Privacy policy

Two kinds of data, two different roles

Billable8 holds two very different things, and we treat them differently.

Your account data. Your name, email address, password, and role. We decide how this is handled, which makes us the controller for it. This page is mostly about that.

What you put in your workspace. Client names, projects, tasks, hours, rates, notes. That data belongs to your business, and some of it describes your clients, who have never heard of us. For that data we act on your instructions and nothing else: we host it, back it up, and show it to the people you have granted access. We do not read it, mine it, or touch it except to run the service or when you ask us to help with something. If you need a data processing agreement for your own compliance work, email us and we will sort one out.

What we collect

• Account details: name, email, role. Passwords are stored as bcrypt hashes (cost factor 12). We never store or log the plaintext, and we cannot recover it, only reset it.
• Workspace content: whatever you enter. Time entries, projects, clients, tasks, notes, bill and cost rates.
• API keys, if you create them: shown to you once, then stored only as a SHA-256 hash.
• Optional calendar connections: your connected Google or Microsoft account identifier and email, calendar names and selections, and encrypted access credentials. We read event titles, times, locations, and links to display the calendars you select. If you enable automated tracking, we also read organizer and attendee email addresses, invitation responses, event status, and recurrence identifiers to match meetings to the clients and tasks you choose.
• Contact form messages, if you send one: your name, email, optional company, and the message. Used to reply to you, kept in our inbox, never added to any list.
• Server logs from our hosting provider: IP address, request path, timestamp. Standard operational logs, retained briefly, used for debugging and abuse prevention.

This is the provider and data inventory currently used by the product. We update it when a processing activity changes.

Connecting a personal calendar

Connecting a calendar is a separate choice from signing in with Google or Microsoft. The connection lets Billable8 read your selected calendars; it does not let Billable8 create, change, or delete events in the provider. Your teammates cannot browse your connected calendar through Billable8. When you choose to log a meeting, its title and time become a timesheet entry governed by your workspace’s usual access permissions.

We use calendar data to show your schedule and create the time entries you choose to log, including through rules you explicitly enable. We do not use calendar data for advertising or AI training. Automated tracking checks your chosen calendars in the background, including while the app is closed. It records scheduled duration, which may differ from actual attendance. Your private automation history retains source event details for up to 90 days while the automation service is running. Minimal timing and duplicate-prevention records remain with your account so a meeting you dismissed or removed is not logged again. Time descriptions use your rule’s text unless you explicitly choose calendar titles. Account details, calendar selections, and encrypted credentials remain until you disconnect or your account is deleted. Disconnecting in Integrations removes the active connection immediately; encrypted backup copies follow our backup retention policy. Time you already logged remains in your timesheet. You can also revoke Billable8’s access in your Google or Microsoft account settings.

Cookies

Authentication pages use essential Auth.js cookies to protect the requested sign-in flow:

• An Auth.js session cookie that keeps you signed in. It expires after 7 days and rotates daily while you use the app.
• __Host-authjs.csrf-token protects the sign-in form, and __Secure-authjs.callback-url returns you to the requested Billable8 page after sign-in.
• A short-lived, encrypted calendar connection cookie protects a Google or Microsoft connection you initiate. It expires after ten minutes and is removed when the callback is handled.

And one that is not essential, which is why we ask before setting it: Google Analytics, on the public marketing pages. It tells us which pages people read and how they arrived, and connects those campaigns to successful signups, trials, checkout starts, subscription payments and refunds. The choice is remembered, and declining is one click, the same as agreeing.

Nothing happens before you answer: the Google Analytics script is not created and no request reaches Google until you press Allow — not a cookie, not a cookieless ping, nothing. Pressing No thanks, or dismissing the banner with Escape, keeps it that way unless you later change the choice through the persistent Cookie settings control.

Private page views and workspace content are never tracked. Page titles in there carry your clients’ and projects’ names, and those are yours. Measuring a marketing page is worth a banner; sending your client list to Google is not a trade we would make on your behalf.

For visitors who allow analytics, our server sends limited conversion events using an anonymous browser identifier: signup method, plan, billing interval and, for subscription payments or refunds, amount, currency and an opaque transaction ID. We do not send your name, email, customer invoices, project names, hours or rates. Campaign attribution is retained by Billable8 for up to 90 days. Google event and user data are retained for up to 14 months, with user retention reset by new activity; aggregate reports may remain longer. Use Cookie settings on a public page to withdraw future measurement. If offline, the server withdrawal request is retried when you next open a public page.

When workspace measurement is enabled, Billable8 records setup milestone dates, days with business activity, feature-use flags and the signup plan to improve onboarding. These measurements contain no customer names, notes, rates, invoice amounts or private page views, and are not sent to Google Analytics. Workspace owners can inspect, stop and erase this measurement in Settings under Workspace measurement. Daily activity is retained for up to 90 days; signup cohort reports cover up to 13 months. First-use dates remain available while the workspace is active and for up to 90 days after closure. When you consent to campaign attribution, reviewed public campaign labels may also group these reports for up to 90 days; withdrawal removes that grouping. Reports suppress small cohorts and outcomes.

We also switch off Google’s cross-site advertising signals and ad personalisation, and truncate IP addresses. Those stay off whichever way you answer — the banner can grant measurement and nothing else, and there is no button on this site that turns advertising storage on. Your light-or-dark theme choice is kept in your browser’s local storage and never sent to us. No ad trackers, no fingerprinting.

Where your data lives

The active Postgres database runs on our Hostinger server in Boston, United States. The application and attachment storage run on Vercel. Application connections to the database use TLS with client certificates. Daily recovery archives are encrypted before upload to Google Drive; the decryption key is stored separately. Encryption of the primary database disk has not been verified. See the security page for the current controls and limitations.

Who else touches it

These providers process customer or account data on our behalf. Each one gets only what its job requires:

We do not sell personal data or use an ad network. If this list changes, we update the public inventory and the applicable customer notice.

Email

Billable8 sends essential verification, recovery, security, membership, and subscription notices, plus acknowledgments of contact requests. Workspace administrators can configure a shared notification address for budget alerts and weekly reports. Optional alerts, reports, and setup guidance can be managed in Notification settings or through the unsubscribe link in an email. Setup guidance requires opt-in. There is no product marketing mailing list.

We retain encrypted pending email content while attempting delivery and remove that content after provider acceptance, permanent failure, suppression, or expiry. Delivery metadata and address hashes help us prevent duplicate sends and honor bounces, complaints, and preferences. Resend processes message content to deliver mail. Open and click tracking are disabled for the sending domain. A delivered status confirms acceptance by the receiving mail server, not that a person opened the message.

What we will never do

• Sell your data, or your clients’ data. To anyone, for anything.
• Use workspace content to train AI models, ours or anyone else’s.
• Show your rates, costs, or margins to your portal clients. That boundary is enforced in the database query layer and covered by automated tests that fail the build if it breaks.
• Hold your data hostage. Export works through a trial, payment recovery, and the 90-day post-closure window. A security or abuse suspension uses verified, operator-assisted export where law and incident response permit it. The product exists because a tool once did this to us, so this one is a promise with a grudge behind it.

Retention and deletion

We keep your data while your account is active. When you delete your account, or ask us to, we remove it from live systems within 30 days. Operational backups expire on a rolling basis after that, so copies age out rather than living forever. Server logs at our hosting provider are retained on their standard short schedule.

Before any of that, export everything yourself: the export endpoint produces CSV or JSON of every table you have the right to see.

Your rights

Access and portability are self-serve through the export. Correction is self-serve too, since you can edit anything you entered. For deletion, or anything you cannot reach yourself, email zach@opsautomators.com and a human will handle it within 30 days, usually much faster. If you are in a jurisdiction that grants specific privacy rights (GDPR, CCPA, and friends), those rights apply and the same address is where to exercise them.

One honest caveat: if your data is in someone else’s Billable8 workspace, say your hours are tracked by an agency you work with, the workspace owner controls it and your request should usually go to them. We will help them honour it.

Children

Billable8 is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children.

When this page changes

We will post changes here and update the effective date. For anything material, account owners get an email before it takes effect, not after.

Contact

Ops Automators, operator of billable8.com.
zach@opsautomators.com. A person reads this inbox, not a queue.