Privacy policy

Updated 9 November 2026

Billvito keeps your business records so you can use them on any phone. This says what is kept, who can reach it and how to have it deleted.

Who this covers

This policy covers the Billvito app for Android, the billvito.com website and the business pages at billvito.com addresses, wherever you use them. They are run by Ahmedonics Technologies (Private) Limited, Islamabad, Pakistan. Questions go to support@billvito.com.

What we keep

• Your account: your email address, your name, your sign-in details from Google if you use Google, and the phones you sign in on (maker and model), with a random key the app makes for each, which keeps each phone's invoice numbers apart.
• Your business: its name, country, contact details, tax number, bank details, usual terms and number format.
• Your records: quotes, invoices, credit notes, your clients and their contact details, payments and balance entries, your suppliers and their contact details, what you bought from them and paid them, petty cash, your catalog, photos and PDFs of bills and receipts you add, and your rough notes with their text, voice recordings, photos and PDFs.
• Your business page: what you put on it, including pictures. A page you publish is public once we have approved it.
• If you ask to join the app test: the email address you give, and your business name and kind if you give them. We use them only to invite you, and delete them once the app is open to everyone, or sooner if you ask.
• Your team: the email addresses you invite, and who made each record, which your team can see by name.
• Your plan: if you subscribe in the app, what Google Play tells us about the purchase: its token, order number, the plan and when it ends. We never see your card.
• Reports about pages: what a visitor tells us when they report a page, and a one-way code made from their internet address so we can limit repeated reports.
• When something goes wrong: a short error report so we can fix it: what failed and where in our code, the page's address without anything after the ?, the time, and your account and business by number; for an error on a web page, also the browser's name and version. Email addresses and phone numbers in it are hidden, and no internet address is kept with it. The app sends no error reports of its own.

What we use it for

To run the service: keeping your records in step across your phones, showing your page, sending the sign-in codes and messages your account needs (a welcome, and news of your page, your plan or your team, never offers), checking pages for our rules, and keeping the service safe. We don't sell your information and we don't show advertising. The app has no advertising ID and no analytics or crash reporting service, and the website uses none either.

Your clients' and suppliers' details

You decide whose details go into Billvito, so make sure you are allowed to keep them and to contact those people. We hold them on your behalf and use them only to provide the service to you.

How it is protected

Everything travels over HTTPS. Private details are encrypted when stored, with a separate key for each business: your business's contact and bank details and payment QR, purchase tokens, your clients' and suppliers' phone numbers, email and street addresses, tax numbers and notes, the notes and bill numbers on entries and documents, the text of rough notes, and voice, photo and PDF files with their names. Names of clients, suppliers and items, amounts, dates and statuses are not encrypted, so that search, totals and reports can work.

Encryption keys are kept apart from the database, so a stolen database alone isn't enough to read those details. They are on the same server today, so someone who broke into the whole server could reach them. This isn't end-to-end encryption: our server can read your records when it needs to, for example to show them to you on another phone.

Who can see it

• You, and anyone you add to your team, who can see the business's records and work on them.
• Our staff manage accounts and check public pages. They have no screen for reading your invoices, clients or notes, and no way to sign in as you. Someone with direct access to the server could technically reach what isn't encrypted, and that access is limited to the people who run the service.
• People who see what you send, because you sent it: PDFs, pictures and messages leave through the app you choose, and that app's own rules then apply.
• Anyone, for what you publish on your business page.
• Companies that run parts of the service for us: LinearHost, whose servers hold the service; Cloudflare, which carries the traffic and keeps a copy of our backups, encrypted with a key Cloudflare doesn't have; and Google, if you sign in with Google or buy through Google Play, and because a copy of our backups is kept on Google Drive, encrypted with a key Google doesn't have. Google's handling is covered by the Google Privacy Policy.

We give information to the authorities only when the law requires it.

On your phone

You can try the app without an account. Your records then stay on your phone and don't reach our servers, so they're lost if the phone is. Once you sign in, they're kept as this policy describes. On a paid plan we also keep an encrypted copy of each PDF you send or make on your phone, so you can open it again as it was. It counts toward your plan's storage, and goes about 30 days after you delete the record it belongs to, or with your account. The app asks for the microphone the first time you record a voice note, for notifications if you use reminders, and to reach nearby devices if you choose a Bluetooth receipt printer. It uses that only to connect to a printer you've already paired with your phone: it doesn't look for other devices or use your location, and the printer you choose stays on that phone. Photos go through your camera app and Android's own photo picker, PDFs through Android's own file screen, and contacts through Android's own picker, so the app has no permission to look through your photos, files or contacts. It can't read WhatsApp: a note only gets what you share into it yourself. Reading rough notes happens on your phone. A signature you draw for your documents stays on that phone and is never sent to us. The app lock uses your phone's own lock, so Billvito never sees your fingerprint or PIN.

Cookies and your country

This website and business pages set no cookies. Signing in to a staff or account page sets one cookie, needed to keep you signed in. Cloudflare works out your country from your internet address, so that people in Pakistan get the version of the site with prices in rupees, and so that we can suggest your country and currency when you start on the web. The app suggests them from your phone's SIM card or settings. We don't keep these guesses, only the country you confirm for your business.

Keeping and deleting

We keep your records while you have an account. You can ask for your account to be deleted. It goes within 30 days, along with any business you alone own and everything in it. Copies in our backups are replaced as new backups are made. The last of them, an encrypted copy kept away from our servers, is gone within 120 days after that. A few things may have to stay longer if the law requires it. Deleting the app from your phone doesn't delete your account. Error reports are deleted 90 days after the error last happened.

Your choices

You can see and change your records in the app at any time. To get a copy, correct something you can't change yourself, or have your information deleted, write to support@billvito.com from your account's address.

Age

Billvito is a tool for businesses, for people aged 18 and over. It isn't directed at children.

Changes

When this policy changes, the date on this page changes. If a change matters to how your information is used, we'll tell you in the app or by email first.