Privacy notice

01Who we are

FairBill is operated by Alpara Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States ("FairBill", "we", "us"). This notice explains how we handle personal data when you visit usefairbill.com, ask for a free review, or use the FairBill service at app.usefairbill.com.

Questions or requests about your data: hello@usefairbill.com.

02Our two roles

For our website, review requests, accounts and business contacts, we decide how personal data is used. We are its controller.

When a business uses FairBill, it gives us invoices, accounting records and emails to check. That material can contain personal data, such as the names and email addresses of supplier contacts or staff. We process it only on that business's instructions, under our agreement and data processing terms with it. The business is the controller, and requests about that data should go to it first. We will help it respond.

03What we collect

• Review requests: your name, work email, company and roughly how many vendor invoices you receive each month.
• Accounts: your name, email address, organization and role, and records of sign-ins. Sign-in is provided by WorkOS.
• Service data, on our customers' behalf: invoices, credit notes, agreements, records read from connected accounting software (such as Xero or Zoho Books), and emails and attachments from a connected mailbox or forwarded to a FairBill address. Also the findings, notes and decisions made in FairBill.
• Correspondence: what you write to us, and any emails sent to vendors on a customer's approval.
• Technical data: IP address, browser details and request logs kept by our hosting provider for security and troubleshooting.

We don't use analytics, advertising or tracking cookies. Signed-in users get one essential session cookie. The website itself sets no cookies.

04Why we use it

• To answer your review request and set up the review: steps you asked us to take before a contract (GDPR Art. 6(1)(b)), and our legitimate interest in replying to business enquiries (Art. 6(1)(f)).
• To provide the service, including accounts, imports, checks and findings: performance of our contract with the customer (Art. 6(1)(b)). For service data, we act on the customer's instructions.
• To keep FairBill secure and prevent abuse: our legitimate interest (Art. 6(1)(f)).
• To meet legal obligations, such as keeping our own billing records: Art. 6(1)(c).

05How we use AI

FairBill checks invoices with exact calculations first. It then uses AI models to screen invoices for possible issues and to investigate flagged ones. AI results are findings for a person to review. They never decide anything on their own: a person approves every vendor email, and FairBill does not make payments or change your accounting records.

We do not use your data to train AI models. We send AI requests with provider-side storage switched off where the provider offers that setting.

06Who we share it with

We use these service providers to run FairBill. Each one gets only what it needs for its task:

• Cloudflare: hosting, file storage (EU jurisdiction), email routing and AI processing. Cloudflare may pass AI requests to the model's maker, currently OpenAI.
• Railway: our database, hosted in the EU (europe-west4).
• WorkOS: sign-in and account management.
• Composio: secure connections to the accounting software and mailboxes that customers choose to connect.
• Google: our own business email, where we receive review requests and messages to hello@usefairbill.com.

We don't sell personal data or share it for advertising. We may disclose data if the law requires it, or to protect our rights or users' safety.

07Where your data is

We store our database and uploaded files in the EU. Some providers are based in the United States and may process data there, for example for sign-in or AI processing. Where personal data leaves the European Economic Area, we rely on safeguards offered by each provider, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

08How long we keep it

• Review requests: up to 12 months if no agreement follows, then deleted.
• Service data: for as long as the customer's agreement runs. We delete a workspace, its files and its connections when the customer asks, and within 30 days after the agreement ends.
• Account and security records: as long as the account exists, plus a short period for security.
• Records we must keep by law, such as invoices for our own fees, for the period the law requires.

09How we protect it

Data is encrypted in transit. Each customer's data is separated in the database by enforced row-level security, so one workspace cannot read another's. Original documents are stored unchanged and checked against their fingerprint. Access to production systems is limited to the people who run FairBill.

10Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to restrict or object to how we use it, and to receive a copy in a portable format. Where we rely on consent, you can withdraw it at any time.

To use these rights, write to hello@usefairbill.com. For data in a customer's workspace, we will pass your request to that customer or help them answer it. If you are in the EU or UK, you can also complain to your data protection authority.

11Changes

If we change this notice in a meaningful way, we will update the date above and tell customers before the change applies.