Privacy Policy

1. Introduction

Greatnews Adm Inc ("we," "our," or "us") operates Bill2Sheet (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

2.1 Information from Google OAuth

When you sign in with Google, we collect:

• Your email address
• Your name
• Your profile picture
• Google Account ID

2.2 Google API Access

We request access to the following Google services:

• Gmail API: To access and display your email messages when you explicitly request this functionality
• Google Calendar API: To read and manage your calendar events when you use calendar features

Important: We only access your Gmail and Calendar data when you explicitly use features that require this access. We store access tokens securely to maintain this connection, but we do not read, store, or share the content of your emails or calendar events except as necessary to provide the requested functionality.

2.3 Documents and Files

When you upload documents to our Service, we process and store these files to provide document intelligence and processing features. We retain uploaded documents only as long as necessary to provide our services.

2.4 Payment Information

We use Stripe to process payments. We do not store your credit card information on our servers. Payment information is collected and processed directly by Stripe in accordance with their privacy policy. We only store:

• Your subscription status
• Stripe customer ID (for subscription management)
• Transaction history (for invoicing and support)

2.5 Automatically Collected Information

We automatically collect:

• Log data (IP address, browser type, pages visited)
• Usage statistics and analytics
• Cookies and similar technologies (see Section 7)

3. How We Use Your Information

We use the collected information for:

• Authentication: To verify your identity and manage your account
• Service Delivery: To provide core features including Gmail integration, calendar access, and document processing
• Payment Processing: To manage subscriptions and billing through Stripe
• Communication: To send service-related notifications, updates, and support messages
• Improvements: To analyze usage patterns and improve our Service
• Security: To detect and prevent fraud, abuse, and security incidents
• Legal Compliance: To comply with applicable laws and regulations

4. How We Share Your Information

We do not sell your personal information. We may share your information with:

4.1 Service Providers

• Google: For OAuth authentication and API access (Gmail, Calendar)
• Stripe: For payment processing and subscription management
• SendGrid: For sending transactional emails
• OpenAI: For AI-powered features (if enabled)
• Microsoft SQL Server: For data storage and management

4.2 Legal Requirements

We may disclose your information if required by law or in response to valid legal processes.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

5. Data Storage and Security

We implement industry-standard security measures to protect your information:

• All data transmission is encrypted using HTTPS/TLS
• Passwords are hashed using ASP.NET Core Identity security standards
• OAuth tokens are encrypted and securely stored in our database
• Access to your data is restricted to authorized personnel only
• Regular security audits and updates

Your data is stored on secure servers. We retain your data as long as your account is active or as needed to provide services.

6. Your Rights and Choices

6.1 Access and Control

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct your information
• Deletion: Request deletion of your account and data
• Portability: Request your data in a portable format
• Objection: Object to certain data processing activities

6.2 Google Account Connections

You can manage or revoke Google account connections at any time:

• In your account settings on our Service
• Through Google Account settings at https://myaccount.google.com/permissions

6.3 Marketing Communications

You can opt out of marketing communications at any time by using the unsubscribe link in our emails.

7. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential Cookies: Required for authentication and security (e.g., session cookies, antiforgery tokens)
• Functional Cookies: To remember your preferences and settings
• Analytics: To understand how you use our Service and improve it

All cookies are configured with appropriate security settings (HttpOnly, Secure, SameSite).

8. Data Retention

We retain your information:

• As long as your account is active
• As necessary to provide our services
• To comply with legal obligations
• To resolve disputes and enforce our agreements

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

9. Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.

11. Google API Services User Data Policy

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Limited Use Disclosure: Our use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending an email notification for material changes

Your continued use of the Service after any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

14. GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA), you have additional rights under GDPR:

• Right to be informed about data collection and use
• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making

To exercise these rights, please contact us at [email protected].