the EU, your national authority).

If you are a resident of California or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, to request access, correction and deletion, and to be free from discrimination for exercising those rights. We do not sell personal information and do not share it for cross-context behavioural advertising. Send requests to info@softbillo.com; authorised agents may submit requests with proof of authorisation.

We protect data with encryption in transit and at rest, workspace-level isolation enforced in the database, role-based access control, optional two-factor authentication, audit logging of sensitive changes, and validated file uploads. Full detail is on our Security page. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authority without undue delay, and within 72 hours where the law requires it.

SoftBillo is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If we learn we have, we delete it.

We may update this policy. Material changes will be announced by email or in-app at least 30 days before they take effect, and the "last updated" date above will change.

Questions? Email info@softbillo.com and say which country you are in so the right entity picks it up — MetaEdx Inc (Delaware, United States) or MetaEdx Technologies Ltd (United Kingdom).

The terms that govern your use of the service are in our Terms of Service, and the cookies we set are listed in our Cookie Policy.