MyBillables Privacy Policy

Effective date: October 16, 2026

This Privacy Policy explains how Blair Software, LLC (“Blair Software”, “we”, “us”) collects, uses, and shares personal information through MyBillables, including mybillables.com, our web and native apps, our APIs, and our emails (together, the “Service”). Blair Software, LLC is the data controller collecting and managing the user data this policy covers.

The short version

We collect what we need to run the Service, and nothing to sell. We don’t sell or share personal information for advertising, and we don’t use customer data to train AI models.
The data your organization puts into MyBillables belongs to your organization. For that data, your organization decides how it’s used, and we process it on their behalf.
You can export your data at any time, and ask us to access, correct, or delete your information.

1. Two roles we play

When we process data for our customers (processor). Businesses (“Customers”) use MyBillables to track time, manage projects and clients, and send invoices. The information they and their team members put into an Organization (“Customer Data”) is controlled by the Customer. If you’re a team member of a Customer, or one of a Customer’s clients, the Customer is responsible for how your information is used. Please send requests about that data to the Customer. We’ll help them respond, as our agreement with them requires.

When we decide how data is used (controller). Blair Software, LLC is the data controller collecting and managing the user data covered by this policy that we collect for ourselves: account and sign-in details, billing information, website visitors, waitlist sign-ups, support conversations, and how the Service is used.

2. Information we collect

You give us

Account information: name, email address, password (stored only as a secure hash), and the Organizations you belong to.
Organization and profile details: company name, industry, currency, time zone, and your role.
Customer Data, entered by you or your team: time entries and notes, projects, tasks, rates, budgets, clients and their contacts, expenses and receipt images, invoices, and payments.
Billing information: billing contact and address. Card details are collected and stored by our payment provider, Stripe. We see only limited details, such as card brand and last four digits.
Waitlist sign-ups: your email address, and optionally the features you’re interested in and your comments.
Support and feedback: what you send us when you contact us.

Collected automatically

Device and log information: IP address, browser and device type, pages and API endpoints requested, timestamps, and error details, used to run, secure, and debug the Service. For each place you’re signed in, we keep the IP address and browser it signed in from and when it was last used, so you can see your sessions in your profile and sign out of any you don’t recognize.
Product usage events: which features are used and when, tied to your account and Organization. We design these events so they don’t contain personal details such as names, email addresses, or the contents of your entries.
Website analytics: on mybillables.com, and only if you allow analytics cookies, Google Analytics records the pages you visit, how you arrived, your approximate location (country or city), and your browser and device type. It also records that a waitlist sign-up happened, never your email address or comments. See §9.
Cookies: see §9.
Attribution: for website visitors and waitlist sign-ups, the referring page and campaign (utm_*) parameters in the link you followed.

From third parties, at your direction

Sign-in providers: if you sign in with Google (or, later, Microsoft), your name, email address, and whether the provider has verified it.
Imports and integrations: if your Organization imports data from Harvest or connects QuickBooks Online, a calendar, or another service, the data that service sends us on your Organization’s instruction. Access tokens for these services are encrypted.
Payment processors: if your Organization takes invoice payments through Stripe or PayPal, payment status and related details for those invoices.

3. How we use information

3.1 To provide the Service

To create and secure accounts, run Organizations, sync and import data, send the emails the Service needs (verification, password reset, invitations, invoices, reminders), process subscriptions, and provide support. Legal bases (EU/UK): performance of a contract, and our legitimate interest in running the Service for Customers.

3.2 To keep the Service safe and improve it

To detect and prevent fraud, abuse, and security incidents, to debug, and to understand which features work, using Usage Data and product events. Legal basis: legitimate interests.

3.3 The waitlist

If you join the waitlist, we use your email address to send one confirmation email, and later to tell you about early access and product updates related to the launch. We use your optional interests and comments, and the page and campaign you came from, to decide what to build and which channels work. If the confirmation email can’t be delivered, or you mark it as spam, we remove your sign-up. You can leave the waitlist at any time from the link in the confirmation email, or with your email app’s unsubscribe button, and we delete your sign-up when you do. Legal basis: consent, which you can withdraw at any time.

3.4 To communicate with you

To send service and billing notices, and, where the law allows or you agree, product news. You can unsubscribe from product news at any time. Service and security notices can’t be turned off while you have an account.

3.5 To meet legal obligations

To keep financial records, respond to lawful requests, and enforce our Terms.

What we don’t do: we don’t sell personal information, we don’t “share” it for cross-context behavioral advertising (as California law defines it), and we don’t use Customer Data to train foundation AI models. Optional AI features use model providers that don’t retain the data, and an Organization’s administrator can turn them off.

4. AI features

Optional AI features, such as suggested time entries, use your own signals (for example calendar events and project activity) to make suggestions only within your Organization. Learning from your choices is scoped to you and your Organization and is never used across Organizations. Suggestions are only drafts until you accept them.

