Privacy Policy

This Privacy Policy explains how ChalkBill(“ChalkBill,” “we,” “us”) collects, uses, and shares information when you use the ChalkBill invoicing application (the “Service”). It applies to visitors to our website and to registered users of the Service.

Who we are

ChalkBill is operated by ChalkBill. If you have questions about this policy or how we handle your data, email us at support@chalkbill.com. Our mailing address is [Mailing address to be added].

What we collect

We collect the following categories of information:

• Account data: your name, email address, password (stored as a one-way hash, never in plain text), and, if you sign up with Google, the name and email from your Google profile.
• Business profile data: optional business name, business address, logo, default tax rate, default currency, and invoice numbering preferences you add in your settings.
• Client data you enter: names, email addresses, company names, phone numbers, and billing addresses of your own clients, which you add to ChalkBill in order to invoice them.
• Invoice data you enter: line items, descriptions, amounts, tax, discounts, due dates, notes, and any payment instructions you choose to type into an invoice (for example, how you’d like a client to pay you). ChalkBill stores this as free text you control — we don’t process payments between you and your clients, and we don’t ask for or store your clients’ card or bank account numbers.
• Subscription billing data: if you upgrade to a paid plan, Stripe processes your payment. We store your Stripe customer and subscription identifiers so we can keep your plan in sync, but we never see or store your full card number — Stripe handles that.
• Usage and log data: basic technical information generated as you use the Service, such as request metadata handled by our hosting providers, and anonymous, aggregate website analytics (see our Cookie Policy for details). When a client accepts or declines an estimate, we record the name they enter, a timestamp, their IP address, and browser user agent, and share this with the freelancer who sent the estimate as a record of the response.
• Support communications: anything you send us by email, such as when you contact support@chalkbill.com for help.

How we use it and our legal bases

We use the information above to:

• Provide the Service — create your account, generate and send invoices, and run the features you use (performance of a contract with you).
• Process subscription payments and manage your plan (performance of a contract, and legal obligations around billing records).
• Secure your account, prevent abuse, and keep the Service running reliably (our legitimate interests).
• Send you transactional email — account verification, password resets, a welcome email, and delivering invoices you send to your clients (performance of a contract; these are not marketing emails).
• Respond to support requests you send us (legitimate interests, and consent where you initiate contact).
• Comply with legal obligations, such as responding to lawful requests from authorities (legal obligation).

We do not use your data for advertising, and we do not sell personal data.

Who we share it with

We share data only with the service providers (sub-processors) needed to run ChalkBill, and only to the extent necessary for them to perform their function for us. We do not sell personal data, and we do not share it for cross-context behavioral advertising.

We may also disclose information if required by law, such as in response to a valid subpoena or court order, or to protect the rights, property, or safety of ChalkBill, our users, or the public.

Data retention

We keep your account, business profile, client, and invoice data for as long as your account is active, so the Service can keep working the way you expect. ChalkBill does not currently have a self-service “delete my account” button or an automatic data-retention schedule built into the product. If you’d like your account and associated data deleted, email support@chalkbill.com and we will process your request.

Security

We take reasonable measures to protect your data, including:

• Passwords are hashed with bcrypt before storage — we never store passwords in plain text.
• Session refresh tokens are stored in httpOnly cookies, which aren’t accessible to page scripts, and are marked Secure in production.
• Sign-in via Google uses OAuth with a short-lived, randomly generated state value to prevent cross-site request forgery.
• Password reset and email verification links use high-entropy, single-use tokens that expire automatically.

No method of transmission or storage is 100% secure, and we don’t claim any particular security certification (such as SOC 2 or ISO 27001). We will update this section if that changes.

Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (you can edit most of this yourself in your account settings).
• Request deletion of your data.
• Request a copy of your data in a portable format.
• Object to, or request that we restrict, certain processing.
• Withdraw consent, where we rely on consent.

To exercise any of these rights, email support@chalkbill.com. We’ll respond as promptly as we can. See our GDPR page for more detail if you’re in the EEA or UK.

International transfers

ChalkBill and the service providers listed above may process and store data in countries other than where you live, including the United States. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards, such as standard contractual clauses, to protect it.

Children’s privacy

ChalkBill is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us so we can remove it.

US state privacy rights

If you’re a resident of a US state with its own privacy law (such as California, Colorado, Connecticut, Virginia, or similar), you may have rights to know, access, delete, or correct your personal information, and to opt out of certain processing. We don’t sell personal data or use it for targeted advertising, so most opt-out rights won’t apply — but you can still reach us at support@chalkbill.com to exercise any applicable rights.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we’ll notify you by email or with a notice in the app. The “Last updated” date at the top of this page shows when it was last revised.

Contact us

ChalkBill
[Mailing address to be added]
support@chalkbill.com