Privacy Policy

Last updated: November 2026

QuietBill (QuietBill, a registered trade name of a Dutch sole proprietorship (eenmanszaak), Beeklaan 38, 4702JL Roosendaal, Netherlands, KvK 97282812; "QuietBill", "we", "us") helps small businesses track software subscriptions and catch auto-renewal deadlines. This policy explains what we collect, why, and your choices. Questions about your data or our DPA: dpa@quietbill.com.

What we collect

• Account data: your name, email, hashed password, and workspace details.
• Documents you send us: receipts, invoices, welcome emails, and contracts you forward, upload, or that we retrieve from a connected mailbox.
• Extracted data: vendor, amount, billing cycle, dates, seats, and the auto-renewal clause text derived from those documents.
• Billing data: handled by Stripe. We store a Stripe customer identifier and plan status, never your card number.
• Usage and diagnostics: logs and error reports needed to run and secure the service.

Connected mailboxes (Gmail / Outlook)

If you connect a mailbox, we request read-only access and use it solely to find receipt-like messages and import them. We cannot send, delete, or modify your mail. We only fetch messages that match receipt criteria, not your entire inbox. Your refresh token is encrypted at rest. You can disconnect at any time, which stops all future access. Our use of information from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use your data

To provide the service: parse documents, build your dashboard, compute cancellation deadlines, and send you alerts. We use the Claude API (Anthropic) to extract structured data from your documents. We do not sell your data and we do not use your documents to train third-party models.

Subprocessors

We share data with vendors only as needed to run QuietBill: Anthropic (AI extraction), Resend (email), Stripe (billing), Hetzner (hosting), Backblaze (encrypted backups), and Sentry (error monitoring). Each processes data on our behalf under their terms.

Retention

We retain your documents and extracted data while your account is active so we can re-process and improve accuracy. You can delete your account, together with every workspace you own, from Settings at any time; this removes the data immediately and cancels any paid plan. You can also request deletion at dpa@quietbill.com; we will delete your data within 30 days. Backups age out on their normal cycle.

Security

Traffic is served over HTTPS. Passwords are salted and hashed; session and reset tokens are stored only as hashes; OAuth refresh tokens are encrypted with AES-256-GCM. Access is scoped to your workspace. Report a vulnerability to security@quietbill.com.

Your rights

Depending on where you live (including under GDPR and CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. Contact dpa@quietbill.com or support@quietbill.com to exercise these rights; we respond within 30 days. You may also complain to your data protection authority (in the Netherlands: the Autoriteit Persoonsgegevens). If you are in the EEA/UK, our legal basis is performance of our contract with you and our legitimate interest in operating the service.

Anonymized vendor insights

To improve accuracy, we may derive aggregate, anonymized statistics about vendors' standard cancellation terms across customers. These aggregates never identify a customer and are only surfaced when enough distinct workspaces agree.

Cookies

We use a single essential, httpOnly session cookie to keep you logged in. We do not use advertising cookies.

Changes

We will post updates here and, for material changes, notify you by email.

Controller: QuietBill, a registered trade name of a Dutch sole proprietorship (eenmanszaak), Beeklaan 38, 4702JL Roosendaal, Netherlands, KvK 97282812. See company details.