Privacy Policy

Bilbx is a receipt-box mobile app for iOS and Android, operated by Fairgo Logistics (ABN 94 279 467 365)(“we”, “us”, “our”). Bilbx helps users scan, store, search, and manage receipts; track warranties, return windows, and tax-related purchases; and stay on top of purchase-related actions.

We respect your privacy and are committed to handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what information we collect, how we use it, and the choices you have.

Account information

When you create an account, we may collect your email address, authentication provider details (such as Google or Apple sign-in identifiers), and a unique user ID.

Receipt data

Bilbx stores the receipt content you choose to capture or upload. This may include receipt images or PDFs, merchant and store names, purchase dates, totals, tax categories, line items, notes, warranty details, return windows, reminders, OCR-extracted text, and AI-extracted details stored in structured formats.

Device and app information

We may collect basic device information such as device type, operating system version, and app version. Where you submit a support request or diagnostic report, additional technical details may be included.

Usage information

We collect basic information about how the app is used — such as which features are opened, whether a scan finished, and when an account is created — together with your account’s unique user ID. This tells us which parts of Bilbx are working and which are not. It does not include the contents of your receipts.

Preferences

We store your in-app preferences, including notification settings, reminder timing, and tax-mode preferences.

Support and feedback

If you contact us for support or submit feedback through the app, we collect the content of your message and any contact details you provide.

Permissions

Bilbx may request access to your device’s camera, photo library or files, and notification permissions. These permissions are used only for the features you choose to use, such as scanning receipts or receiving reminders.

We use the information we collect to:

• Create and manage your receipt box and account
• Process receipts using OCR and AI to extract details automatically
• Sync your receipt data across your devices
• Track returns, warranties, tax-related records, reminders, and purchase actions
• Send local notifications and optional email reminders where you have enabled them
• Improve the reliability, security, and functionality of the app
• Respond to your support requests, feedback, and enquiries
• Prevent abuse and protect user accounts

When you choose to scan or upload a receipt, Bilbx uses OCR and AI to help turn that receipt into searchable, structured data. The data processed may include the receipt image or PDF, OCR-extracted text, merchant and store names, purchase dates, totals, taxes, line items, notes that appear on the receipt, and related metadata needed to process the receipt.

This processing is carried out by Bilbx together with a small number of vetted enterprise AI providers engaged under commercial data processing agreements. Receipt content is sent to those providers for the single purpose of extracting receipt fields and returning them to your account. It is processed on an isolated, business-tier basis — not through consumer AI products — and is not retained by those providers beyond what is necessary to perform the extraction and to meet their own security and abuse-monitoring obligations.

For every provider that touches receipt content, we require by contract that your data is:

• never sold, rented, or shared for advertising
• never used to train, fine-tune, or improve any AI or machine learning model — ours, theirs, or anyone else’s
• never used for any purpose other than returning extracted receipt details to you
• encrypted in transit and at rest, and logically separated from other customers’ data

Before receipt content is sent for AI processing, the app asks for your permission or requires an action from you that clearly starts AI receipt processing, such as choosing to scan, upload, or process a receipt with AI. If you would prefer that receipt content is not processed this way, do not use the AI receipt scanning or AI receipt extraction features — you can still add and manage receipts manually.

Bilbx runs on established enterprise cloud infrastructure and works with a small number of carefully vetted service providers to deliver core app functionality. To avoid publishing details about our systems that would be useful only to someone trying to attack them, we describe these providers by the function they perform rather than naming each one:

• Identity and authentication— secure account sign-in and session management. Where you choose Google Sign-In or Sign in with Apple, that provider verifies who you are and returns a sign-in identifier to us; we never receive your password for those accounts.
• Encrypted cloud file storage— for the receipt images and PDFs you upload
• Managed database and sync infrastructure — for storing your receipt records and keeping them in sync across your devices
• Text recognition (OCR)— on-device and cloud-based recognition of the text printed on your receipts
• Enterprise AI processing— for extracting structured receipt details from the images, PDFs, and text you choose to process with AI, as described in section 4
• Email delivery and support tooling— for reminders you have enabled and messages you send us
• Product analytics— measuring how features are used so we can improve the app
• Abuse and bot protection— to protect sign-in and contact forms from automated abuse

Every provider is engaged under its own terms and a data processing agreement, and may only process your information as necessary to perform the specific function we have engaged it for. We choose providers that offer enterprise-grade security, maintain independent security certifications and audits, and make contractual commitments that are the same as, or substantially equivalent to, the protections described in this policy — including commitments not to use customer data to train or fine-tune AI or machine learning models. Providers may process limited data to deliver, secure, monitor, and maintain their own service, including abuse monitoring and service reliability functions.

We do not sell your personal information or your receipt data, and we do not share it with advertisers or data brokers. Describing providers by function does not reduce your rights: if you are a customer, a business, a regulator, or an app store reviewer who needs to know the identity of a specific provider, or a list of our current sub-processors, contact us and we will provide those details.

Some of the cloud and AI service providers we use may process or store information on servers located outside Australia. Where personal information is disclosed to an overseas recipient, Fairgo Logistics takes reasonable steps to ensure that the overseas recipient handles your information in accordance with the Australian Privacy Principles, as required by the Privacy Act 1988 (Cth). Those steps include binding data processing agreements, contractual data protection and confidentiality commitments, and selecting providers that meet recognised international security standards.

If you would like to know the countries in which your information may be processed, please contact us.

We take reasonable technical and organisational steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These measures include:

• Encrypted data transport (TLS/HTTPS) for all connections
• Encryption at rest for receipt files and records held by our infrastructure providers
• Account-level access rules, so your receipts and records are accessible only to your authenticated account
• Secure authentication, session management, and protections against automated abuse
• Enterprise cloud security controls provided by infrastructure providers that maintain independent security certifications and audits
• Least-privilege internal access — access to user data is limited to authorised systems and to the small number of personnel who need it to operate or support the service
• Publishing as little as possible about the internal design of our systems, so that public documents cannot be used to map our infrastructure

No method of electronic storage or transmission is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

We retain your receipt data and account information for as long as your account is active or as needed to provide the service. You can delete individual receipts at any time within the app.

If you wish to delete your account and associated data, you may request this by contacting us at the details below. Please note that some information may be retained for a limited period in backups, audit logs, or where required by law or legitimate business purposes.

Under the Australian Privacy Principles, you have the right to request access to the personal information we hold about you and to request correction of any information that is inaccurate, out-of-date, incomplete, or misleading. To make a request, please contact us using the details at the end of this policy.

If you have a concern or complaint about how we handle your personal information, please contact us at the details below. We will acknowledge your complaint and respond within a reasonable time.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

Bilbx is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected information from a child under this age, we will take steps to delete it promptly.

We will only send you marketing communications where permitted by applicable Australian law. You can opt out of marketing communications at any time by following the unsubscribe instructions included in the message or by contacting us directly.

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.

If you have any questions about this privacy policy or how we handle your personal information, please contact us: