Privacy Policy
Last updated: November 11, 2026 · Effective: October 11, 2026
This policy explains what personal data QuickBilling collects, why we collect it, who receives it, how long we keep it and what you can do about it. It covers the website quickbilling.io, the web app at app.quickbilling.io with its in-app AI assistant, the QuickBilling API, the hosted QuickBilling MCP server at mcp.quickbilling.io and the emails we send.
It applies to three groups of people: QuickBilling users, people who receive invoices or estimates sent with QuickBilling, and visitors to our website.
The short version
- QuickBilling is operated by Solution Plus Tech Consultancy FZE, Sharjah Publishing City Free Zone, United Arab Emirates. Contact: info@quickbilling.io.
- We use your data to run QuickBilling: your account, your workspaces, the invoices, estimates, expenses and income you record, and the emails you send through us.
- When you send a document as a link, QuickBilling records when and how the recipient opens it. On paid plans this includes the recipient's IP address and, if the recipient allows it in their browser, their precise location. Section 4 explains this in full.
- If you use the in-app AI assistant, or connect an AI assistant or MCP client to QuickBilling, it can read and change your QuickBilling data on your instructions. The provider of the AI model handles that data under its own privacy policy. A QuickBilling app for ChatGPT is not available yet. Our tax features are not part of the ChatGPT app or the hosted MCP server; section 5 explains where they are available.
- We do not sell personal data, we do not use it for advertising, and we do not use your content to train AI models.
- Our servers and file storage are in Sweden (EU). Our database and email service are in the United States.
- You can export your data, delete your account, revoke share links, API keys and AI connections, and contact us to exercise any of your privacy rights.
1. Who we are
QuickBilling is a product of Solution Plus Tech Consultancy FZE, a company registered in the Sharjah Publishing City Free Zone, United Arab Emirates ("Solution Plus", "we", "us"). For the personal data described in this policy we are the data controller, except where section 2 says we act on behalf of our users.
Registered address: Business Center, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates. Privacy contact: info@quickbilling.io.
2. Our role: controller and processor
We decide how and why personal data is processed for user accounts, subscriptions, website visits, newsletter and waitlist sign-ups, and messages you send us. For that data we are the controller.
Our users also store data about their own clients in QuickBilling: customer records, invoices and estimates, and the activity recorded when a client opens a shared document. We process that data on our user's behalf and on their instructions, so the user who owns the workspace is the controller and we are their processor.
If you use QuickBilling for a business, you are responsible for having a legal basis for the client data you store and for telling your clients about it, including the document tracking described in section 4. If you need a data processing agreement, contact us at info@quickbilling.io.
3. Information we collect
3.1 Account and profile
- Your name, email address and password. Passwords are handled by our authentication provider and stored only in hashed form.
- If you sign in with Google, we receive your name, email address and profile picture from Google.
- Profile settings: profile picture, language and preferred currency.
- Workspaces you create or join: name, description, picture, colour theme, preferences, your role, who invited you and when you joined. Invitations store the invitee's email address.
- How you found QuickBilling: when you sign up, we save with your account which button on our website you used, the first page of your visit on quickbilling.io, the website that referred you (the domain only, or "direct"), your page language and when this was captured. The website passes the button, first page, referring website and language to the app in the sign-up link; nothing is stored in your browser for this, and the app removes them from the address bar when it opens. They are kept as described for account and profile data in section 9.
3.2 Content you store in QuickBilling
- Billing profiles (the business that issues your documents): name and legal name, contact details, address, tax identifiers such as VAT or GST numbers, logo, default currency and payment terms.
- Payment details you add to your invoices, such as bank account holder, IBAN, SWIFT/BIC, account and routing numbers, or payment links.
- Customers: name, email address, contact person, phone, website, address and tax identifiers.
- Invoices and estimates: line items, amounts, dates, notes, terms, the recipients and message of the emails you send, reminder settings and payment status.
- Expenses, income and projects: vendors, amounts, dates, categories, tags, notes, budgets, recurring rules, and the receipts and attachments you upload.
- Templates, item libraries and activity logs that record who changed what in a workspace.
The content is yours. We use it only to provide the service to you.
3.3 Subscription and payment
Paid plans are sold through Stripe Checkout. You enter your card details directly with Stripe, and we never receive or store full card numbers. Stripe sends us your customer and subscription identifiers, plan, status, billing period and payment events, together with the billing name, email and address you gave Stripe.
3.4 Messages and sign-ups
- Contact form: your name, email address and message. These reach us as an email to info@quickbilling.io and are not stored in the QuickBilling database.
- Newsletter and payments waitlist: the email address you submit.
- Emails you send us and our replies.
3.5 Technical and usage data
- Server logs: for every request to our API we log the time, the address requested, the response, your IP address and your browser's user agent. Sign-in and sign-up attempts also log the email address used.
- Google Analytics on quickbilling.io and app.quickbilling.io (including shared document pages): pages viewed, referrer, approximate location, device and browser information, and page performance measurements. Google Analytics uses cookies (section 11).
- Google Analytics events for sign-up and first use: in the web app, Google Analytics receives an event when the sign-up page is viewed, when you start signing up, when you finish and when sign-up fails (only the kind of error, never its message), and when you create your first invoice. The events for viewing the sign-up page and for finishing sign-up also carry the source details from section 3.1 (button, first page, referring domain and language). On the website, if you accept analytics, Google Analytics also receives which sections of a page you view and how far you scroll.
- Error monitoring with Sentry in the web app, including shared document pages: when something breaks, we receive technical details about the error, your browser and device, and your IP address. In the web app, Sentry also records a replay of about one in five of your sessions, and of every session in which an error occurs; in these replays, text and form input are masked and images are blocked.
- Error monitoring with Sentry on the website quickbilling.io, for all visitors: when something breaks, we receive technical details about the error, the page you were on, your browser and device, and page performance measurements. We have set Sentry up on the website not to collect your IP address; as with any web request, Sentry's servers still receive your IP address in the connection that delivers the report. If you accept analytics in the cookie banner, Sentry also records a replay of about one in five of your visits to the website, and of every visit in which an error occurs; text and form input are masked and images are blocked. Without your consent, or after you withdraw it, no replay is recorded.
- In the web app at app.quickbilling.io, fonts are loaded from Google Fonts, so your browser sends your IP address to Google when it loads those pages. The website quickbilling.io serves its fonts itself.
3.6 API keys and connected AI assistants
API keys (Unlimited plan) are stored hashed, together with an encrypted copy so that you can view a key again, its scopes, expiry date and when it was last used. When you connect an AI assistant or MCP client (or, once it is available, ChatGPT), we record the authorisation you grant. Section 5 describes what passes through these connections.
4. Information about people who receive invoices and estimates
This section is for anyone who has received an invoice or estimate sent with QuickBilling, and for users who want to know what the tracking features record. The business that sent the document is responsible for this data. We process it on that business's behalf.
4.1 When you open a shared document
Documents can be shared as a link (app.quickbilling.io/share/…). Anyone who has the link can open the document until the sender revokes the link or deletes the document. Each time the link is opened, we record:
- the date and time, and a per-visit session identifier;
- your IP address, and the country, region and city derived from it (we send the IP address to the geolocation service ipapi.co for this lookup);
- your browser, operating system, device type and the referring page;
- what you do on the page: time spent, downloading the PDF, copying or forwarding the link, clicking the sender's email address, and scrolling to the end;
- any response you give: marking the document as paid, or accepting or declining it, with your remarks. The sender is notified of your response by email.
4.2 Precise location, only with your permission
The shared document page asks your browser for your location. Your browser shows a permission prompt. If you allow it, we record your latitude and longitude, the accuracy of the reading and its time. If you decline, no precise location is recorded and the document still opens normally.
4.3 When a document is sent to you by email
We store your email address, whether you were a To, Cc or Bcc recipient, and the message's delivery status where our email provider reports it. The email contains a small image that tells us when it is opened, and opening it records your IP address and email client. You can prevent this by turning off automatic image loading in your email program.
4.4 Who sees this information
The sender sees this activity in QuickBilling. On the Free plan they see only whether and when the document was viewed and how many times. On paid plans they see the full details, including IP address, approximate location and, where you allowed it, precise location. They can also export this data.
Shared document pages also load Google Analytics and Sentry error monitoring (section 3.5).
To exercise your rights over this data, contact the business that sent you the document. You can also write to info@quickbilling.io and we will help, or pass your request to that business.
5. AI assistants and connected apps
We do not use your content to train AI models. Your data reaches an AI model in three cases only: when you use the in-app assistant, when you connect an assistant or MCP client yourself, and when you use a feature that reads what you upload with AI (described below).
Some features use AI to read and organise what you upload, such as bank statements and receipts. To do this, the relevant content is sent to our AI service providers so that the feature can work. For PDF bank statements we ask you first, and account and card numbers are hidden before the text is sent. We do not sell your data, we do not use it for advertising, and we do not share it with anyone else.
5.1 The in-app AI assistant
The AI assistant is a chat panel inside QuickBilling, available on every plan, with a daily message limit. To apply that limit we store how many messages you send each day. It can look up your data and prepare invoices, estimates, expenses, customers and reports on your instructions. It asks for your approval before it edits, deletes or sends anything. When you ask, it can also use the tax features, such as the tax profile, the VAT position and tax-year drafts.
To answer a request, your messages and the QuickBilling data the assistant looks up (which can include customers with their contact details, invoices and expenses in the workspaces you can access) are sent to the provider of the AI model, which handles them under its own terms and privacy policy. We do not control that processing. If you add your own AI provider key, we store it encrypted, and your messages and the data the assistant looks up go to that provider under your account with it.
- The assistant works only with the workspaces and permissions your account already has.
- You can stop using it at any time; nothing is sent to the AI provider unless you use the assistant.
5.2 The hosted MCP server, Claude Desktop and ChatGPT
When you connect an MCP client such as Claude Desktop or Cursor to our hosted MCP server at mcp.quickbilling.io, you sign in to QuickBilling and approve the connection on our consent screen. The client then receives an access token that lets it act on your account. The connection asks for the openid, email and profile scopes, which identify you by your user ID, name and email address.
While connected, the client calls QuickBilling tools in response to your requests. Each call fetches only what that request needs, but the results can include anything in the workspaces you can access: customers with their contact details and tax identifiers, billing profiles including bank details, invoices and estimates, expenses, income, projects and reports.
The client can also make changes on your instructions: create, update or delete customers, invoices, estimates, expenses, income and projects; send an invoice to your customer by email; create or revoke share links (previewing an invoice creates one); and, where the client supports it, attach a file you upload to an expense as a receipt. Team administration, account data export, subscription management and logo or avatar uploads are not available through the MCP server.
Our tax features are not available through the hosted MCP server, and they will not be part of the QuickBilling app for ChatGPT. These are the tax profile, the VAT position and VAT return previews, tax presets and VAT number checks, tax-year drafts and year-end checklists, and US tax records. ChatGPT and clients connected to mcp.quickbilling.io therefore do not receive them. The invoices, expenses and other records listed above, including the VAT amounts and tax identifiers recorded on them, remain available to a connected client, as do the financial reports, such as profit and loss, which show VAT collected and VAT paid, and the expense reports, including the report of expenses you marked as tax-deductible.
The provider of the assistant or client you use, such as Anthropic for Claude, handles what it receives under its own terms and privacy policy, and we do not control that processing. A QuickBilling app for ChatGPT is not available yet. Once it is available and you connect it, the same applies, with OpenAI as the provider.
- Our MCP server at mcp.quickbilling.io does not store your access tokens. Sign-in tokens are issued by our authentication provider (Supabase). Access tokens expire after one hour, and your client renews them until you disconnect.
- The MCP server keeps your selected workspace in memory for up to 30 days. Its logs identify you only by a shortened one-way hash of your user ID.
- To disconnect, remove QuickBilling in the settings of your assistant or MCP client. You can also ask us to revoke the connection on our side.
5.3 Other assistants and the API
Our open-source MCP server package and the REST API let you connect other AI tools, such as Claude Desktop or Cursor, using an API key. The MCP server package runs on your own computer, and it also offers the tax features listed in section 5.2. You decide whether to set it up and which AI client receives the data. Whatever data you or your assistant fetch is then handled by the AI provider you chose, under its terms. You can revoke an API key at any time in your workspace settings.
