Your Data, Handled With Care

Billtize is cloud billing, accounting, and inventory software made for businesses in Nepal. This policy explains how Billtize collects, uses, protects, and shares information when you visit our websites or use our software.

It covers this website at billtize.com, your Billtize sign-in at me.billtize.com, the Billtize app at app.billtize.com, and our API at api.billtize.com.

Two ideas sit behind everything below. First, the business records you create in Billtize belong to you. We process them to run the service you asked for, and we do not sell them. Second, we only ask for the information a job actually needs. If a feature does not need your data to work, we do not take it.

By using Billtize, you accept the practices described here. If you use Billtize through your employer, this policy also applies to the account and activity records your employer's team creates.

Customer / User

Any individual or business that visits our sites, holds a Billtize account, adds a user to an account, or transacts with us.

Account Data

The business information you or your team enter into Billtize: invoices, bills, vouchers, contacts, items, stock, payments, attendance, tasks, payroll, reports, and settings.

Personal Data

Information that identifies a person, such as a name, email, phone number, address, or device and usage details tied to an account.

Sensitive Personal Data

Higher-risk personal information, including passwords, salary and payroll details, financial account details, and precise location data.

We / Us / Billtize

The team and company that operate the Billtize product and these websites, reachable through our contact page.

We collect information in four ways: what you give us, what your team creates in Billtize, what our systems record automatically, and what browsers store locally.

Information you give us

• Account details: your name, email, phone number, and password when you register, and an optional profile photo. For each organization you add: its legal and display name, PAN or VAT number, address, phone, email, website, and logo. When you invite someone, we store their email and the role you give them.
• Contact and demo requests: the name, email, phone, company, inquiry type, and message you send through our contact form, WhatsApp, phone, or email.
• Subscription details: the plan and term you buy, your payment record, and related correspondence. We do not take card payments on our websites.
• Support conversations: messages, screenshots, files, and log details you share so we can fix a problem.

Account Data you create in Billtize

This is the core of the service, and it can include personal data about people your business deals with or employs:

• Sales and purchase records: invoices, bills, credit and debit notes, receipts, payments, and the parties attached to them.
• Customer and supplier records: contact names, addresses, phone numbers, email, PAN details, and files you attach.
• Inventory records: items, quantities, warehouse locations, batch numbers, and expiry dates.
• Financial records: ledgers, journal vouchers, bank and cash account balances, and reports.
• HR records: staff names, roles, shifts, attendance and check-in locations, work hours, leave, assigned tasks, salaries, and payroll and TDS figures.

Information collected automatically

• Device and connection data: IP address, browser type and version, operating system, device model, screen size, and language.
• Usage data: pages visited, links clicked, features used, time spent, referring page, and error or crash details.
• Account activity: sign-in times, IP address, device, and browser, plus a log of records created, changed, or deleted, so your admins can see who did what.
• API activity: if you use Developer Mode API keys, the time, path, result, IP address, and user agent of each request.
• Server logs: request, timing, and error records needed to keep the service running and diagnose faults.

Information from connected features

• GPS attendance: when your business turns on location-verified attendance, Billtize records the staff member's location at check-in and check-out and compares it with the zones you assign.
• IRD CBMS: when IRD sync is on for an organization, it enters its IRD taxpayer login, which we store encrypted. Approved invoices and sales credits are then sent to CBMS, and we record the status IRD returns.
• Daraz: when you connect your Daraz seller account, we store the access tokens Daraz issues, keep stock in sync, and import your Daraz orders, including each buyer's name, phone number, and delivery address.
• FonePay: when you add your FonePay merchant login, we store it encrypted and send the payment amount to FonePay to create a QR code your customer can pay.
• Market Insights: we visit the public product pages of websites you add and record product names and prices. No personal data is collected this way.
• Imports and attachments: data you import from Excel, such as contacts, items, invoices, or bills, and files you attach to records such as contacts, invoices, bills, items, or tasks.