We share personal information only:

Within your Organization: what you enter is visible to others in your Organization according to its roles and permissions. Invoices you send are shared with the clients you send them to.
With service providers (sub-processors) who process it for us under contracts that require them to protect it and use it only for us (§6).
With services you connect: when you or your Organization connects a third-party service, we send it what’s needed for the integration.
For legal reasons: to comply with law or valid legal process, to protect rights, safety, and the Service, or to investigate fraud. Where allowed, we’ll tell the affected Customer first.
In a business transfer: as part of a merger, acquisition, or sale of assets, subject to this policy’s protections, with notice to you.
With your consent or at your direction.

6. Sub-processors

At launch we expect to use:

Provider	Purpose	Location
Amazon Web Services	Hosting, database, file storage, backups, logs	United States (us-east-2, Ohio)
Resend	Sending transactional email	United States
Stripe	Subscription billing; invoice payments for Customers who connect it	United States, and globally
Google	Sign in with Google, for users who choose it	United States, and globally
Google (Google Analytics)	Website analytics on `mybillables.com`, for visitors who allow it	United States, and globally

Integrations a Customer chooses to connect (such as Harvest, QuickBooks Online, PayPal, or a calendar provider) receive data at that Customer’s direction. The current list is published at mybillables.com/legal/subprocessors, and we’ll give Customers notice before adding one.

7. Where data is stored, and international transfers

Each Organization’s data is stored in the region chosen when it was created. Data at rest, including backups, stays in that region. At launch, the available region is the United States.

If you’re outside the United States, your information will be transferred to and processed in the United States. Where the law requires, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses and the UK Addendum, or the EU-U.S. Data Privacy Framework where a provider participates in it.

8. How long we keep information

Account information: while your account is active, and then deleted within 90 days of account closure, unless the law requires us to keep it longer.
Customer Data: as long as the Customer keeps it in the Service. After an Organization is canceled, it stays exportable for 90 days and is then deleted from the live Service, and from backups as they expire (within 35 days).
Billing records: as long as tax and accounting law requires (typically 7 years).
Waitlist sign-ups: until you leave the waitlist, your address is undeliverable, or 30 days after general availability, whichever comes first, unless you create an account.
Website analytics: 14 months in Google Analytics, then deleted by Google.
Logs: up to [90] days, unless needed longer to investigate a security incident.

9. Cookies

Needed for the Service to work. The app uses a secure session cookie that keeps you signed in, and security cookies that protect against cross-site attacks. These don’t need your consent. The app also remembers a few settings in your browser: light or dark theme, how you last signed in, whether the sidebar is collapsed (a cookie), and which organization each tab is working in. They stay on your device and aren’t used for tracking.

Analytics, only with your consent. On mybillables.com, we use Google Analytics to count visits and learn which pages help people find us. Its cookies (_ga and _ga_<id>, kept up to 2 years) are set only after you choose Allow in the cookie banner. Until then, and if you decline, Google Analytics sets no cookies and receives only cookieless signals, without a cookie identifier, that can’t be tied to you across visits. We store your choice in your browser. You can change it at any time from Cookie settings at the bottom of every page, and declining removes the analytics cookies.

We don’t use advertising cookies or cross-site tracking. Google Analytics’ advertising features, Google signals, and ad personalization are turned off. If that changes, we’ll update this policy and ask for consent where the law requires.

10. Security

We protect personal information with encryption in transit (TLS 1.2 or later) and at rest, isolation between Organizations enforced in the database, encrypted storage of third-party access tokens, hashed passwords and email-link tokens, least-privilege access for our staff, and regular backups. No system is perfectly secure. If a breach affects your information, we’ll notify you and the authorities as the law requires.

11. Your rights and choices

Depending on where you live, you may have the right to:

access the personal information we hold about you, and get a copy in a portable format;
correct it;
delete it;
object to or restrict some processing, and withdraw consent where we rely on it;
opt out of the sale or sharing of personal information (we don’t do either) and of targeted advertising (we don’t do it);
not be discriminated against for exercising these rights;
appeal our decision on your request, and complain to your data protection authority.

How to exercise them: many are available in the app (profile settings and, for administrators, full export and deletion). Otherwise, email privacy@mybillables.com. We’ll verify your request, usually by confirming control of your account’s email address, and respond within the time the law requires (generally 30 days for GDPR and 45 days for California). You can use an authorized agent where the law allows.

If your request concerns Customer Data, we’ll pass it to the relevant Customer and help them respond.

California notice at collection. In the last 12 months we’ve collected the categories described in §2: identifiers, commercial information (billing), internet activity (logs and usage), and professional information (as part of Customer Data). We collect them for the purposes in §3, disclose them only as in §5, keep them as in §8, and don’t sell or share them.

12. Children

The Service is for businesses and isn’t directed to children under 16. We don’t knowingly collect their personal information. If you believe a child has given us personal information, contact us and we’ll delete it.

13. Changes to this policy

We’ll post changes here and update the effective date. For material changes, we’ll notify account owners by email or in the app before they take effect.

14. Contact us

Blair Software, LLC is the data controller collecting and managing user data under this policy.

Privacy questions and requests: privacy@mybillables.com