The short version

What you type onto an invoice is stored so that you can print it again, find it later, and issue a receipt against it. That is the whole reason it is kept.
There is no advertising. If you press Accept on the cookie notice, Google Analytics runs on the pages a stranger reads before signing up — the home page, the free document pages (invoice, quotation, receipt, cash bill, tax invoice, delivery note), sign in and sign up — so we can see how people find BillTrove. Press Decline and it never loads. Once you are signed in, your browser loads nothing from anyone else: no analytics, no tracking of any kind, on any page behind your account.
Your details and your customers' details are never sold, rented, or shared for marketing.
Delete your account and it goes — the business, the customers, the documents, and the logo you uploaded.

Who you are dealing with

BillTrove, 417/60, Moo 9, Nongprue, Banglamung, Chonburi 20150, Thailand. Email billtrove.services@gmail.com. Under Thailand's Personal Data Protection Act, we are the data controller for what you put into the app.

What is stored

Your account — your name, your email address, and your password. The password is stored scrambled, so nobody at BillTrove can read it, not even to help you.
Your business — name, type of business, address, phone, email, tax ID, whether you are a head office or a branch, your footer note, and the logo file if you upload one.
The payment details you want printed — bank name, account name, account number, PromptPay number. These go onto your paperwork. BillTrove never uses them to move money.
Your customers — whatever you type about them: name, address, phone, email, tax ID.
Your paperwork — items, quantities, prices, VAT, dates, notes, and the payments you record against an invoice. When you issue a document, an unchangeable copy of it is stored. That is what makes a tax invoice a tax invoice, and it is why an issued document cannot be edited afterwards.
Suggestions you send us — the message you write in the "Tell us what to improve" box, and, if you are not signed in and choose to leave one, the email or LINE ID we should reply to. If you are signed in, it is kept with your account. It is read by the people running BillTrove and by nobody else. To have one removed, email us.
Technical records — your IP address and browser type in the session that keeps you signed in, and the web server's ordinary log of requests.
The country a document was made in — worked out from your IP address at the moment you make it, and kept as a country and nothing finer. It tells us which countries BillTrove is used in. The same lookup, kept nowhere, decides whether the English pages offer Thai-only things such as 7% VAT and the Thai tax invoice — the pages under /th/ always do. The IP itself is not stored against the document, the lookup runs on our own server without asking anyone else, and it is never used to identify you.

Using it without an account

Quick Invoice and Quotation work without signing up. What you make is stored against an anonymous token held in your browser session — there is no name or email attached to it. If you sign up or log in afterwards in that browser, it moves to that account. If you never do, it stays with nobody's name on it.

What is not done

No advertising, no tracking pixels, no social buttons that report back, and nothing that follows you to other websites. Google Analytics on the public pages (below) is the one exception.
Once you are signed in, nothing on the page is loaded from another company's server, so no third party is told what you did in your account. This is checked by an automated test, not just promised.
Your documents are not read, mined, or used to train anything.
Nothing is sold or handed to anyone for marketing.

Google Analytics

Runs only if you press Accept on the cookie notice, and only on the pages a stranger can reach without signing in — the home page, the free document pages (invoice, quotation, receipt, cash bill, tax invoice, delivery note), the sign-in and sign-up pages, and this page — so we can see roughly how many people visit, how they found BillTrove, how many visits end in a document being made, and how many in signing up. Each of those is a single event: one when a document is saved without an account, saying only which page it was made on; one the moment an account is made, on the sign-up page, saying only whether a document was made first and which "Create free account" link was pressed. It stops the moment you sign in: the dashboard, your invoices, your customers, your settings, none of it is measured by Google or anyone else. Google Analytics sees an anonymised visit, not your name, your business, or anything you typed into a document.

Cookies

Six. Three are needed to run the app: the session cookie that keeps you signed in and remembers which language you chose, the security token that stops another website submitting forms as you, and one that remembers your answer to the cookie notice for 180 days. The fourth is Google Analytics' cookie, set only if you pressed Accept, only on the public pages above and only if you have not signed in — it is what lets Google Analytics tell a new visitor from a returning one. Change your answer any time with "Cookie settings" at the foot of any public page; if you decline, the Google Analytics cookie is deleted. The fifth is set only when you answer or close the "Tell us what to improve" box after saving a document: it holds nothing but the number 1, and it stops that box asking you again for 60 days. The sixth is set only if you change the currency on a document page without signing in: it holds just the currency's three-letter code (like USD), so your next document starts in it, and it lasts a year.

Where it is kept

In a PostgreSQL database on a server in Singapore, rented from DigitalOcean. The connection between your browser and that server is encrypted.

Who else can see it

DigitalOcean, as the company that runs the server the app sits on.
Resend, which delivers the "forgot password" email — your email address and that one reset link pass through it.
Google Analytics, only if you accepted it on the cookie notice, have not signed in, and are on the pages listed above — see Google Analytics and Cookies.
Anyone you give a share link to. A shared document link is signed and stops working after 90 days, but while it works, whoever holds it can open that document. Treat the link like the document itself.
Nobody else, unless the law requires it.

How long it is kept

For as long as your account exists. Nothing is deleted automatically — a five-year-old invoice is still there, because that is usually what a business needs. Sign-in sessions expire on their own.

Deleting it

One document: Invoices → Delete. A draft, a quotation, a delivery note, or an invoice with no payment recorded can be deleted, and it is gone at once — the document, its lines and its stored copy; its number is not used again. Receipts and issued Thai tax invoices cannot be deleted: they are the record that money changed hands or that VAT was charged. Everything: Profile → Delete Account. It asks for your password, then removes the account, the business, the customers, the documents, the recorded payments, the suggestions you sent us and the logo file. It cannot be undone, so print or download anything you want to keep first.

Your rights

Under Thailand's Personal Data Protection Act you can ask what is held about you, ask for it to be corrected, ask for a copy, and ask for it to be deleted. Most of that you can do yourself inside the app. For anything else, email billtrove.services@gmail.com and you will get an answer within 30 days.

Security

Passwords are hashed, the connection is encrypted, and the server's configuration file is not reachable from the web. No system is perfect: use a password you do not use anywhere else, and tell us straight away if something looks wrong with your account.

Changes to this page

If this page changes, the date at the top changes with it. If a change actually affects what happens to your data, you will be told inside the app rather than left to notice.