Privacy Policy for Trackbill.ai
Last Updated: July 24, 2026Trackbill.ai 隱私政策最後更新日期：2026 年 7 月 24 日
Start managing your finance better
1. Introduction
Welcome to Trackbill.ai ("Trackbill", "we", "us", or "our"). We are committed to protecting your privacy and managing your personal data in a transparent, secure, and lawful manner.
This Privacy Policy ("Policy") explains how we collect, use, store, transfer, and protect your personal data when you use our expense tracking and receipt management services, including our website (the "Site"), our integration with third-party messaging services (such as WhatsApp), and our integrations with cloud storage and accounting platforms (collectively, the "Service").
This Policy complies with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO") and other applicable data protection laws. By creating an account, accessing, or using our Service, you acknowledge that you have read and understood this Policy.
2. Statement of Policy
We comply with the Data Protection Principles ("DPP") under the PDPO. Specifically, we ensure that:
- Personal data is collected lawfully and fairly for directly related purpose(s).
- All practicable steps are taken to ensure personal data is accurate and not kept longer than necessary.
- Personal data is used strictly for the purpose for which it was collected (or a directly related purpose), unless explicit consent is given.
- Personal data is protected against unauthorized or accidental access, processing, erasure, loss, or use.
- Data subjects have the right to access and correct their personal data.
3. What Personal Data We Collect
We collect the minimum personal data necessary to operate and improve our Service.
A. Information You Provide Directly
- Account Information: Name, email address, company name, and encrypted account credentials when you register on our Site.
- Contact & Identifier Data: Your WhatsApp phone number, required to link your messaging account to our receipt processing engine.
- Financial Content & Receipts: Images of receipts, invoices, bills, transaction notes, and associated messages sent via WhatsApp, uploaded via desktop, or extracted from connected services ("User Content").
B. Information Collected Automatically
- Extracted Financial Data: Data automatically extracted by our AI engine from your User Content, including vendor names, transaction dates, amounts, tax/VAT breakdown, currency, and line items (including bilingual English/Chinese receipt text).
- Technical & Usage Data: IP address, browser type, operating system, device diagnostics, and usage statistics collected when visiting our Site.
C. Data from Third-Party Integrations
- Google Workspace (Gmail & Google Drive): With your explicit permission, we programmatically scan your inbox specifically to identify and extract financial receipts/invoices, or pull files from designated Drive folders.
- Accounting Software (Xero, QuickBooks, Zoho): We maintain authenticated secure connection tokens solely to export extracted data to your connected accounting software. We do not pull, store, or monitor your historical banking or ledger records.
4. Purpose of Data Collection and Use
We process your personal data for the following specific purposes:
- Service Provision: To process receipt images using artificial intelligence (such as enterprise AI processing models), extract structured data, and generate expense reports.
- Third-Party Integrations: To push formatted financial data and receipt attachments to your connected accounting platforms (Xero, QuickBooks, Zoho) or cloud spreadsheets (Google Sheets).
- Account Administration & Billing: To manage your account, process subscription payments via secure third-party payment gateways (e.g., Stripe), and issue billing invoices.
- Customer Support & Service Updates: To communicate essential updates, technical alerts, security notices, and support responses.
- System Improvement: To train and refine our internal receipt extraction algorithms using aggregated, fully anonymized data that cannot identify any individual.
Google Limited Use Disclosure: Trackbill's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Direct Marketing (Hong Kong PDPO Part 6A Compliance)
We strictly respect your preferences regarding direct marketing communications (such as promotional emails, feature updates, or special offers).
- Consent Required: We will not use your personal data (including your email address or WhatsApp number) for direct marketing purposes unless we have obtained your explicit, opt-in consent.
- Opt-Out Right: You may opt out of receiving direct marketing communications at any time, free of charge, by:
- Clicking the "Unsubscribe" link in any marketing email;
- Adjusting your notification preferences in your Trackbill account dashboard; or
- Contacting our Data Protection Officer at privacy@trackbill.ai.
Service-related notices (e.g., password resets, payment receipts, system downtime warnings) are non-promotional and are excluded from direct marketing opt-outs.
