Privacy Policy

1. Introduction

BuildBillRX ("we", "us", or "our") is a contractor invoicing and job management application operated by RX Digital LLC, a limited liability company organized under the laws of the State of Arizona. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our iOS mobile application and web dashboard (collectively, the "Service"). Please read this policy carefully. If you do not agree with its terms, please discontinue use of the Service.

Questions? Contact us at hello@buildbillrx.com.

2. Information We Collect

A. Account Information

When you register, we collect your name, email address, phone number, and business name through our authentication provider (Clerk). We may also collect profile photos and company logos that you upload.

B. Client, Job, and Invoice Data

To provide core functionality, we collect and store: client names, addresses, phone numbers, and email addresses; job descriptions, locations, photos, and scheduled dates; invoice line items, amounts, and payment status; estimates, contracts, and signatures (including GPS coordinates captured at time of signing); and expense records.

C. Financial Data — Plaid

If you connect a bank account, we use Plaid Inc. to facilitate the connection. We receive read-only transaction data (amounts, merchant names, dates, categories) and account balance information. We do not receive or store your banking credentials. Plaid's privacy policy is available at plaid.com/legal/privacy-policy.

D. Payment Data — Stripe

Payment processing is handled by Stripe Inc. via Stripe Connect. We do not store full credit card numbers or bank account numbers. Stripe may share limited payment confirmation data with us (e.g., last four digits, payment status). Stripe's privacy policy is available at stripe.com/privacy.

E. Email Data — User-Provided SMTP/IMAP

If you connect an email account using your own SMTP/IMAP credentials, we temporarily access and store email headers and content in your account for display within the inbox feature. Your email credentials are stored encrypted. We do not read, analyze, or share your email content for any purpose beyond displaying it to you.

F. Photos and Media

With your permission, we access your device camera and photo library to capture and upload job site photos, receipt images, and contract signer identity photos. These files are stored securely in our cloud infrastructure and are associated with your account only.

G. Location Data

We request location permission to: (1) automatically calculate mileage for business trips between job sites, and (2) capture GPS coordinates at the time a contract is signed as a legal record. You may grant "while using" or "always on" location permission; "always on" is used only for background mileage tracking while driving to job sites. We do not sell or share location data with third parties for advertising purposes.

H. Push Notification Tokens

With your permission, we collect a device push notification token (via Expo Push Notifications) to send you job reminders, invoice status updates, and other in-app notifications. You can disable push notifications at any time in your device settings.

I. Usage and Device Data

We automatically collect certain technical information when you use the Service, including device type, operating system version, app version, and crash/error logs. This data is used solely for debugging and service improvement.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Generate invoices, estimates, contracts, and reports on your behalf
• Process payments and payouts through Stripe Connect
• Sync and display bank transactions via Plaid
• Send transactional notifications (job reminders, invoice updates)
• Calculate mileage deductions for tax purposes
• Provide AI-assisted features via OpenAI (see Section 5)
• Respond to your support inquiries
• Improve and debug the Service
• Comply with legal obligations

We do not sell your personal information to third parties. We do not use your data for behavioral advertising.

4. Data Sharing and Disclosure

We may share your information only in the following circumstances:

• Service Providers: We share data with third-party vendors listed in Section 5 who process it on our behalf under data processing agreements.
• Legal Requirements: We may disclose information if required by law, subpoena, court order, or governmental request.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your data may be transferred as part of that transaction.
• Protection of Rights: We may disclose information to protect the rights, property, or safety of RX Digital LLC, our users, or others.

5. Third-Party Service Providers

We use the following processors to deliver the Service:

6. Data Storage and Security

Your data is stored on Supabase infrastructure hosted in the United States. We enforce Row-Level Security (RLS) policies on our database so that each user can only access their own data. Data is encrypted at rest and in transit using industry-standard TLS/SSL encryption.

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are legally required to retain it (e.g., financial records for tax purposes, which we retain for 7 years in accordance with IRS guidelines).

Certain aggregated, anonymized data from which you cannot be identified may be retained indefinitely for service improvement purposes.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and associated data (see below).
• Portability: Request export of your data in a machine-readable format.
• Opt-Out of Notifications: Disable push notifications in your device settings at any time.
• Location: Revoke location permissions in your device settings at any time.

To exercise any of these rights, contact us at hello@buildbillrx.com.

9. Account Deletion

You can delete your account directly within the BuildBillRX app by navigating to Settings → Privacy & Security → Delete Account. This action is permanent and will remove your account, all associated client/job/invoice data, signatures, photos, and your authentication record.

Alternatively, you may email hello@buildbillrx.com to request deletion. We will process your request within 30 days.

Note: Deletion of your account does not cancel any active Stripe subscriptions. Please cancel your subscription before deleting your account or contact us for assistance.

10. Children's Privacy

The Service is intended for use by business professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will delete it promptly.

11. California Privacy Rights (CCPA)

If you are a California resident, you have the right to: know what personal information we collect and how it is used; request deletion of your personal information; opt out of the sale of personal information (we do not sell personal information); and not be discriminated against for exercising your rights.

To submit a California privacy request, contact us at hello@buildbillrx.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date at the top of this page and, where appropriate, by sending you an in-app notification or email. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy, please contact: