Privacy Policy

Bilbx is a receipt-box app for iOS, Android and the web (bilbx.com), operated by Fairgo Logistics (ABN 94 279 467 365) (“we”, “us”, “our”). Bilbx helps users scan, store, search, and manage receipts; track warranties, return windows, and tax-related purchases; and stay on top of purchase-related actions.

We respect your privacy and are committed to handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what information we collect, how we use it, and the choices you have.

Account information

When you create an account, we may collect your email address, authentication provider details (such as Google or Apple sign-in identifiers), and a unique user ID.

Receipt data

Bilbx stores the receipt content you choose to capture, upload, share into Bilbx from another app, or email to your Bilbx address. This may include receipt images or PDFs, merchant and store names, purchase dates, totals, tax categories, line items, notes, warranty details, return windows, reminders, OCR-extracted text, and AI-extracted details stored in structured formats.

Emails you send to your Bilbx address

If you use your Bilbx email address, we receive each email sent to it in full: the sender, recipients, subject, date, message body, and attachments, together with the results of the security checks run on it (such as spam, virus, and sender-authentication checks). We also store the senders you have allowed, and whether each email was scanned, held for your review, approved, or dismissed.

Other people’s information

Receipts and emails can contain information about other people, such as a sender’s name and email address or a name printed on an invoice. We handle it only to provide Bilbx to you, and protect it in the same way as your own information.

Purchases and subscriptions

If you subscribe, we receive your plan, subscription status, and purchase identifiers and dates from the Apple App Store, Google Play, or our web payment provider, through our subscription-management provider. We never receive your full card number.

Device and app information

We may collect basic device information such as device type, operating system version, and app version, and a push-notification token for your device so we can deliver notifications and live progress updates. Where you submit a support request or diagnostic report, additional technical details may be included.

If the app crashes or hits an unexpected error, it automatically sends a crash report: what went wrong and where in the app’s code, your device model, operating system and app version, and the device’s state at the time, such as free memory. We use crash reports only to find and fix faults, and we don’t attach your account, name or receipts to them.

Security checks

To protect Bilbx from abuse, your device’s platform confirms that requests come from a genuine copy of the app, and our website uses bot protection on sign-in, on contact forms and on the Ask Bilbx chat. These checks send limited device and browser information to the provider that runs them.

App lock

If you turn on app lock, Bilbx uses your phone’s own Face ID, Touch ID, fingerprint, or passcode check. Your biometric information stays on your phone: Bilbx only learns whether the check succeeded.

Usage information

We collect basic information about how the app is used - such as which features are opened, whether a scan finished, and when an account is created - together with your account’s unique user ID. This tells us which parts of Bilbx are working and which are not. It does not include the contents of your receipts.

Questions you ask Bilbx on our website

If you type a question into the Ask Bilbx chat on our website, we send it to Google Cloud, which finds the answer in our published guides. So that a follow-up question makes sense, Google Cloud keeps the questions and answers of one conversation together. We keep each question, the page it was asked on, the country it was asked about, whether it was answered and which conversation it belonged to, so we can improve the guides. We keep it without your name, account or IP address, so please don’t include personal details in a question. The chat remembers the country you chose in your browser.

Messages you send to our team

If you write to a person from the Ask Bilbx chat, we keep your messages and our replies, the page and country you wrote from, when each side last saw the conversation, when your browser last checked it for replies, and the email address you give us, if you choose to give one. We use the address only to email you a reply you haven’t read in the chat within a few minutes. If you remove a conversation from your browser, we close it and stop replying in the chat. Your conversations are linked to your browser, not to your name, so the person answering can see your earlier conversations from the same browser. The link in a reply email reopens a conversation, so treat that email as private. We delete a conversation 12 months after its last message. Your chat history, including what our guide answered, is also kept in your browser until you remove it there or clear your browser’s storage.

Preferences

We store your in-app preferences, including notification settings, reminder timing, and tax-mode preferences.

Support and feedback

If you contact us for support or submit feedback through the app, we collect the content of your message and any contact details you provide.

