DRAFT - to be reviewed by our lawyer before launch.
This policy explains what personal data ForestBill collects, why, who we share it with, how long we keep it, and what rights you have. We keep it short and plain. Questions: support@forestbill.com.
1. Who we are
ForestBill is a product of Genyune SMC-Private Limited, Karachi, Pakistan.
- Registered address: [[REGISTERED ADDRESS]]
- Company registration number: [[COMPANY REGISTRATION NUMBER]]
- Phone: [[PHONE]]
- Privacy requests: support@forestbill.com
2. Two different roles
ForestBill handles personal data in two ways. It matters which one applies to you.
| Whose data | Our role | Who decides about the data |
|---|---|---|
| Our customers' people: the staff of agencies who sign in to ForestBill, and people who contact us | Controller | ForestBill decides, as explained in this policy |
| Our customers' clients: the people and businesses an agency bills, sends contracts to, or lets into its client portal | Processor | The agency decides. We only follow its instructions (see section 9 and our Data Processing Addendum) |
If you are a client of an agency (for example you got an invoice or a contract from a business that uses ForestBill), the agency is responsible for your data. Please read section 9.
3. Data we collect about agency staff and website visitors
Account data. Your name, email address, the agency and brands you belong to, your role, and your password (stored only as a secure, one-way hash, never in readable form).
Security data. Your two-step sign-in (2FA) settings and recovery codes (stored hashed), the devices and browsers you sign in from, sign-in times, IP addresses and the approximate country of a sign-in. We use these to protect your account, for example to email you about a sign-in from a new device.
Activity data. What you change in ForestBill is written to the agency's audit log: who did what, and when.
Billing data. Your agency's plan, invoices and payments to ForestBill. If you pay by card, Stripe handles the card. We only keep the card brand, the last 4 digits and the expiry date.
Messages. What you write to us by email, and our replies.
Technical data. When something breaks, we record an error report so we can fix it. Before an error report is stored, we remove passwords, secrets and other sensitive values from it.
We do not buy data about you, and we do not sell your data.
4. Why we use it
| Purpose | Legal reason (where the law asks for one) |
|---|---|
| Run your account and provide ForestBill | To perform our contract with your agency |
| Keep ForestBill and your account secure, prevent fraud and abuse | Our legitimate interest in a safe service |
| Bill your agency for its plan | To perform our contract |
| Send service emails (sign-in codes, security alerts, billing reminders, changes to our terms) | To perform our contract, and our legitimate interest |
| Answer your questions and give support | To perform our contract, and our legitimate interest |
| Keep financial records | Legal obligations |
We do not send marketing emails without your agreement, and you can stop them at any time.
5. Cookies
ForestBill uses only cookies that are needed for the service to work. We do not use tracking, analytics or advertising cookies.
| Cookie | What it does |
|---|---|
Sign-in session (name starts with forestbill) | Keeps you signed in |
forestbill_device | Recognises a device you signed in from before, so we can warn you about sign-ins from new devices |
forestbill_theme | Remembers light or dark mode |
forestbill_sidebar | Remembers if you folded the side menu |
portal_session | Keeps an agency's client signed in to the client portal |
When a client pays on a pay page, the payment provider's own payment form (for example Stripe or PayPal) may set its own cookies, mainly to prevent fraud. Those cookies are controlled by that provider under its own privacy policy.
Because we only use necessary cookies, we do not show a cookie banner.
6. Who we share data with
We share personal data only with service providers that help us run ForestBill (our "sub-processors"), and only as much as they need:
| Provider | What it does for us | Data it handles |
|---|---|---|
| [[HOSTING PROVIDER AND SERVER LOCATION]] | Servers that run ForestBill and its database | All data stored in ForestBill |
| Cloudflare | Network protection and delivery of our websites (DNS, protection against attacks) | Traffic to our websites, including IP addresses |
| Cloudflare R2 | File storage (PDFs, logos, exports) and our encrypted backups | Stored files and encrypted backups |
| Stripe | Card payments for ForestBill plans | Agency billing details; card data goes directly to Stripe |
| The email sending service (to be confirmed) | Sends ForestBill's emails | Email addresses and email content |
Error monitoring runs on our own servers, so error reports are not sent to an outside company.
Payment and email accounts that an agency connects (for example the agency's own Stripe or PayPal account, or its own email mailbox) are chosen and controlled by the agency. When ForestBill sends data to them, it does so on the agency's instruction. They are the agency's providers, under the agency's own agreements with them.
