Privacy Policy
This policy describes how Quietbill handles personal data. Quietbill is a self-serve invoicing tool for merchants who sell with Stripe.
Who is responsible
Quietbill is the controller for merchant account data. Contact: [email protected].
When your customers use your invoice portal, you are typically the controller of their billing details. We process that data for you in order to generate invoices.
What we collect
- Account: email address, password digest, portal name and slug, whether you have paid.
- Stripe connection: a restricted API key, encrypted at rest, plus the business details you enter for invoices.
- Invoices: snapshots of payments (amounts, line items, dates, customer email, billed-to name, company, address, tax ID) and sequential invoice numbers.
- Portal access: the email a customer types, so we can send a magic link and show only their payments.
- Technical: a session cookie, IP address and user agent on sign-in, and ordinary server logs.
- Purchase of Quietbill: Stripe handles your card. We store the Checkout session id so we can mark your account as paid.
Why we use it
To provide the service: authenticate you, look up Stripe payments, issue invoices, email magic links, take the one-time payment, prevent abuse, and keep backups. We do not sell personal data and we do not use it for advertising.
Processors
- Stripe processes the one-time Quietbill payment and, through the key you connect, is the source of your customers’ payment data.
- Email: magic links and password resets are sent through the SMTP provider configured for this deployment.
- Hosting: the app and its SQLite database run on the host documented in the README (Railway volume at
/rails/storage).
Cookies
We set a signed, HTTP-only session cookie so you stay signed in. The customer portal does not use advertising or analytics cookies.
How long we keep it
Account and invoice data stay until you ask us to delete the account, unless we must keep something longer for a legal claim. Daily SQLite backups on the same volume are kept for 14 days.
Your rights
You can ask for a copy of your data, a correction, or deletion by emailing [email protected]. You may also have the right to complain to a data protection authority.
Security
Merchant Stripe keys are encrypted at rest with keys you set in the environment. Passwords are hashed. The Stripe key you connect is restricted and read-only. No method of transmission or storage is perfectly secure.
Children
Quietbill is for businesses. We do not knowingly collect data from children.
Changes
If we change this policy in a way that matters, we will update this page and the date above. Continued use after that date is acceptance of the change.