Privacy Policy

FastBilling is billing and accounts software operated by [Your registered business name], [address]. This policy covers the FastBilling web application and its mobile version.

It is written for two groups: the businesses that use FastBilling, and the customers and suppliers whose details those businesses record in it.

Account and sign-in data:

• Your business name, and optionally its address, mobile number and email
• Each user's name, username, and optionally email and mobile
• A password hash — never the password itself
• Sign-in sessions, and the date each user last signed in

Business data you enter:

• Parties you trade with: name, mobile, email, address, opening balance
• Items: name, unit, buy and sale rates
• Bills, orders, journal entries and the ledger built from them
• Bank account details you choose to record for printing on a bill

A security and accountability trail:

• Who did what and when — signing in, closing a bill, reopening one, changing a permission
• The IP address and browser reported with those actions

• Passwords or Master PINs in readable form. Both are hashed with argon2id, which is one-way — we cannot recover them, and neither can anyone who obtains the database.
• Session tokens in readable form. Only a SHA-256 hash of each token is stored.
• Card or bank credentials. Any future payment processing is handled by the payment provider; card details never reach our servers.
• Passwords, PINs or tokens in the audit trail. That is enforced in the code, because an audit table is exactly where such a leak would persist.

The party and transaction records you enter are yours. We process them to run the service for you, and for nothing else.

We do not sell them, we do not share them with advertisers, and we do not use one business’s data to build features or models for another. Each business’s data is isolated at the database level and every request is scoped to the signed-in user’s organisation on the server, never by anything the browser sends.

FastBilling lets you send a customer a link to one closed bill, which they can open without signing in. That link carries a long random token and is the only thing protecting the bill — anyone who has the link can view it.

The link shows that one bill only. It never exposes your other customers, your other bills, or your cost prices and margins. You can withdraw a link at any time from the bill, and it stops working immediately.

• Our infrastructure providers, who host the servers and database on our behalf and are bound to protect it
• Our email provider, when the service sends an email you asked it to send
• Anyone you deliberately share a bill link with
• Authorities, where the law genuinely requires it

That is the whole list.

Your business data is kept for as long as your account is active, because accounting records need to remain available across financial years.

If you close your account, tell us and we will delete your data within 15 days. Backups are cycled out on their own schedule, so a copy may persist in backup for a short period after deletion.

You can ask us for a copy of your data, ask for it to be corrected, or ask for it to be deleted. Write to [privacy@yourdomain.com] and we will respond within [period].

FastBilling also has an export function, so you can take your data out yourself at any time without asking.

Connections are encrypted with TLS. Passwords and Master PINs are hashed with argon2id. Session cookies are marked HttpOnly and Secure, so browser scripts cannot read them and they are never sent over an unencrypted connection.

No system is perfectly secure. If we ever discover a breach affecting your data, we will tell you what happened, what was affected, and what we are doing about it.

If this policy changes in a way that materially affects you, we will say so rather than quietly updating the date at the top.