Permissions

Bilbx may request access to your device’s camera, photo library or files, and notification permissions. These permissions are used only for the features you choose to use, such as scanning receipts or receiving reminders.

We use the information we collect to:

• Create and manage your receipt box and account
• Process receipts using OCR and AI to extract details automatically
• Receive email at your Bilbx address, check that it is safe and from a sender you have allowed, and turn the receipts in it into records
• Sync your receipt data across your devices
• Track returns, warranties, tax-related records, reminders, and purchase actions
• Send local notifications and optional email reminders where you have enabled them
• Improve the reliability, security, and functionality of the app
• Respond to your support requests, feedback, and enquiries
• Process purchases and manage your plan and its limits
• Prevent abuse and protect user accounts

When you scan, upload, share, or email a receipt to Bilbx, the image, PDF, or email is sent to our servers, and the text on it is read in the cloud by an enterprise AI provider, which returns the details as searchable, structured data. Bilbx does not read receipt text on your device. The data processed may include the receipt image or PDF, OCR-extracted text, merchant and store names, purchase dates, totals, taxes, line items, notes that appear on the receipt, and related metadata needed to process the receipt.

This processing is carried out by Bilbx together with a small number of vetted enterprise AI providers engaged under commercial data processing agreements. Receipt content is sent to those providers for the single purpose of extracting receipt fields and returning them to your account. It is processed on an isolated, business-tier basis - not through consumer AI products - and is not retained by those providers beyond what is necessary to perform the extraction and to meet their own security and abuse-monitoring obligations. That processing may take place in data centres outside Australia; section 6 explains where.

For every provider that touches receipt content, we require by contract that your data is:

• never sold, rented, or shared for advertising
• never used to train, fine-tune, or improve any AI or machine learning model - ours, theirs, or anyone else’s
• never used for any purpose other than returning extracted receipt details to you
• encrypted in transit and at rest, and logically separated from other customers’ data

Before receipt content is sent for AI processing, the app asks for your permission or requires an action from you that clearly starts AI receipt processing, such as choosing to scan, upload, or process a receipt with AI. For email, forwarding or sending a receipt to your Bilbx address is that action: emails from senders you have allowed are processed when they arrive, and emails from anyone else are held and processed only if you approve them. If you would prefer that receipt content is not processed this way, do not use the AI receipt scanning or AI receipt extraction features - you can still add and manage receipts manually.

Bilbx runs on established enterprise cloud infrastructure and works with a small number of carefully vetted service providers to deliver core app functionality. To avoid publishing details about our systems that would be useful only to someone trying to attack them, we describe these providers by the function they perform rather than naming each one:

• Identity and authentication - secure account sign-in and session management. Where you choose Google Sign-In or Sign in with Apple, that provider verifies who you are and returns a sign-in identifier to us; we never receive your password for those accounts.
• Encrypted cloud file storage - for the receipt images and PDFs you upload
• Managed database and sync infrastructure - for storing your receipt records and keeping them in sync across your devices
• Cloud text recognition and AI processing - for reading the text on the receipts, PDFs, and emails you choose to process, and extracting structured details from them, as described in section 4
• Email receiving - for receiving mail sent to Bilbx addresses and checking it for viruses, spam, and sender authentication before it is stored
• Email delivery and support tooling - for reminders you have enabled and messages you send us
• Payments and subscriptions - the Apple App Store, Google Play, a web payment provider, and a subscription-management provider
• Push notifications - Apple’s and Google’s notification services, for notifications and live progress updates
• Website hosting - for bilbx.com and the web portal
• Product analytics - measuring how features are used so we can improve the app
• Crash reporting - receiving crash reports from the app so we can fix faults
• Abuse and bot protection - to confirm that requests come from genuine copies of the app, and to protect sign-in and contact forms from automated abuse

Every provider is engaged under its own terms and a data processing agreement, and may only process your information as necessary to perform the specific function we have engaged it for. We choose providers that offer enterprise-grade security, maintain independent security certifications and audits, and make contractual commitments that are the same as, or substantially equivalent to, the protections described in this policy - including commitments not to use customer data to train or fine-tune AI or machine learning models. Providers may process limited data to deliver, secure, monitor, and maintain their own service, including abuse monitoring and service reliability functions.

