Privacy Policy

Yonglie Zhu, an individual established in the People's Republic of China, operates Unbillableand decides what happens to the data described here. Under China’s Personal Information Protection Law (PIPL) that makes us the personal-information handler for the account data on this page. Write to hello@getunbillable.cloud about anything on this page.

We hold exactly these things, and nothing else:

• Your email address — the login identity for the account, plus a scrypt hash and salt of your password. We never store the password itself and cannot read it.
• Client names and the context line you write about each client — for example “three dental practices in Manchester”. This is client business information, and often a real trading name.
• The figures and notes you enter per report — spend, clicks, cost per click, conversions, cost per acquisition, return on ad spend, any extra metric rows you add, and the freeform note explaining what happened.
• Voice samples you paste — the good-month and bad-news writing samples, and the note about how you deliver bad news. These are usually your own past client emails.
• Generated text — every draft the tool produced for you, including edits you made in the editor, so the report still opens tomorrow.
• Product events — a small log of things like signup, first generation and pricing-page view, with the account email, a timestamp, and the browser user agent.
• Anything you send through the contact form — the name, email, subject and message you type there.

We do not ask for, and do not want, an address, phone number, date of birth, or payment card. When you buy a pack of credits, checkout happens on the payment provider’s own page and card details never reach our servers. We store only that a pack was paid for, its order identifier, and the credit balance it added.

Generation is not done on our own hardware. When you press generate, we send the material needed for that report to DeepSeek, a third-party language-model provider accessed through its API at api.deepseek.com.

That request contains:

• the client name and context line;
• the figures for the period, and your note about what happened;
• your pasted voice samples and bad-news style note, so the draft matches your tone;
• the report sections already written, when you regenerate a single section;
• our instructions to the model (the prompt).

It does not contain your password, your email address, your session cookie, or any other account’s data.

DeepSeek’s handling of API requests is governed by its own terms and privacy policy. We cannot make promises on its behalf, and we do not claim it is certified under any framework.

We do not use your content — client names, figures, notes, voice samples, or generated text — to train, fine-tune, or evaluate any model, ours or anyone else’s. We do not sell it, rent it, or share it for advertising. It is used to generate your report and to show it back to you, and for nothing else.

We have no model of our own and no training pipeline. The voice matching works by putting your pasted samples into the prompt for that one request.

One cookie, and it is the one that keeps you signed in: ub_session. It is HttpOnly, SameSite=Lax, Secure in production, and lasts 30 days or until you sign out. It contains your account id, a session version number, an issue time and a signature — not your password.

There is no analytics product, no advertising pixel, no third-party cookie, no session recorder and no cross-site tracker on this site. Because we set no cookie that is not strictly necessary, there is no cookie-consent banner.

• Vercel hosts the site and runs the serverless functions. Request logs (IP address, path, user agent, timestamps) are kept by Vercel under its own policies for a short retention window.
• Vercel Blob stores the account documents. The store is private and located in the EU (Frankfurt, fra1).
• DeepSeek generates text, as described in section 3, outside the EU.

One honest wrinkle about geography: the database lives in Frankfurt, but the serverless functions that read and write it run in Vercel’s US East region, so a request handling your data is executed in the United States before it returns to you. We are not claiming an EU-only processing footprint, because it would not be true.

We disclose data to anyone else only if the law compels us, and we will tell you unless we are legally barred from doing so. There is no analytics vendor, no CRM, no marketing tool and no data broker in the chain.

Account data, reports, voice samples and generated text stay until you ask us to delete the account. There is no automatic expiry, because an old report is the point of the archive. Product events are kept for the life of the account so the history stays coherent. Contact-form messages are kept until they are answered and no longer needed.

Email hello@getunbillable.cloud from the address on the account, with the subject “delete my account”. You can also use the contact form, though mail from the account address is quicker to verify.

We will delete the account document, which holds the email, password hash, client records, reports, voice samples and generated text, together with the email index entry, the referral code and the product-event rows for that address. We aim to do it within 7 business days and will confirm in writing when it is done.

Deleting the account does not reach into Vercel’s own request logs or DeepSeek’s systems; those follow their retention rules, not ours.

Under China’s Personal Information Protection Law you have the right to know and decide what happens to your personal information, to see a copy of it, to correct it, to have it deleted, to withdraw consent, and to receive it in a portable format. Write to the address in section 8 and we will act on it. We do not make automated decisions with legal effect about you, and we do not profile you for advertising.

If you are in the EU, the UK, or another country with its own data-protection law, that law applies to you as well and you may also complain to your own national supervisory authority. Where the two overlap we will follow the stricter requirement. We would appreciate the chance to fix the problem first.

Do not enter:

• names, contact details or any other personal data about members of the public, customers, patients, or employees;
• health, medical, genetic or biometric data;
• financial account numbers, card numbers, or government identifiers;
• data about children;
• anything you are under a contractual or legal duty not to disclose to a third-party processor.

Client company names and campaign metrics are business data and are what the tool is built for. If a note needs a real person’s name to make sense, replace it before pasting.

Passwords are hashed with scrypt and a per-account salt. Sessions are signed cookies that are invalidated when you change your password. The data store is private and only reachable with the deployment’s own credentials, and every write to an account document is serialised so two requests cannot clobber each other.

We hold no security certification: no SOC 2, no ISO 27001, no PCI attestation, and no independent penetration test has been carried out. If a provider tells you this product is certified, it is not.

If what we store or who we send it to changes, this page changes and the effective date at the top moves with it. A material change will be emailed to account holders before it applies.