Privacy Policy

BillFi provides billing, RADIUS, captive-portal and network automation software to internet service providers ("Customers"). In this policy, "we", "us" and "our" refer to BillFi. "You" refers to a Customer, a Customer's employee, or a subscriber of a Customer whose data flows through BillFi.

Where a Customer processes their subscribers' data through BillFi, the Customer is the data controller and BillFi acts as a data processor under a separate Data Processing Addendum (DPA).

The categories of personal data we may process include:

• Customer account data: name, email, phone, company name, billing address, role.
• Subscriber data (on behalf of Customers): name, address, ID/KYC details where the Customer's jurisdiction requires it, contact number, plan, invoice history, payment status.
• Network & session data: RADIUS authentication records, session start/stop, framed IP, NAS identifier, upload/download counters.
• Payment metadata: transaction IDs, gateway references, amounts, currency, timestamps. We do not store card PANs — those live with our PCI-compliant gateway partners.
• Usage & telemetry: pages viewed inside the admin app, feature usage, error logs, IP address of the admin session.

• Provide, secure and improve the BillFi service.
• Authenticate subscribers and reconcile payments on our Customer's behalf.
• Send transactional email/SMS (invoice reminders, receipts, system alerts).
• Respond to support requests, incidents and abuse reports.
• Meet legal, tax and regulator obligations.

We do not sell personal data. We do not use subscriber data to train third-party AI models.

Where GDPR applies, we rely on:

• Contract — to deliver the service to a Customer.
• Legitimate interests — security, fraud prevention, service improvement.
• Legal obligation — tax, accounting, lawful requests from competent authorities.
• Consent — where explicitly requested (for example, marketing emails).

BillFi uses vetted sub-processors to operate the service — cloud hosting, email/SMS delivery, error tracking and payment gateways selected by the Customer. A current list is available on request and in the DPA.

We disclose data to law enforcement or regulators only when we have a valid legal basis, and where practical we notify the affected Customer first.

Customer account data is retained for the life of the subscription and up to 90 days after cancellation, unless a longer period is required by law. Subscriber data retention is controlled by the Customer — deletion requests from a Customer are honoured within 30 days.

Backup snapshots are kept encrypted and cycled on a 35-day rolling schedule.

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We enforce role-based access, per-action audit logs and require 2FA for BillFi staff with production access. See our Security & DPA page for details on platform controls.

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict or port personal data we hold about you, and to object to certain processing. If you are a subscriber of one of our Customers, please contact your ISP first — they act as the controller of your data.

For requests we can act on directly, email privacy@billfi.net. We respond within 30 days.

BillFi operates infrastructure in multiple regions. Where personal data is transferred out of the EEA/UK, we rely on Standard Contractual Clauses and supplementary safeguards appropriate to the destination.

BillFi is a B2B service intended for internet service providers. We do not knowingly collect data from children under 16. If you believe we have, contact us and we will delete it.

We update this page when the service or our practices change. The "Effective" date at the top reflects the latest revision. Material changes are communicated to Customer admins by email.

Privacy questions: privacy@billfi.net. For a signed DPA or a sub-processor list, request it via the same address.