We do not sell your personal information or your receipt data, and we do not share it with advertisers or data brokers. Describing providers by function does not reduce your rights: if you are a customer, a business, a regulator, or an app store reviewer who needs to know the identity of a specific provider, or a list of our current sub-processors, contact us and we will provide those details.

Some of our providers store or process information outside Australia. By function, your information is held or processed in:

• Australia (Sydney) - your receipt records and account data, most of our server processing, and the receiving and screening of email sent to your Bilbx address
• The United States - your receipt images and PDFs and their image processing, sign-in, product analytics, crash reports, payments and subscriptions, website hosting, push notifications, and support mail
• Japan - the sending of emails Bilbx sends you, such as reminders and verification messages
• AI processing - our AI provider may serve a request from any of the regions where it operates, including the United States

Where personal information is disclosed to an overseas recipient, Fairgo Logistics takes reasonable steps to ensure that the overseas recipient handles your information in accordance with the Australian Privacy Principles, as required by the Privacy Act 1988 (Cth). Those steps include binding data processing agreements, contractual data protection and confidentiality commitments, and selecting providers that meet recognised international security standards.

If you have questions about where your information is processed, please contact us.

We take reasonable technical and organisational steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These measures include:

• Encrypted data transport (TLS/HTTPS) for all connections
• Encryption at rest for receipt files and records held by our infrastructure providers
• Account-level access rules, so your receipts and records are accessible only to your authenticated account
• Secure authentication, session management, and protections against automated abuse
• Screening of email sent to Bilbx addresses: mail that carries a virus, or fails its sender’s own authentication policy, is refused before it is stored, and suspected spam waits for your review
• An optional app lock on your phone, and the option to hide amounts in notifications
• Enterprise cloud security controls provided by infrastructure providers that maintain independent security certifications and audits
• Least-privilege internal access - access to user data is limited to authorised systems and to the small number of personnel who need it to operate or support the service
• Publishing as little as possible about the internal design of our systems, so that public documents cannot be used to map our infrastructure

No method of electronic storage or transmission is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

We keep your account information and receipts for as long as your account is open. You can delete individual receipts, and emails in your Bilbx inbox, at any time.

• Deleting your account. You can delete your account and its data yourself in the app’s settings, or ask us to through our account deletion page. This removes your account, receipts, receipt images and PDFs, and emails. Copies in our backups are removed as those backups expire, within 14 days.
• Email. The copy held by our email receiving infrastructure is deleted within 7 days. In Bilbx, an email and its attachments are deleted 30 days after it is handled, or after 90 days if it is still waiting for your review. Receipts made from an email stay in your account until you delete them.
• Using Bilbx as a guest. If you use Bilbx without creating an account, your guest data is deleted 30 days after you started, unless you create an account before then. The app reminds you of this.
• Bilbx addresses. When you delete your account, we keep a one-way record of your Bilbx address names so that they are not given to anyone else for at least 24 months.

Some information may be kept for longer where the law requires it, such as records of payments, or in audit logs needed to keep the service secure.

Under the Australian Privacy Principles, you have the right to request access to the personal information we hold about you and to request correction of any information that is inaccurate, out-of-date, incomplete, or misleading. You can also ask for a copy of your receipts and data. To make a request, please contact us using the details at the end of this policy.

If you live in a country whose privacy law gives you further rights, such as the right to have your data deleted or moved, you can use them in the same way.

If you have a concern or complaint about how we handle your personal information, please contact us at the details below. We will acknowledge your complaint and respond within a reasonable time.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

Bilbx is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected information from a child under this age, we will take steps to delete it promptly.

We will only send you marketing communications where permitted by applicable Australian law. You can opt out of marketing communications at any time by following the unsubscribe instructions included in the message or by contacting us directly.

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes, we will update the “Last updated” date at the top of this page, and if a change is significant we will also let you know in the app or by email. We encourage you to review this policy periodically.

If you have any questions about this privacy policy or how we handle your personal information, please contact us: