Privacy policy

1What you give us

When you create an account we ask for:

• Your name and email address. The email identifies your account, receives the verification code, and is where a password reset goes.
• A password, which is stored only as a hash. We cannot read it, and neither can anyone who obtains the database.
• A phone number, optionally. The field can be left blank and the service works the same without it.

We ask for nothing else at signup. No date of birth, no address, no identity document, no card details — the subscription is paid by bank transfer, so we never see a card.

2What you put in

Your business details, your customers, your products, and the documents you issue are yours. We store them so the service can show them back to you and print them on a document. We do not sell them, share them with anyone, or use them to train anything.

Some of that data is about other people — a customer's name, phone number or address. You decide what to enter, and in that data you are the controller and we handle it on your instructions. Enter what you need on an invoice and no more.

3What we collect automatically

We count how many people visit the public pages. To count people rather than page loads without identifying anyone, each visit is reduced to a one-way hash of the network address and browser, salted with a value that is generated fresh every day and deleted with it. The address itself is never written down, and because the salt changes daily the same person on two days produces two unrelated values. The rows are deleted after 45 days.

Errors are logged so we can fix them. An error record holds the message, where it happened, and which account was signed in — not the contents of your documents.

4Cookies

Bilufoiy sets a small number of cookies, all of them necessary for it to work, and none of them for advertising or analytics. They are listed on the cookies page.

5Who else is involved

Running the service means a few other companies handle data on our behalf:

• Cloudflare hosts the service and stores its database and files. It also provides the anti-bot check on the sign-up and sign-in forms, and delivers the email we send you.
• Google Fonts serves the typeface the site is set in. This means your browser requests a file from Google when a page loads.
• Telegram receives operational alerts we send ourselves — for example that a transfer was submitted. Messages you send through the chat button reach us this way.

There are no advertising networks, no social media pixels, and no third-party analytics on any page.

6How long we keep things

Your account and its data are kept while the account exists, including while it is unpaid and read-only — we do not delete a business's records because a subscription lapsed. Visitor counts are deleted after 45 days. If you close your account we delete its data; export first, because that step is not reversible.

7What you can ask for

You can export everything in your account at any time from Settings → Data & backup, in JSON and CSV, including while the account is read-only. You can correct anything by editing it. You can ask us to delete your account and its data by writing to the address below.

8Security

Traffic is encrypted in transit. Passwords are hashed. Access to the production data is limited to the people who run the service. No service can promise perfect security, and we do not: if something goes wrong that affects you, we will tell you.

—Who we are

Bilufoiy is operated by OfficeLab Pvt Ltd, in the Republic of Maldives.

• Registration number: C02972023
• Email: hello@bilufoiy.com