We use information for defined purposes, not open-ended ones:

Running the service

Providing billing, accounting, inventory, HR, reporting, and the integrations you turn on, including emails you set up, such as invoices to your customers, scheduled alerts, and task or leave notices. This is the main reason we hold Account Data.

Compliance and filing

Sending approved invoices and sales credits to IRD CBMS, and generating VAT Summary, Annex 13, and other statutory reports your business needs.

Account administration

Creating accounts, verifying identity, adding users, applying roles and permissions, emailing renewal reminders, and managing subscriptions.

Support

Answering requests, reproducing a problem, and spotting patterns so we can fix issues before more customers meet them.

Security and fraud prevention

Limiting repeated sign-in attempts, blocking abuse, restricting accounts that misuse the service, and investigating incidents.

Improvement and research

Understanding which features are used, removing dead ends, and prioritising what to build next. Where possible we do this on aggregated or de-identified data.

Marketing and communications

Product updates, tips, and offers about Billtize. We keep marketing separate from the notices you need to run your account, and you can opt out of marketing at any time.

We share information in a small number of controlled situations. We do not sell your personal data or your Account Data.

• Service providers: companies that host our servers, deliver our email (we send email through Google), and provide website analytics (Google Analytics). They are limited to the task we use them for.
• Integrations you turn on: IRD CBMS receives your invoices and sales credits, Daraz receives stock updates and order actions, and FonePay receives payment amounts for QR codes. Nothing is sent to these services unless your organization has turned the integration on.
• Your customers: when you email an invoice from Billtize, it goes to the email address on that customer's record.
• Government and regulators: we may disclose information where Nepali law, a court, or a competent authority compels us to.
• Your own team and organisation: users you invite see the modules, branches, and warehouses their role allows. Data shared inside your account follows your own role and permission settings.
• Professional advisers: auditors, lawyers, and accountants who help us operate, under duties of confidentiality.
• Business transfers: if Billtize is restructured, merged, acquired, or financed, customer information may move as part of that transaction. We would tell you before any change in how your data is used.
• With your consent: anything else you explicitly agree to, including publicising a customer story.

We may publish non-identifying statistics, such as aggregate usage numbers or anonymised trends, that cannot be traced back to you or your customers.

Billtize's HR module can verify attendance with GPS inside zones a business assigns. Because this involves your staff, we treat it carefully:

• The business using the feature, not Billtize, decides who is assigned to which zone and whether attendance is location-checked.
• Location is captured at check-in and check-out to record attendance. It is not a live tracking feed of where a person is all day.
• Remote login is available where a business approves it, so a staff member is not blocked from working when they are outside an assigned zone.
• Attendance feeds leave and payroll. Salary, payslip, and TDS figures are entered by the business and are visible to the staff member concerned and to users the business gives HR permissions.
• Staff should be told by their employer what is recorded, which is a condition we expect before the feature is turned on.

Cookies are small files a site stores in your browser. On billtize.com and in your Billtize account we use them for three jobs:

Strictly necessary

Keep you signed in to your Billtize account and app, protect your session, and remember app settings in your browser. These cannot be switched off.

Analytics

Google Analytics runs on billtize.com, me.billtize.com, and app.billtize.com. It records which pages are visited, how visitors arrived, and how long they stay, so we know what helps and what to fix.

Advertising

We do not use advertising or retargeting cookies. If that changes, we will update this section first.

You can delete or block cookies in your browser settings, and Google offers a browser add-on to opt out of Analytics. Blocking necessary cookies will stop sign-in and other features from working properly.

Third-party sites we link to, such as our social profiles, Daraz, or FonePay, have their own cookie practices we do not control.

We keep personal data and Account Data only as long as we need it for the purposes above, or as long as Nepali law requires records to be kept. Then we delete or anonymise it.

