Privacy Policy

Kontroma Private Limited, incorporated in India (CIN placeholder), operates the Reimbilly platform at reimbilly.app and app.reimbilly.app (“the Service”). Grievance Officer: Sachin Zore — grievance@reimbilly.app.

• Account data: Name, email address, phone number (optional), profile photo.
• Expense data: Receipt images, vendor names, amounts, dates, categories, notes, GST details.
• Organisation data: Company name, team memberships, roles, spending policies.
• Usage data: App events, feature usage, crash reports (via Sentry), device type, OS version.
• Payment data: We do not store card numbers. Payment is processed by Razorpay; we store only payment references and status.
• Chat messages: Stored as ciphertext only. We cannot read message content.

• Providing and improving the Service.
• Processing expense reports and approvals.
• Sending transactional emails (approval notifications, invitations).
• Analytics to improve features (aggregated, not sold to advertisers).
• Compliance with legal obligations.

We process personal data on the following bases: (a) consent — for marketing; (b) contract — to provide the Service you signed up for; (c) legitimate interest — for security and fraud prevention; (d) legal obligation — for tax and regulatory purposes.

We share data with the following sub-processors:

• Supabase Inc. — database and auth (ap-south-1).
• Sentry Inc. — crash reporting.
• Resend Inc. — transactional email.
• Razorpay Software Pvt. Ltd. — payment processing.

We do not sell your data. We do not use your data for advertising.

• Free plan: 3 months of expense data after account deletion.
• Pro plan: 2 years.
• Business / Enterprise: 5 years or as contractually agreed.
• Deleted accounts: All personal data purged within 30 days, except where legally required.

Under the DPDP Act 2023 and GDPR, you have the right to:

• Access and export your personal data (Settings → Data Export).
• Correct inaccurate data.
• Delete your account and data.
• Withdraw consent for marketing.
• Lodge a complaint with a supervisory authority.

To exercise your rights, email privacy@reimbilly.app.

The marketing website (reimbilly.app) uses essential cookies only (session, CSRF). No analytics cookies, no advertising cookies. The web app (app.reimbilly.app) uses local storage for offline caching and session persistence.

See our Security page for a full description of our technical and organisational measures.

We will notify you by email and in-app notification at least 14 days before material changes take effect. Continued use of the Service constitutes acceptance.

Grievance Officer: Sachin Zore
Email: grievance@reimbilly.app
Response time: Within 30 days (DPDP Act 2023 requirement).