Privacy Policy

1. Bank and card statement uploads

When you upload a statement (a CSV export), the file is read in memory and then discarded. The raw file is never written to disk or kept in storage. Only the cleaned-up transactions persist in your account: merchant, amount, currency, date and direction.

• We don't store full account numbers. If a statement line contains one, it isn't kept in the saved record.
• Statement descriptors such as "UPI/NETFLIX/9876543210/YESB" are cleaned up to a merchant name, and the raw descriptor text is discarded once that's done.

2. Email access (Gmail and Apple email)

If you connect your Gmail or Apple email account, we only ever ask for read-only permission to search and read messages. We never ask for permission to send, delete or change your email.

• What we read: messages that look like receipts, order confirmations, renewal notices, trial reminders and payment-failure notices.
• What we extract: merchant, amount, currency, billing frequency and relevant dates. We keep these details, not the message itself.
• What we keep: the extracted details, plus the message date and a reference ID so we can re-check a detection later. We don't keep email bodies, attachments or unrelated messages.
• You can disconnect your email account at any time from Settings. This revokes our access and stops all scanning immediately.

3. What we build from your data

From these sources we build subscription records: merchant, category, amount, billing frequency, status and a confidence score. Wherever a feature doesn't need raw data, we keep the derived details instead.

• Price history is kept so we can spot price rises and show how your spending has changed.
• Autopay mandates and card standing instructions are kept as part of the subscription record when detected.

4. AI processing

When our rules can't classify a charge on their own, we send limited details (the descriptor text, amount and dates, never full emails or statement files) to a third-party AI model for a suggestion. Most subscriptions are identified without AI at all.

• AI output is a suggestion with a confidence score, never a fact. Anything below our confidence threshold is shown to you to confirm before it counts toward your totals.
• AI never sends anything on your behalf. Every message the app drafts, such as a cancellation email, needs your explicit approval before it is sent.
• AI can make mistakes. Its suggestions, including plan suggestions, may sometimes be inaccurate, incomplete or entirely made up. Always check a suggestion before acting on it. Any decision or action you take based on it is your responsibility.

5. Keeping, disconnecting and deleting data

• You can disconnect any source, or clear your uploaded-statement history, at any time from Settings.
• You can delete your account at any time. This removes your subscription records, price history, statement-derived data and account details. Some records may be kept briefly where the law requires it, or for fraud prevention or dispute resolution, and are then deleted.
• Deleting your account doesn't refund any subscription amount you have already paid. See our Terms of Service for details.
• You can request a copy of your data. We send data exports only to the email address registered on your account, and never to any other address or through any other channel.
• We keep data only while it serves a feature you use. For example, price history is kept as long as you track that subscription.

6. Audit logging

We keep a log of sensitive actions on your account: connecting or disconnecting a source, exporting or deleting your data, and sending any message on your behalf. These logs never contain email content, full account numbers, UPI handles or access tokens.

7. Security

• Your data is encrypted in transit (TLS) between your device and our servers.
• Your data is encrypted at rest in our database and file storage.
• You sign in with Google, Apple or a one-time code. We never collect or store a password for your email.

8. Payments

Your Upbil subscription is billed through the Apple App Store or Google Play. We never receive or store your card details. The store handles payment, and we receive only your subscription status and purchase history.

9. Contact

Upbil is owned and managed by TechTalkByte. To ask about this policy, request a data export, disconnect a source or delete your data, use Settings in the app or email privacy@upbilpay.com.