• Account Data: for the life of the subscription. If a trial or subscription ends, we keep the organization's data for a reasonable period so you can renew and pick up where you left off. We delete it when you ask us to, or after that period, subject to the tax record rules below.
• IRD records: for organizations with IRD sync, invoices and sales credits are permanent tax records and cannot be deleted from Billtize.
• Accounting and tax records: statutory retention applies. Nepal's Income Tax Act, 2002 (2058 BS) and Value Added Tax Act, 1996 (2052 BS) expect supporting documents to be preserved for a number of years, so we retain the data needed to answer a legitimate audit or filing query.
• Contact and inquiry records: kept while the enquiry is relevant and afterwards for reference, typically a few years.
• Server and activity logs: kept for the shorter period needed for security, debugging, and audit, generally months rather than years.
• Marketing consent records: kept to prove you agreed, until you withdraw it.
• Anonymised or aggregated data: kept indefinitely, because it no longer identifies anyone.

Deleted data may remain in backup copies for a limited time before those backups are replaced.

Billtize is built around the assumption that your books are the most valuable thing on the system. Our controls are described on the security page and include:

• Encryption in transit over HTTPS, and encryption of the logins and keys you give us, such as IRD and FonePay logins, Daraz tokens, and API secrets.
• Protected sign-in sessions, limits on repeated sign-in attempts, and role-based permissions limiting which modules, warehouses, and billing locations each user can reach.
• Transaction locking, so records before a date you choose cannot be changed.
• Activity and user logs that show who changed what.
• Automated backups.
• Least-privilege access for our own staff, who only reach production data when the job needs it.

If a security incident affects your personal data, we will notify you and any authority we are required to notify, without unnecessary delay.

Under Nepal's Individual Privacy Act, 2018 (2075 BS) and the Individual Privacy Regulation, 2020 (2077 BS), and as a matter of how we choose to operate, you can ask us to:

Know what we hold

Confirm whether we process your personal data and receive a copy of it.

Correct it

Fix inaccurate or incomplete personal data. For Account Data, most changes are quicker inside Billtize itself.

Delete it

Request erasure of personal data we no longer need, subject to the statutory retention above.

Object or restrict

Object to processing based on legitimate interests, or ask us to pause processing while a dispute is settled.

Take it with you

Export your records. Billtize reports and lists export to Excel, and we can help with a broader extract.

Withdraw consent

Stop marketing messages, or withdraw consent given for a feature that relies on it, any time.

Send your request from the email on your account to our contact page and tell us what you want and why. We may need to verify your identity before we act. We answer within a reasonable period, and we will explain it if we cannot grant something.

If you are a Billtize customer whose business uses our software to process its own customers' or staff's data, you are the controller for that data and Billtize is the processor. Route those requests to us through your admin, and we will help you respond.

Billtize is business software for users who can enter a binding contract under the law of Nepal. It is not aimed at children, and we do not knowingly collect personal data from anyone under 18.

If you believe a child has given us personal data, contact us and we will investigate and delete it where we can.

Billtize runs on servers operated for us by hosting providers. Some services we use, such as Google for email delivery and analytics, process data outside Nepal.

When data leaves the country we rely on contracts and technical safeguards that keep a comparable level of protection, and we apply the same rules here to it.

This policy is written for businesses operating in Nepal and is governed by the laws of Nepal, including:

• The Individual Privacy Act, 2018 (2075 BS) and the Individual Privacy Regulation, 2020 (2077 BS).
• The Electronic Transactions Act, 2008 (2063 BS), covering electronic records, digital signatures, and cyber offences.
• The Income Tax Act, 2002 (2058 BS), the Value Added Tax Act, 1996 (2052 BS), and Inland Revenue Department requirements, including CBMS e-billing rules.
• The Labour Act, 2017 (2074 BS), where attendance, leave, and payroll records are involved.

If your business has obligations under other laws, those sit with you, and your Billtize settings and exports are there to support you.

We update this page when our practices change. The date at the top of the page shows when it was last revised, and the current version on this URL is always the one that applies.

For a material change, such as a new category of data or a new way of sharing it, we will tell you in the product or by email where we are allowed to contact you.