6. How we use information, and our legal bases
If the EU or UK General Data Protection Regulation (GDPR) applies to you, we rely on the legal bases below.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and run your account and workspaces, store your content, generate PDFs, send the emails you ask us to send | Account, profile, content | Contract (Art. 6(1)(b)) |
| Account emails: activation, password reset, invitations, payment reminders you schedule, notifications of recipient responses | Account, content | Contract (Art. 6(1)(b)) |
| Sell and manage subscriptions; keep billing and tax records | Subscription and payment data | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Document tracking for senders | Recipient data (section 4) | Processed for our user, who determines the basis. Precise location is collected only with the recipient's browser permission |
| Connect AI assistants and the API at your request | Data the assistant requests | Contract (Art. 6(1)(b)) |
| Keep the service secure, prevent fraud and abuse, enforce rate limits | Logs, IP address, account data | Legitimate interests (Art. 6(1)(f)) |
| Find and fix errors | Error and session-replay data | Legitimate interests (Art. 6(1)(f)) |
| Understand how the website and app are used, and improve them | Analytics data | Legitimate interests (Art. 6(1)(f)), or consent where the law requires it for cookies |
| Answer your messages and support requests | Messages, account data | Contract or steps before a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Send the newsletter and payments-feature updates you signed up for | Email address | Consent (Art. 6(1)(a)) |
| Comply with the law and defend legal claims | Any relevant data | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
7. Who we share information with
We do not sell personal data, and we do not share it for advertising. We disclose it only to:
- Service providers that run parts of QuickBilling for us (the table below). They may use the data only to provide their service to us.
- People you choose to share with: the clients you send documents to, anyone who has a share link you created, and the members of your workspaces.
- AI assistants you connect yourself (section 5). Their providers, such as Anthropic or, once it is available, OpenAI, are not our service providers; they receive data at your direction.
- Senders of documents, who see recipient activity (section 4).
- Authorities, courts or other parties, when the law requires it or when it is needed to protect our rights, our users or the public.
- A buyer or successor, if QuickBilling or Solution Plus is sold or reorganised. This policy would continue to apply to your data.
| Provider | What it does for us | Where the data is |
|---|---|---|
| Amazon Web Services | Servers for the website, app, API and MCP server; storage of uploaded files (logos, avatars, receipts, attachments); sending email | Sweden (EU) for servers and files; United States for email |
| Supabase, Inc. | Database and authentication, including sign-in for the MCP server | United States |
| Stripe | Subscription checkout, card payments and the billing portal | United States and other Stripe locations |
| Google Analytics, Google sign-in if you use it, and Google Fonts in the web app | United States and other Google locations | |
| Functional Software, Inc. (Sentry) | Error monitoring and session replays in the web app and on the website (on the website, replays only with your consent) | Germany (EU) and United States |
| Kloudend, Inc. (ipapi.co) | Looking up the approximate location of a document recipient's IP address | United States |
AI model providers: to run the in-app assistant and the features that read what you upload (for example bank statements and receipts).
8. International transfers
We are based in the United Arab Emirates, our servers and files are in Sweden, and our database and email provider are in the United States. Your data is therefore transferred to and processed in countries other than your own, which may have different data protection laws.
For transfers of personal data from the EU, the UK or Switzerland, we rely on an adequacy decision where one exists (for example, the EU-US Data Privacy Framework for certified providers), or on the European Commission's Standard Contractual Clauses included in our providers' data processing terms.
9. How long we keep information
| Data | How long |
|---|---|
| Account and profile | While your account exists. Deleted from our database when you delete your account. |
| Workspace content (customers, documents, expenses, income, projects) | Until you delete it, the workspace or your account. We never delete it automatically, because you may need it for your own tax records. |
| Uploaded files (logos, avatars, receipts, attachments) | Until you delete them or your account. Files of a deleted workspace are removed when you delete your account, or earlier if you ask us. |
| Document recipient activity (section 4) | As long as the related document exists. Deleted with the document, the workspace or the account. |
| Share links | Active until the sender revokes them or deletes the document. |
| Email open-tracking images | Stop recording after 90 days. |
| Workspace invitations | Invitation links expire after 7 days. |
| Subscription records | Our copy is deleted with your account. Stripe keeps payment and invoice records for the periods the law requires of it. Where we must keep billing records for tax or accounting purposes, we keep them for up to 7 years. |
| Contact form messages and support emails | Up to 3 years after our last exchange, unless we need them longer for a legal claim. |
| Newsletter and payments waitlist | Until you ask us to remove you. These lists are separate from your account and are not removed automatically when you delete it. |
| Server logs | Up to 90 days. |
| Error monitoring (Sentry) | Up to 90 days. |
| Google Analytics | Event-level data up to 14 months. Aggregated reports, which do not identify you, may be kept longer. |
| MCP server connections | Access tokens expire after 1 hour; the connection lasts until you disconnect. Workspace selection on the MCP server: up to 30 days, in memory only. |
10. Your rights and choices
10.1 Controls in QuickBilling
- Edit your profile, workspaces and content at any time.
