Privacy Policy

LessBill ("we", "our", or "us") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have in relation to it.

This policy applies to all users of the LessBill website (lessbill.org) and application (app.lessbill.org). By using our services, you acknowledge that you have read and understood this policy.

1. What we collect

We collect personal data in the following categories:

Account data. When you create a LessBill account, we collect your name, email address, and a hashed password. If you choose to sign in via a third-party provider (such as Google), we receive your name and email address from that provider.

Billing and payment data. If you subscribe to a paid plan, payment details are processed by our payment provider (Stripe). We do not store your full card number or CVV. We retain records of transaction amounts, dates, and plan details for accounting and support purposes.

Cloud cost and usage data. To provide our service, we access cloud billing and resource metadata from the cloud accounts you connect to LessBill. This includes service names, resource identifiers, region information, cost figures, and resource tags. We do not access the contents of your data stored in cloud services, and we do not require or accept write access to your cloud infrastructure.

Usage data. We collect information about how you interact with the LessBill application, including pages visited, features used, and actions taken. This data is used to improve the product and is not used to profile you for advertising purposes.

Technical data. We collect standard server log data including IP addresses, browser type, operating system, and referring URLs. This data is retained for security monitoring and troubleshooting.

Communications. If you contact us by email or through our contact form, we retain the content of that communication and any personal data included in it in order to respond and maintain a record of our support interactions.

2. How we use it

We use the data we collect for the following purposes:

• To provide and operate the service. Account data, cloud cost data, and usage data are used to authenticate you, deliver cost analysis and recommendations, and maintain the functionality of the application.
• To process payments. Billing data is used to manage subscriptions, issue invoices, and handle refunds and disputes.
• To improve the product. Aggregated and anonymized usage data helps us understand which features are most valuable and where we should invest development effort.
• To communicate with you. We may send you transactional emails (account setup, billing notifications, password resets) and, if you opt in, product updates and announcements. You can unsubscribe from marketing emails at any time.
• To ensure security and prevent fraud. Technical and usage data is used to detect abuse, investigate security incidents, and protect the integrity of the service.
• To comply with legal obligations. We retain certain records where required by applicable law, including financial records for tax and accounting purposes.

We do not sell your personal data to third parties. We do not use your data to serve you advertising.

3. Data storage and security

LessBill is hosted on Amazon Web Services (AWS) infrastructure located in the European Union (eu-west-1, Ireland) by default, with data processing that may also occur in the United States. If you are based in the European Economic Area (EEA), transfers to the United States are conducted under Standard Contractual Clauses approved by the European Commission.

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, loss, or destruction. These measures include encryption of data at rest using AES-256, encryption of data in transit using TLS 1.2 or higher, access controls limiting which employees can access customer data, and regular security reviews.

We retain personal data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (for example, financial records which we retain for seven years).

4. Third parties

We share personal data with a limited number of third-party service providers who help us operate the service. Each provider is bound by contractual data processing agreements and is only permitted to use your data as directed by us.

• Stripe - payment processing and subscription management
• Amazon Web Services - cloud infrastructure, hosting, and database services
• Postmark - transactional email delivery
• Sentry - error monitoring and application performance monitoring

We do not share your personal data with any other third parties without your explicit consent, except where required to comply with a legal obligation or court order.

5. Your rights

If you are located in the EEA, the United Kingdom, or another jurisdiction with applicable data protection law, you have the following rights in relation to your personal data:

• Right of access. You may request a copy of the personal data we hold about you at any time.
• Right to rectification. If any personal data we hold about you is inaccurate or incomplete, you may ask us to correct it. You can update most of your account information directly from your account settings.
• Right to erasure. You may request that we delete your personal data. We will action erasure requests within 30 days. Note that some data may need to be retained for legal compliance reasons.
• Right to restriction of processing. In certain circumstances, you may ask us to restrict how we process your data while we resolve a dispute or pending request.
• Right to data portability. You may request a copy of your data in a structured, machine-readable format. We can provide your account data and your cloud cost data in JSON format.
• Right to object. You may object to our processing of your personal data where we rely on legitimate interests as the legal basis for processing.
• Right to withdraw consent. Where we process data on the basis of your consent (for example, marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing before the withdrawal.
• Right to lodge a complaint. If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with your local supervisory authority. For users in Ireland, this is the Data Protection Commission (www.dataprotection.ie).

To exercise any of these rights, please contact us at hello@lessbill.org. We will respond to all legitimate requests within 30 days.

6. Contact

If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us:

LessBill
Email: hello@lessbill.org

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.