Privacy Policy

This Privacy Policy explains how billpulse.io ("BillPulse," "we," "us," or "our") collects, uses, discloses, and protects information when you use the BillPulse website, applications, and services (the "Service"). By using the Service, you agree to this Policy. It should be read together with our Terms of Service, Disclaimer, and Cookie Policy.

1. Information we collect

Information you provide

• Account information — your name, email address, and password (stored only as a salted hash, never in plain text).
• Uploaded documents — the medical bills or related documents you submit for analysis, and the data extracted from them (such as charges, codes, and amounts). The uploaded image/PDF itself is processed transiently and is not retained after your analysis completes.
• Payment information — handled by our payment processor (Stripe). We receive limited billing details (such as plan, status, and the last four digits/card brand) but do not store your full card number.
• Communications — messages you send us (for example, support requests).

Information collected automatically

• Usage & analytics data — analyses run, features used, and similar activity.
• Device & log data — IP address, browser and operating-system type, and timestamps, used for security, abuse-prevention, and diagnostics.
• Cookies — see our Cookie Policy.

2. How we use information

• to provide, operate, and improve the Service and run your bill analyses;
• to create and manage your account and authenticate you;
• to process payments, subscriptions, and renewals;
• to send transactional emails (verification, password reset, receipts, and service notices);
• to maintain security, prevent fraud and abuse, and enforce our Terms;
• to analyze usage and improve performance and accuracy;
• to comply with legal obligations and respond to lawful requests.

3. How we share information

We do not sell your personal information. We share it only as follows:

• Service providers who process data on our behalf, including: our payment processor (Stripe), third-party artificial-intelligence model providers used to read and analyze documents, email-delivery providers, and cloud-hosting/database providers. These providers are permitted to use the information only to provide services to us.
• Legal & safety — when we believe disclosure is required by law or legal process, or necessary to protect the rights, property, or safety of BillPulse, our users, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction — for example, when you choose to email a dispute letter to a provider.

4. Artificial-intelligence processing

To read and analyze your document, its contents may be transmitted to and processed by third-party AI providers under contractual confidentiality and security obligations. We aim to minimize the data sent and do not authorize these providers to use your content for their own purposes beyond providing the analysis service to us. Do not upload information you are not authorized to share.

5. Data retention

Uploaded bill images/PDFs are not retained after your analysis completes. We retain account information, analysis results and history, transaction records, and logs for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements, after which we delete or de-identify it.

6. Security

We use technical and organizational measures designed to protect your information, including encryption in transit, salted password hashing, access controls, and rate limiting. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential.

7. Your choices & rights

You may access or update your account information, or request deletion of your account, by contacting us. Depending on where you live, you may have additional rights:

U.S. state privacy rights (including California / CCPA & CPRA)

Residents of California and certain other states may have the right to know, access, correct, and delete personal information, and to opt out of "sale" or "sharing" of personal information. We do not sell your personal information. To exercise these rights, contact privacy@billpulse.io. We will not discriminate against you for exercising them.

EEA / UK rights (GDPR), where applicable

Where the GDPR or UK GDPR applies, you may have rights to access, rectify, erase, restrict, or object to processing, and to data portability. Our legal bases include performance of our contract with you, your consent, our legitimate interests, and compliance with legal obligations. You may lodge a complaint with your local supervisory authority.

8. Health information & HIPAA

BillPulse is not a HIPAA "covered entity" or "business associate," and information you provide to us is not protected health information under HIPAA in our hands. We nevertheless apply the protections described in this Policy to the information you share.

9. Children's privacy

The Service is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from anyone under 18 (or under 13). If you believe a child has provided us information, contact us and we will delete it.

10. International users

The Service is operated from the United States and intended for U.S. users. If you access it from outside the U.S., you understand your information will be processed in the U.S., where data- protection laws may differ from those in your country.

11. Changes to this Policy

We may update this Policy from time to time. We will update the "Last updated" date and, for material changes, provide additional notice where required. Continued use of the Service after changes take effect constitutes acceptance.

12. Contact us

Questions or requests about privacy? Email privacy@billpulse.io.