Privacy policy

eBillStack is a product of Vicam Consulting LLC (“we”, “us”).

1. Introduction

This policy explains what information eBillStack collects, how we use it, who we share it with and how long we keep it. It covers this website, the eBillStack app, the client portal, the REST API and the MCP server.

2. Information we collect

• Account information: your name, email address and password. We store passwords hashed.
• Security details: if you turn on two-factor authentication or passkeys, we store what’s needed to check them, with secrets encrypted. API tokens are stored hashed.
• Workspace data: what you and your team enter, including members and their roles, pay rates and bill rates, time entries and timers, projects and tasks, clients and their contacts, invoices, estimates, credit notes, payments received, expenses and receipt files, supplier bills, pay runs, pay statements and payments recorded as sent.
• Client portal users: the name and email address of each client contact you invite, and records of their sign-ins.
• Billing information: your plan, the number of people on it and your billing history. Stripe processes card details; we never see or store your full card number.
• Connected accounts: if you turn on Pay online, the Stripe keys you enter for your own Stripe account, and the status and amount of each payment your clients make. If you import from Elorus, your Elorus API key and the data we read from Elorus. These keys are stored encrypted.
• Activity and usage data: a record of changes made in your workspace, and technical details such as IP address, browser type and access times.

3. How we use your information

• To provide and maintain eBillStack, and to improve it.
• To send the emails the Service needs, such as invitations, sign-in links, invoices and statements you send to clients, payment reminders you set up and notifications.
• To bill you for the Paid plan.
• To answer your questions and support requests.
• To keep the Service and your data secure, and to detect and prevent fraud and abuse.
• To meet our legal obligations.

4. Data storage and security

Data is encrypted in transit. Stored secrets, such as Stripe and Elorus keys and two-factor secrets, are encrypted. Receipts, statements and other private files are only available to people allowed to see them. Access to production systems is restricted to the people who run the Service.

5. Data sharing

We don’t sell your personal data. We share it only in these cases:

• Within your workspace: people in your workspace see what their role allows.
• With your clients: client contacts you invite to the portal see that client’s documents, and the people you send invoices or statements to receive them.
• Stripe: for Paid plan billing. If you turn on Pay online, your clients’ payments go through your own Stripe account, under your agreement with Stripe.
• Service providers: we use third parties for email delivery and for hosting and storing the Service. They process data only to provide their service to us.
• Your integrations: if you add webhooks or connect tools with an API token, data is sent to the endpoints and tools you choose. Importing from Elorus sends your API key to Elorus so we can read your account.
• Legal requirements: we may disclose information when the law, a regulation or a legal process requires it.

6. Data retention

We keep your account and workspace data while your account is open. Cancelling the Paid plan or downgrading to Free doesn’t delete any data.

To have your account or workspace deleted, email us. We may keep some records after deletion where we need them for billing and tax, to resolve disputes, to prevent fraud or to meet other legal obligations.

7. Your choices and rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong.
• Have your data deleted.
• Get a copy of your data in a portable format. Workspace data can also be exported as CSV from the app.
• Object to or restrict some processing of your data.

If your data is in someone else’s workspace, for example as a member of their team or as one of their clients’ contacts, that business decides what it holds about you. Contact them first; we’ll help them respond.

8. Cookies and analytics

We use essential cookies to keep you signed in and to remember your preferences. The client portal uses its own sign-in cookie. We don’t use advertising or tracking cookies, and this website has no analytics.

9. Children

eBillStack is for businesses and isn’t meant for anyone under 18. We don’t knowingly collect information from children.

10. Changes to this policy

We may update this policy. We’ll tell you about significant changes by email or in the app before they take effect.

11. Contact

Questions about this policy or your data? Email hello@ebillstack.com.