Privacy Policy

Effective and last updated: November 15, 2026

This Privacy Policy explains how AppBill, Inc. (“AppBill,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you visit app-bill.us.com, contact us, or use our expense, card, and budget management services (together, the “Services”). It also explains your privacy rights and choices.

This Policy does not cover third-party services that have their own privacy practices, including your employer, card issuer, accounting provider, or bank. If your employer provides your AppBill account, its policies and instructions also apply.

1. Who is responsible for your information

For information collected through our public website, sales activities, and direct customer relationships, AppBill is the controller or business responsible for that information. For expense records, receipts, card activity, and other information a customer uploads to its workspace, the customer is generally the controller or business and AppBill acts as its processor or service provider. Our agreement with the customer governs that processing.

2. Information we collect

Information you provide

• Contact and account details: name, work email, employer, role, phone number if provided, login identifiers, and authentication information.
• Business spend records: transaction details, receipts, business purposes, categories, budgets, approval notes, reimbursement details, and related attachments.
• Communications: sales enquiries, support requests, survey responses, security-review correspondence, and your communication preferences.
• Billing and contract details: billing contact, subscription plan, invoices, and transaction history. Full payment card details used to pay subscription invoices are handled by our payment provider rather than stored directly by AppBill.

Information collected automatically

When you use the Services, we may collect IP address, device and browser type, operating system, language, approximate region derived from IP, pages or features used, timestamps, referring URLs, diagnostic logs, and security events. Our public website stores your theme and consent choices locally. Optional analytics operate only where enabled and with any consent required by law.

Information from others

We receive information from your employer or workspace administrator, card program partners, accounting integrations, identity providers, service providers, and public business sources. If you connect an integration, the information we receive depends on your settings and that provider’s terms.

Please do not place full payment card numbers, government identity numbers, health information, or unrelated sensitive personal information in free-text fields or receipts. If a receipt contains such information incidentally, restrict access and retain it only as needed.

3. How we use information

We use personal information to:

• provide, maintain, secure, and improve the Services;
• create accounts, authenticate users, and enforce workspace permissions;
• process expenses, match receipts, apply customer-configured controls, and produce exports;
• respond to enquiries, provide support, and communicate service changes;
• manage subscriptions, billing, contracts, and customer relationships;
• detect fraud, abuse, security incidents, and violations of our terms;
• understand service performance and develop useful features;
• comply with law, establish legal claims, and enforce our agreements; and
• send relevant marketing where permitted, with the ability to opt out at any time.

We do not sell personal information for money. We do not use customer workspace content to train general-purpose artificial intelligence models unless a customer separately agrees in writing.

4. Legal bases for EEA and UK processing

Where the GDPR or UK GDPR applies, our legal bases include: performance of a contract when we provide the Services; legitimate interests in securing, improving, and marketing our business, balanced against your rights; compliance with legal obligations; and consent where required, such as for certain optional cookies. You may withdraw consent without affecting earlier lawful processing.

5. When we disclose information

We may disclose information to:

• Your organization and its administrators, according to workspace roles and settings;
• Service providers and subprocessors that support hosting, storage, communications, analytics, payment processing, customer support, and security, subject to contractual limits;
• Card, banking, identity, and accounting partners when you choose or your organization configures those services;
• Professional advisers and authorities where needed for legal compliance, protection of rights, fraud prevention, or safety; and
• A successor in a merger, financing, reorganization, or sale, subject to appropriate confidentiality and notice where required.

We may share aggregated or de-identified information that cannot reasonably be used to identify a person. We require service providers to use personal information only for the services they provide to us and to protect it appropriately.

6. International transfers

AppBill is based in the United States, and information may be processed in the United States and other countries where we or our providers operate. These countries may have different data protection laws. Where required, we use recognized transfer mechanisms such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, and supplementary safeguards. You may contact us for more information about applicable transfer safeguards.

7. Retention

We keep information only as long as reasonably necessary for the purposes described above, including the duration of an account, our agreement with a customer, legal retention requirements, security, dispute resolution, and backup cycles. Customer workspace retention is also affected by the customer’s settings and instructions. When information is no longer required, we delete it, anonymize it, or securely isolate it until deletion is possible.

Public website consent records remain in your browser until you clear site data. Contact emails are retained as needed to respond and maintain an appropriate business record.

8. Security

We use administrative, technical, and physical safeguards designed for the nature of the information we handle, including encrypted connections, access controls, authentication protections, logging, and operational review. No online service can guarantee absolute security. Notify us at [email protected] if you suspect unauthorized access. Customers should also protect credentials, use appropriate roles, and remove access promptly when personnel change.

9. Your rights and choices

Depending on where you live, you may have the right to request access, correction, deletion, portability, restriction, or objection; withdraw consent; opt out of targeted advertising, sale, or certain profiling; and appeal a denied request. You also have the right to complain to your local data protection authority.

Submit a request to [email protected]. We may verify your identity and authority before acting. Authorized agents may submit requests where local law allows, subject to proof of authorization. We will not discriminate against you for exercising privacy rights.

If your information sits in an employer’s workspace, we may refer you to that organization because it controls the record. You can unsubscribe from marketing through the link in our emails. Service and security notices are not marketing and may still be sent.

U.S. state privacy notices

Where state law applies, you may request confirmation of processing and a list of categories or specific third parties to whom information was disclosed, as required. Our categories of collected information and recipients are described above. We do not sell personal information for money or knowingly share it for cross-context behavioral advertising. If our practices change, we will provide any required notice and opt-out mechanism.

10. Children’s information

The Services are for business users and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided information, contact us so we can investigate and delete it where appropriate.

11. Changes to this Policy

We may update this Policy as our Services or legal obligations change. We will post the revised version with a new effective date. For material changes, we will provide additional notice where required, such as by email or an in-product message.

12. Contact us

If you are in the EEA or UK and have an unresolved concern, you may contact your local data protection authority. We would appreciate the opportunity to address your concern first.