We also share data when the law requires it, to protect our rights or the safety of others, or with a buyer if ForestBill is ever sold (we would tell you first).
To check that a new password has not appeared in known data leaks, we send only the first 5 characters of a one-way code of the password to a public leak-check service. Neither the password nor your email address is sent.
7. International transfers
ForestBill is run from Pakistan. Our servers are at [[HOSTING PROVIDER AND SERVER LOCATION]], and some of our providers (such as Cloudflare and Stripe) work in many countries, including the United States and the European Union. This means your data may be stored or handled outside your own country.
When we use providers in other countries, we choose providers with strong security and data-protection commitments, and we use the protection their contracts offer (for example standard contractual clauses where they apply).
8. How we protect data
- Card numbers never reach ForestBill. They go straight from the browser to the payment provider.
- Secrets are encrypted. Payment account keys, email passwords and similar secrets are encrypted with a separate key for each agency. Even our support staff cannot read them in the app.
- Two-step sign-in (2FA) is available to everyone, is required for ForestBill's own staff, and agencies can require it for their whole team.
- Tamper-evident audit log. Every change is recorded in a chain that shows if a record was changed or removed.
- Strict separation between agencies. One agency can never see another agency's data; this is enforced in the database itself.
- Encrypted backups, stored off our main server and tested every week.
- Limited staff access. ForestBill staff can open an agency's workspace only in a recorded support session: with a reason, for at most 60 minutes, with an email to the agency's Owners.
No system is perfectly secure. If a data breach affects you, we will tell you (and, where required, the authorities) without undue delay.
9. Data about an agency's clients (ForestBill as processor)
Agencies use ForestBill to bill their clients. For that data:
- The agency is the controller. It decides what data to put in ForestBill and why. We process it only to provide ForestBill to the agency, following our Data Processing Addendum.
- What it can include: names, email addresses, company names, phone numbers, addresses, tax numbers, invoices, payments, subscriptions, contracts and signatures (including the IP address and browser used to sign), files the agency uploads, and client portal sign-ins.
- We do not use agencies' client data for our own purposes, sell it, or use it for advertising.
- If you are a client of an agency and want to see, correct or delete your data, please contact that agency (its contact details are on its invoices, emails and pages). The agency can delete a client's personal data in ForestBill. If you write to us, we will pass your request to the agency.
10. How long we keep data
| Data | How long |
|---|---|
| Account, agency and client data | As long as the agency uses ForestBill |
| Sign-in codes and short links | Minutes to days, until used or expired |
| Data exports and report files | 7 days |
| Notifications | 90 days |
| Backups | Up to 12 months, then they expire. Deleted data disappears from backups when they expire |
When an agency closes its account:
- The agency can first export all its data.
- There is a 30-day grace period, during which the closure can be cancelled.
- After 30 days, personal data is deleted (names, email addresses, contact details, signatures, files, sign-in data).
- Financial records (invoices, payments, refunds, credit notes, subscriptions, contracts and the audit log) are kept in anonymised form for 5 years from the closure date, because the law asks for financial records to be kept. Then they are deleted for good.
ForestBill's own records about the agency as our customer (its name, plan and our invoices to it) are kept for our own accounting.
11. Your rights
Depending on where you live, you may have the right to:
- see the personal data we hold about you and get a copy;
- correct data that is wrong;
- delete your data, where we do not need to keep it;
- object to or limit some uses of your data;
- move your data to another service (an Owner can export all agency data at any time);
- complain to your data protection authority.
How to ask:
- If you are agency staff or a website visitor: write to support@forestbill.com. We will reply within 30 days. We may ask you to confirm who you are.
- If you are a client of an agency: contact the agency first (see section 9). We will help the agency answer.
Many things you can also do yourself in the app, such as changing your name, email or password, or turning on 2FA.
12. Children
ForestBill is for businesses. It is not meant for anyone under 18, and we do not knowingly collect data about children.
13. Changes to this policy
We may update this policy. For important changes we will email agency Owners at least 30 days before they apply. The date at the top shows the last update.
14. Contact
- Privacy requests and questions: support@forestbill.com
- General: hello@forestbill.com
- Post: Genyune SMC-Private Limited, [[REGISTERED ADDRESS]]
Questions about this page? Write to hello@forestbill.com.
ForestBill is a product of Genyune SMC-Private Limited, Karachi, Pakistan.