- Export your account data as a JSON file from your Profile page (profile, workspaces, billing profiles, customers, invoices and estimates). Invoices, reports and customer statements can also be exported as CSV. For data not covered by these exports, such as expenses, income or projects, email us.
- Delete your account from your Profile page. This permanently deletes your profile, the workspaces you own and their content, your memberships and your API keys.
- Revoke share links, delete documents, and revoke API keys.
- Disconnect an AI assistant or MCP client in that app's settings.
- Unsubscribe from the newsletter or the payments waitlist by emailing info@quickbilling.io.
- Decline the browser location prompt on shared documents, and block remote images in your email program to stop open tracking.
- Block or delete cookies in your browser, or install Google's opt-out add-on (tools.google.com/dlpage/gaoptout) to stop Google Analytics.
10.2 Your rights under the GDPR (EU, EEA and UK)
You have the right to access your personal data, have it corrected, have it erased, restrict its processing, receive it in a portable format, and object to processing based on legitimate interests. Where we rely on your consent, you can withdraw it at any time without affecting earlier processing. You can also complain to the data protection authority where you live or work.
10.3 Your rights under UAE law
Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you may request information about the processing of your data, and its correction, erasure or restriction, and you may object to certain processing. You can complain to the UAE Data Office.
10.4 United States residents
Depending on your state, you may have the right to know what personal information we hold about you, to correct or delete it, and to obtain a copy. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. We will not treat you differently for exercising these rights.
10.5 How to make a request
Email info@quickbilling.io from the address linked to your account, or tell us how we can verify your identity. We answer within one month. If a request is complex, we may extend this by up to two further months and will tell you why. If we process your data on behalf of a QuickBilling user (sections 2 and 4), we will pass your request to that user or help them answer it.
11. Cookies and browser storage
Our own code does not set cookies. Google Analytics sets cookies on our website and app. We also use your browser's local and session storage for features that need it.
| Name | Type and site | Purpose | Duration |
|---|---|---|---|
| _ga, _ga_<ID> | Cookie, set by Google Analytics on quickbilling.io and app.quickbilling.io | Distinguishes visitors and sessions for analytics | Up to 2 years |
| sb-…-auth-token | Local storage, app | Keeps you signed in | Until you sign out |
| currentWorkspaceId, qb_language, quickbilling-theme, quickbilling:invoice-tabs:v2, quickbilling:sidebar-collapsed | Local storage, app | Remembers your workspace, language, theme and layout | Until you clear them |
| qb_share_session | Session storage, shared document pages | Groups one visit to a shared document into a single session | Until the tab is closed |
| qb:create-draft-lock, sentryReplaySession | Session storage, app | Prevents duplicate drafts; links a session replay to one browsing session | Until the tab is closed |
| sentryReplaySession | Session storage, quickbilling.io, only after you accept analytics | Links a session replay to one browsing session | Until the tab is closed |
| i18nextLng, qb:vite-preload-reload | Local and session storage, quickbilling.io | Remembers your language; recovers from a failed page update | Until cleared, or until the tab is closed |
| qb:consent | Local storage, quickbilling.io | Remembers your choice about analytics | Until you clear it |
12. Security
- All connections to our website, app, API and MCP server are encrypted with HTTPS.
- Our database and file storage providers encrypt stored data at rest.
- Passwords are stored hashed by our authentication provider. API keys are stored hashed, and a separate copy that lets you view the key again is encrypted with AES-256-GCM.
- Every API request is checked against your workspace membership and role. Sign-in, password reset and share-link requests are rate limited.
- Uploaded receipts and attachments are delivered through signed links that expire after a few minutes. Logos and profile pictures can be viewed by anyone with their address, because they appear on the documents you share.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the competent authorities where the law requires it.
13. Children
QuickBilling is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
14. Third-party websites and services
Our pages link to other websites, and you can use QuickBilling together with services such as Stripe, Google sign-in and AI assistants. Those services have their own privacy policies, and we are not responsible for how they handle your data.
15. Changes to this policy
We will update this policy when our practices change, for example before we launch a feature that processes personal data in a new way. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect.
This policy is also available in German, French and Spanish. If the versions differ, the English version applies.
16. Contact us
Questions about this policy, or requests about your data:
Solution Plus Tech Consultancy FZE (QuickBilling)
Business Center, Sharjah Publishing City Free Zone
Sharjah, United Arab Emirates
Email: info@quickbilling.io
Website: quickbilling.io