6. Disclosure and Sharing of Personal Data
We do not sell, rent, or trade your personal data. We only share personal data with trusted third-party data processors strictly necessary for providing the Service:
- Cloud Infrastructure Providers: Secure hosting and encrypted storage providers (e.g., Amazon Web Services, Google Cloud Firebase).
- AI & OCR Processors: Enterprise-tier AI service providers used to parse receipt images. Content submitted to these enterprise models is processed securely and is not used by third parties to train public AI models.
- Third-Party Communication Channels: Messaging interfaces (e.g., WhatsApp/Meta) used to receive your incoming receipt submissions.
- Legal Requirements: We may disclose your data if required to do so by Hong Kong law, court order, or lawful request by government or law enforcement authorities.
7. Cross-Border Transfer of Personal Data
Your personal data may be transferred to, stored, and processed on servers located outside of Hong Kong (primarily in the United States and Singapore cloud regions).
By using the Service, you acknowledge and agree to the transfer of your data to servers outside Hong Kong. We ensure that overseas service providers maintain physical, technical, and organizational security standards equivalent to the protection required under the HK PDPO.
8. Data Retention and Erasure
- Retention Period: We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or to satisfy legal, accounting, or reporting requirements.
- Account Deletion: You may delete your account at any time via your account settings page. Upon account deletion:
- Account access is immediately revoked.
- Your data enters a 30-day grace period (to prevent accidental data loss).
- After 30 days, all account details, receipt images, extracted financial data, and third-party access tokens are permanently and unrecoverably deleted from our live systems.
9. Data Security
We implement robust security measures to safeguard your sensitive financial information:
- Encryption: Data in transit is secured using SSL/TLS protocols. Data at rest (receipt images and database records) is encrypted using industry-standard AES-256 encryption.
- OAuth Authentication: We use secure tokenized OAuth authorization for third-party integrations (Google, Xero, QuickBooks). Trackbill never sees or stores your third-party account passwords.
- Access Control: Strictly enforced Role-Based Access Controls (RBAC) ensure that only authorized technical staff have access to system infrastructure for maintenance purposes.
10. Data Access and Correction Rights (HK PDPO)
Under the Hong Kong Personal Data (Privacy) Ordinance, you have the right to:
- Check whether we hold personal data about you and request access to such data;
- Require us to correct any personal data relating to you that is inaccurate;
- Ascertain our policies and practices in relation to personal data.
To exercise your Data Access Request (DAR) or Data Correction Request, please contact our Data Protection Officer in writing (details below). In accordance with the PDPO, we may charge a reasonable fee for processing any data access request.
11. Third-Party Websites and Services
Our Service integrates with third-party applications (such as WhatsApp, Google Workspace, Xero, and QuickBooks). This Privacy Policy applies solely to Trackbill.ai. We are not responsible for the privacy practices or content of third-party platforms. We encourage you to read the privacy policies of any connected third-party platform.
12. Changes to This Privacy Policy
We reserve the right to modify this Privacy Policy at any time. If material changes are made, we will notify you by email or via a prominent notification on our Site at least 14 days before the changes take effect.
13. Contact Us / Data Protection Officer
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer:
Trackbill.ai Data Protection Office
Email: privacy@trackbill.ai
General Support: support@trackbill.ai
Address: 19/F, Tesbury Centre, Queen's Road East, Wanchai, Hong Kong
1. 引言
歡迎使用 Trackbill.ai（以下簡稱「Trackbill」、「我們」或「本公司」）。我們承諾保護您的個人私隱，並以透明、安全及合法的方式處理您的個人資料。
本隱私政策（下稱「本政策」）旨在說明當您使用我們的開支追蹤及收據管理服務、網站（下稱「本網站」）、第三方即時通訊軟件（如 WhatsApp）整合功能，以及雲端儲存與會計平台整合服務（統稱「本服務」）時，我們如何收集、使用、儲存、傳輸及保護您的個人資料。
本政策符合香港法例第486章《個人資料（私隱）條例》（「《私隱條例》」）及其他適用之數據保護法律。當您註冊帳戶、存取或使用本服務時，即代表您已閱讀、理解並同意本政策之內容。
2. 政策聲明
我們嚴格遵守《私隱條例》下的保障資料原則（DPP）。具體而言，我們確保：
- 個人資料的收集方法合法且公平，並僅用於與本服務直接相關的目的。
- 採取所有合理可行措施，確保個人資料準確無誤，且保存時間不超過所需期限。
- 除非獲得您的明確同意，否則個人資料僅用於收集時指定的目的（或直接相關的目的）。
- 採取嚴密的安全措施，保護個人資料免受未經授權或意外的查閱、處理、刪除、遺失或使用。
- 資料當事人享有查閱及更正其個人資料的權利。
3. 我們收集的個人資料
我們僅收集營運及改善本服務所必需的最少個人資料。
A. 您直接提供的資料
- 帳戶資料：當您在本網站註冊時提供的姓名、電郵地址、公司名稱及經加密的帳戶憑證。
- 聯絡及識別資料：您的 WhatsApp 電話號碼（用於將您的通訊帳戶與我們的收據處理引擎連結）。
- 財務內容及收據：您透過 WhatsApp、桌面端上傳或從連結服務中擷取的收據影像、發票、賬單、交易備忘及相關訊息（統稱「用戶內容」）。
B. 自動收集的資料
- 擷取的財務數據：我們的人工智能（AI）引擎從您的「用戶內容」中自動擷取的結構化數據，包括商戶名稱、交易日期、金額、稅項明細、貨幣及項目明細（包含中英文混合之收據文字）。
- 技術及使用數據：您訪問本網站時收集的 IP 地址、瀏覽器類型、操作系統、設備診斷數據及使用統計。
C. 來自第三方整合功能的資料
- Google Workspace（Gmail 及 Google Drive）：在獲得您的明確授權後，我們會透過程式掃描您的收件箱，專門識別並擷取財務收據／發票，或從指定的 Google Drive 文件夾中讀取檔案。
- 會計軟件（Xero、QuickBooks、Zoho）：我們僅維護安全的授權令牌（Tokens），以將擷取的數據單向匯出至您連結的會計軟件。我們不會讀取、儲存或監控您的歷史銀行記錄或賬目總簿。
4. 收集及使用個人資料的目的
我們出於以下特定目的處理您的個人資料：
- 提供服務：使用人工智能（如企業級 AI 處理模型）解析收據影像、擷取結構化數據並生成開支報告。
- 第三方整合：將格式化的財務數據及收據附件推送至您連結的會計平台（Xero、QuickBooks、Zoho）或雲端試算表（Google Sheets）。
- 帳戶管理與賬務處理：管理您的帳戶、透過安全的第三方支付網關（如 Stripe）處理訂閱付款，並開立服務發票。
- 客戶支援與服務更新：向您發送必要的服務更新、技術通知、安全警報及支援回覆。
- 系統改進：使用經過去識別化及完全匿名化的概要數據，訓練並優化我們的收據擷取演算法（此類數據無法識別任何個人）。
Google API 限制使用聲明：Trackbill 對於從 Google API 接收到的資訊的使用與傳輸，將嚴格遵守 Google API 服務用戶數據政策，包括其中的「限制使用」（Limited Use）要求。
5. 直接促銷（符合香港《私隱條例》第6A部規定）
我們嚴格尊重您對直接促銷訊息（如推廣電郵、新功能通知或特別優惠）的偏好。
- 必須獲得事先同意：除非事先獲得您的明確選擇性同意（Opt-in），否則我們不會將您的個人資料（包括電郵地址或 WhatsApp 號碼）用於直接促銷。
- 隨時取消訂閱的權利：您可以隨時免費選擇停止接收直接促銷訊息，途徑包括：
