1. Who we are
Billow Labs, Inc. ("Billow", "we", "us") provides finance and accounting software, including our website, dashboard, agents and Excel add-in.
Our address is 555 Bryant St #860, Palo Alto, CA 94301, United States.
This notice explains how we handle personal information through these services. Billow is responsible for deciding how information is used for its own account administration, business communications, security and optional analytics. For these activities, Billow is the data controller.
Customers choose the purpose and authorize the information used in their finance workflows. We process that information on their instructions as a service provider or data processor. The customer's privacy notice explains its own use of that information.
2. Information we handle
We receive information directly from you, from your organization and from the services it connects to Billow. We also collect technical information when you use our services.
| Information | Examples |
|---|---|
| Account and business contact information | Name, work email, organization and account identifiers. |
| Workflow information | Instructions, accounting records, selected spreadsheet or document contents, integration details and generated reports. These may include names, contact details and information about suppliers or employees. |
| Usage and technical information | Device and browser information, IP addresses, sign-in and execution events, error diagnostics and, when enabled, product analytics and session recordings. |
| Communications | Demo requests, support messages and privacy requests. |
Workflow definitions, history, inputs, outputs and files may be stored to provide the service, allow you to return to previous work and support troubleshooting. Processing is not limited to temporary spreadsheet memory.
3. Why we use information
Where the GDPR applies to processing for which Billow is the controller, the following purposes and legal bases apply:
| Purpose | Legal basis |
|---|---|
| Set up and manage accounts, provide the service and respond to service requests | Performance of a contract where you are a party to it; otherwise our legitimate interest in providing services to your organization and supporting its authorized users. |
| Respond to demo requests and business inquiries | Steps at your request before entering a contract, where applicable; otherwise our legitimate interest in responding to business inquiries and explaining our services. |
| Protect accounts, detect misuse and investigate technical problems | Our legitimate interest in keeping the service secure, reliable and available. |
| Understand product usage through optional analytics and session recording | Your consent. |
| Meet applicable legal obligations, including required business records and privacy-request handling | Compliance with the applicable legal obligation. |
| Establish, exercise or defend legal claims | Our legitimate interest in protecting our rights and resolving disputes. |
When relying on legitimate interests, we consider the purpose, the information needed and the effect on people's rights. You may object as described below.
For customer-controlled workflow information, we follow the customer's instructions. The customer determines the applicable legal basis for that processing.
4. Who receives information
Information is available to authorized users within your organization and to destinations selected in its workflows. We use service providers for hosting and storage, AI processing, connected applications, workflow execution, communications and diagnostics or analytics.
These include Supabase and Railway for application infrastructure, Vercel for website hosting, OpenAI and Anthropic for AI processing, Nango for integrations and PostHog for product analytics. A workflow may also use connected accounting, file or communication services selected by the customer. Providers receive information needed for the relevant service under the applicable terms and data-processing arrangements.
We may disclose information where required by law or where necessary to establish, exercise or defend legal claims.
5. International transfers
Billow is based in the United States and uses international service providers. Information may be processed outside the EU/EEA, including in the United States. Protection under local law may differ from that in your country.
Where GDPR international-transfer rules apply, the transfer must be covered by an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses. Applicable provider data-processing agreements include these clauses for covered transfers; for example, Supabase's and Anthropic's agreements contain SCC provisions, and OpenAI's agreement provides for SCCs or an applicable adequacy decision for relevant onward transfers.
We assess the applicable transfer arrangement and any additional protections needed under our transfer-review procedure. Contact us for information about a transfer affecting your information or a copy of the relevant safeguards, with confidential information removed where necessary.
6. Retention and security
We keep personal information for as long as needed for its purpose. In deciding the period, we consider the active account or customer relationship, customer instructions, the need to retrieve or troubleshoot workflow results, applicable recordkeeping requirements and any legal claim.
When information is no longer needed, it is deleted or anonymized under the applicable retention process. Backup copies follow their separate retention cycles. Disconnecting an integration prevents future authorized access through that connection; it does not by itself delete information already included in previous workflows or reports.
We use access restrictions and encryption to protect information in our services. The specific storage and retention arrangements depend on the service and type of information.
7. Your choices and rights
Where applicable, you may request access to your personal information, correction of inaccurate information, deletion, restriction of processing or a portable copy of information. You may object to processing based on legitimate interests, including any direct marketing.
Where processing relies on consent, you may withdraw it at any time. For optional dashboard analytics, use the privacy settings; you can also contact the team. Withdrawal does not affect processing lawfully carried out before withdrawal. Declining optional analytics does not prevent use of the core service.
You can make a request using the contact details below. We may need to verify your identity. If the request concerns information controlled by a customer, we will coordinate with that customer or direct you to it. Rights are subject to applicable legal conditions and exceptions.
You may complain to a data-protection supervisory authority, including the authority where you habitually live or work or where you believe an infringement occurred. You do not have to contact Billow first.
8. Information needed to use the service
Account and contact details are needed to establish or manage access and respond to requests. The information and permissions needed for a workflow depend on the task you choose. Without the necessary information or access, we may be unable to provide the relevant account, response or workflow.
Optional analytics is not a condition of using the service. We will identify any specific information that you are legally required to provide when such a requirement applies.
9. Automation
Billow uses AI and automation to interpret instructions, perform calculations and run workflows selected by users. Outputs support finance and accounting work. People make decisions using that analysis.
Billow does not itself make decisions about individuals based solely on automated processing, including profiling, that produce legal or similarly significant effects. Automating a workflow step does not mean Billow makes those decisions about a person.
10. Children
Billow provides business finance and accounting services and does not offer services directly to children.
11. Contact and updates
Email: privacy@thebillow.ai
Post: Billow Labs, Inc., 555 Bryant St #860, Palo Alto, CA 94301, United States.
We update this notice when our practices or applicable requirements change and show the revised date. We will provide additional notice of material changes where required.
Version history: 13 September 2026 - expanded the notice to cover the current platform and GDPR disclosures. Previous notice: 14 February 2026.