Legal
Privacy Policy
What HelloBill keeps, why, who else sees it, and how long it stays.
Last updated 11 October 2026
1Who this is and what it covers
HelloBill is an invoicing app for small businesses, run by MAROTECH SOLUTIONS in Kuala Lumpur, Malaysia ("we", "us"). This policy covers the HelloBill app for iPhone and Android, our servers, and the pages your clients open from an invoice or a quote.
We follow Malaysia's Personal Data Protection Act 2010. Where another country's law gives you more rights, you have those too.
2What we keep and why
Your account
- Your name and email address, to sign you in and to write to you about your account.
- Your password, stored only as a one-way hash we cannot read back. If you sign in with Apple or Google instead, we keep the account number that service gives us, and the email address it shares.
- Your plan (Free or Pro) and when a subscription renews or ends.
Your business
- The business details you enter: name, address, registration and tax numbers, bank and payment details, logo, invoice settings.
- Your clients, items, invoices, quotes, recurring invoices and payments, with any proof-of-payment photos or PDFs you attach.
- A record of each message the app sends for you (an invoice, a reminder, a receipt): to whom, when, and whether it was delivered.
We use this only to run the app for you: to make your invoices and PDFs, send them, remind your clients, and show you who has paid.
Your phone
- A notification token, if you allow notifications, so we can tell you when a client views or pays an invoice.
- The app's version, so we can tell you when an update is ready.
The app does not ask for your location or your contacts list. When you pick a client from your contacts, your phone hands us only the one contact you chose. Photos are read only when you choose one.
Keeping the service safe
When a sign-in fails, an upload is refused or a request is blocked, we note the time and the internet (IP) address, to stop abuse. These notes are deleted after 90 days.
3Your clients' details
The details you keep about your clients belong to your business. We hold them for you and use them only to send what you ask (invoices, quotes, reminders, receipts). You are responsible for having your clients' permission to send them these.
When a client opens an invoice or a quote link, we note that it was viewed, so you can see it. When they accept a quote or change their reminder choices, we keep the time and their IP address as a record of that answer. A client can stop reminders from any reminder with one tap.
4Who else sees it
We never sell your data, and there are no adverts in HelloBill. We share it only with the services that run parts of the app, each only what it needs:
| Service | What for, and what it gets |
|---|---|
| Brevo | Delivers our emails: your invoices, quotes, reminders and receipts, and your own account emails. It gets the recipient's address and the message. |
| Stripe | Only if you turn on online payments. Your clients pay on Stripe's page into your own Stripe account. Stripe has its own agreement with you and its own privacy policy. We keep the payment's reference, the card brand and last 4 digits or the bank, and Stripe's fee. |
| The app store and RevenueCat | If you buy Pro, your phone's app store takes the payment. RevenueCat tells us the subscription is active. They know your HelloBill account number, never your business data. We never see your card. |
| Google Firebase | Delivers notifications to your phone. It gets your phone's notification token and the notification's words. |
| Apple and Google sign-in | Only if you choose them. They confirm who you are. |
| Mocean | Only once WhatsApp or SMS reminders are available and you turn them on. It gets your client's phone number and the message. |
| Tencent Cloud | Hosts our servers. It stores the data but does not use it. |
We give data to the authorities only when Malaysian law requires it.
5Who at our end can read it
A small number of our staff can view an account to answer a support request or to deal with abuse. They sign in with a password and a second step, and each change they make is logged with who made it and when.
6How long it is kept
- Your account and business data: for as long as you have the account.
- When you delete your account, your account, business, clients, invoices, quotes, payments, files and notification tokens are deleted from our live systems at once. See Delete your account.
- Backups of our database are kept for up to 30 days, then destroyed. Deleted data leaves the backups within that time.
- The reason you give for leaving is kept without your name, email or any detail that could identify you.
- Emails already sent stay in your clients' mailboxes. Stripe and the app stores keep their own records under their own rules.
7Where it is processed
Our servers are in Singapore. Brevo processes email in the European Union; Stripe, RevenueCat and Google may process data in the United States and other countries. Each of them is bound to protect it.
8Keeping it safe
Everything between the app and our servers is encrypted (HTTPS). Passwords are hashed. Each account can reach only its own business's data. Invoice and quote links use long random codes that cannot be guessed. Proof-of-payment files are private and are only shown inside the app.
No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.
9Your rights
- See and correct it. Most of it is in the app, and you can change it there. For a copy of anything else we hold about you, write to us.
- Delete it. Delete your account in the app, or ask us to.
- Stop messages. Turn off notifications on your phone at any time. Your clients can stop reminders from any reminder.
- Withdraw consent. You can stop using any optional part (sign-in with Apple or Google, online payments, notifications) at any time.
We answer within 21 days. If you are not happy with our answer, you can complain to Malaysia's Personal Data Protection Commissioner.
10Children
HelloBill is for running a business and is not meant for anyone under 18. We do not knowingly keep data about children.
11Changes
When this policy changes, the date at the top changes. If a change matters, we will tell you in the app before it applies.
12Contact
Write to support@hellobill.my. MAROTECH SOLUTIONS, Kuala Lumpur, Malaysia.