- 點擊任何行銷電郵底部的「取消訂閱」（Unsubscribe）連結；
- 在 Trackbill 帳戶後台調整通知設定；或
- 電郵聯絡我們的資料保護主任：privacy@trackbill.ai。
與服務相關的必要通知（如重設密碼、付款收據、系統維護警告）不屬於直接促銷，不受此取消訂閱機制影響。
6. 個人資料的披露與共享
我們絕不出售、出租或交易您的個人資料。我們僅在提供服務所必需的情況下，與以下可信賴的第三方「資料處理者」共享資料：
- 雲端基礎設施提供商：安全的託管及加密儲存服務商（如 Amazon Web Services、Google Cloud Firebase）。
- AI 及光學字元識別（OCR）處理商：用於解析收據影像的企業級 AI 服務提供商。提交予此類企業級模型的內容均經安全處理，不會被第三方用於訓練公開的 AI 模型。
- 第三方通訊渠道：用於接收您傳輸收據的通訊介面（如 WhatsApp / Meta）。
- 法律要求：若根據香港法律、法院命令或政府／執法機關的合法要求，我們可能會依法披露您的資料。
7. 個人資料的跨境傳輸
您的個人資料可能會被傳輸至香港境外（主要位於美國及新加坡的雲端伺服器）進行儲存及處理。
使用本服務即代表您知悉並同意將資料傳輸至香港境外的伺服器。我們確保海外服務提供商維持與香港《私隱條例》要求相當的物理、技術及組織安全標準。
8. 資料保存與刪除
- 保存期限：我們僅在實現收集目的所必需的時間內，或在滿足法律、會計及報告要求的期限內保存您的個人資料。
- 帳戶刪除：您可以隨時透過帳戶設定頁面申請刪除帳戶。刪除帳戶後：
- 帳戶存取權限將立即被終止。
- 您的數據將進入為期 30 天的緩衝期（以防止意外刪除）。
- 30 天後，所有帳戶資料、收據影像、擷取的財務數據及第三方授權令牌將從我們的營運系統中永久且不可復原地刪除。
9. 資料安全
我們採取嚴格的安全措施以保障您敏感的財務資料：
- 數據加密：傳輸中的數據採用 SSL/TLS 協議加密；靜止數據（收據影像及資料庫記錄）採用行業標準的 AES-256 加密技術。
- OAuth 安全授權：第三方整合（Google、Xero、QuickBooks）均採用安全的 OAuth 令牌機制。Trackbill 絕不會檢視或儲存您的第三方帳戶密碼。
- 權限控制：嚴格執行基於角色的權限控制（RBAC），確保僅限授權的技術人員出於系統維護目的存取基礎設施。
10. 查閱及更正資料的權利（香港《私隱條例》）
根據香港《個人資料（私隱）條例》，您享有以下權利：
- 查詢我們是否持有您的個人資料，並要求查閱該等資料；
- 要求我們更正任何與您有關的不準確個人資料；
- 瞭解我們對於個人資料的政策及實務。
如欲提出查閱資料要求（DAR）或更正資料要求，請以書面形式聯絡我們的資料保護主任（聯絡方式見下文）。根據《私隱條例》規定，我們處理查閱資料要求時可能會收取合理的行政費用。
11. 第三方網站及服務
本服務整合了第三方應用程式（如 WhatsApp、Google Workspace、Xero 及 QuickBooks）。本隱私政策僅適用於 Trackbill.ai。我們對第三方的私隱慣例或內容不承擔任何責任，建議您閱讀所連結之第三方平台的隱私政策。
12. 本隱私政策的變更
我們保留隨時修改本隱私政策的權利。如有重大變更，我們將在變更生效前至少 14 天透過電郵或本網站上的顯眼通知告知您。
13. 聯絡我們／資料保護主任
若您對本隱私政策或個人資料處理有任何疑問、意見或要求，請聯絡我們的資料保護主任：
Trackbill.ai 資料保護辦公室
電郵：privacy@trackbill.ai
客戶支援：support@trackbill.ai
地址：19/F, Tesbury Centre, Queen's Road East, Wanchai, Hong Kong
14-day free trial, no credit card required
Start managing your finance better
Drive Efficiencies.
Trackbill is a cutting-edge financial technology platform offering secure, seamless financial services ranging from auditing.
No credit card required. Unsubscribe anytime.
Setup in under 5 minutesBank-level encryptionWhatsApp-native