BillFlow Ai

BillFlow AiDiscovery House, 5 Barling Way, Nuneaton CV10 7RH, United KingdomGoogle profile

Privacy

Privacy

BillFlow Ai processes supplier invoices that you upload or forward so draft bills can be prepared for Xero.

Who is responsible

The data controller is Benjamin Barber, operator of BillFlow Ai, Discovery House, 5 Barling Way, Nuneaton CV10 7RH, United Kingdom. BillFlow Ai is not registered at Companies House and is not VAT registered. Write to billflowai@gmail.com.

What we store

  • Account email and name
  • Your private inbound alias
  • Uploaded or forwarded invoice files
  • Extracted fields and supplier rules
  • Xero tenant id and organisation name
  • The OAuth refresh token, server-side only
  • Stripe customer and subscription ids

Account data is scoped to your signed-in user. We do not sell personal data.

What we send to Xero

Contacts as needed, ACCPAY bills with Status DRAFT, and the original PDF as an attachment. Nothing is authorised. No bank, no payments, no ACCREC.

What we receive from Xero

Organisation name, tenant id, and the contacts, accounts and tax rates needed to code a draft.

Processors

Hosting for the app; database and file storage for your account; Postmark for inbound mail; a server-side vision model for extraction; Stripe for the subscription; Xero for the ledger connection. We do not use your invoices to train public models.

Lawful basis

Contract for the service. Legitimate interests for security logs. Consent is not required for the core pipe. UK GDPR and the Data Protection Act 2018 apply.

Retention and deletion

Invoices and drafts are kept while the account is open. Write from the registered email to billflowai@gmail.com or use /contact and we will delete the account and revoke the Xero connection.

You can also use the support page.

Tokens

Xero access and refresh tokens are never shown in the browser. The client secret is never placed in frontend (`VITE_`) variables. Tokens are used only to create contacts and ACCPAY draft bills on your behalf.

Analytics

Public pages and the signed-in app use Google Analytics 4 (measurement ID G-VLVVSHS190). IP addresses are anonymised (`anonymize_ip`). You can opt out with a browser add-on such as Google Analytics Opt-out.

Your rights

Access, correction and deletion. There is no ICO registration number. For a subject-access or deletion request, write from the registered address to billflowai@gmail.com.