Bill

BILL Privacy Notice: Key Points and Risks

Effective date: January 30, 2026

Applies to: BILL Holdings, Inc. and its subsidiaries and affiliates, including Bill.com, DivvyPay, and Invoice2go. It covers websites, apps, products, services, marketing activities, surveys, promotions, and related interactions.

1. Data Collection and Use

What BILL collects

The notice says BILL may collect information from:

• You directly, including information provided when creating or managing an account, using services, contacting support, or giving feedback.
• Your use of the Services, although this section is largely unspecified in the provided text. The type of information collected depends on the products used, account configuration, privacy settings, location, and applicable law.
• Third parties, such as banks, accounting software providers, and other sources, where legally permitted.

BILL may combine information imported from third parties with information collected through other BILL products. Data is therefore not necessarily confined to the particular service you use.

The notice does not provide a detailed list of data categories in the supplied version. Depending on the service, users should expect that financial, account, transaction, device, usage, contact, and identification-related information may be involved.

How BILL uses information

BILL may use information to:

• Provide, facilitate, administer, and support the Services;
• Improve and develop products and features;
• Protect the Services, network, and accounts;
• Market BILL products and services, subject to available opt-outs;
• Conduct targeted online advertising;
• Comply with anti-money-laundering, know-your-customer, sanctions, anti-terrorism financing, and other legal requirements;
• Perform other purposes permitted by law or specifically authorized by you.

Risk: The purposes are broad, and information may be used across BILL’s corporate family and product ecosystem.

2. User Rights and Choices

Users can generally:

• Update or correct certain account information through account settings;
• Change communication preferences;
• Opt out of marketing emails using “unsubscribe”;
• Opt out of marketing texts by replying “STOP”;
• Adjust device permissions, cookies, and browser settings;
• Seek additional rights under applicable state, national, or regional privacy laws.

Marketing opt-outs may take up to 10 days. Opting out does not stop essential account, service, security, or transactional communications.

Certain jurisdictions, including California and other locations identified in BILL’s supplemental notices, may provide additional rights such as access, deletion, correction, restriction, portability, or opting out of targeted advertising or certain “sale” or “sharing.” The specific rights and procedures are not set out fully here and require reviewing the applicable supplemental notice.

3. Third-Party Sharing

BILL may disclose information:

• Among BILL companies, affiliates, subsidiaries, and its parent company;
• To third parties you authorize;
• To service providers and business partners assisting with operations;
• When required or permitted by law;
• With your consent.

BILL states it will not sell, rent, lease, or trade personal information for another party’s marketing purposes without consent. However, this does not necessarily prohibit other forms of disclosure, targeted advertising, business transfers, analytics, or disclosures treated as “sale” or “sharing” under particular state laws.

4. AI/ML Training

The notice does not expressly state whether personal information is used to train artificial intelligence or machine-learning models. It permits broad uses to improve Services, but that language should not be assumed to authorize AI training specifically. Users seeking certainty should request clarification from BILL or review applicable product-specific terms.

5. Key User Obligations and Restrictions

• Do not allow children, as defined by applicable law, to use the Services.
• Protect your account credentials and never share your BILL password.
• Be cautious when posting in blogs or community forums: posts may be publicly read, copied, or used by others.
• Understand that disabling cookies or device permissions may impair functionality or require additional authentication.
• Continued use of the Services or participation in Marketing after an updated notice is posted constitutes acceptance of the updated practices.

6. Liability, Security, and Disputes

BILL describes its safeguards as “commercially reasonable” and references SOC 1, SOC 2, SOC 3, and other security attestations. However, it expressly states that security is not guaranteed and information could be accessed, altered, disclosed, or destroyed.

This notice contains no detailed dispute-resolution procedure, governing law, indemnity, damages cap, or liability exclusion. Those provisions likely appear in the applicable BILL Terms of Service, which should be reviewed separately. The notice also does not promise compensation for breaches.

Information may be transferred to and stored in the United States or other countries with potentially weaker privacy protections. Use of the Services is stated to constitute consent to these international transfers.

7. Retention and Policy Changes

BILL retains information as long as needed to:

• Provide Services or administer accounts;
• Follow internal retention policies;
• Meet legal obligations;
• Resolve disputes;
• Preserve legal rights; or
• Enforce agreements.

The notice may be updated by posting a revised version with a new effective date. Where legally required, BILL will provide additional notice. Otherwise, continued use constitutes consent. Users who object may cancel their account, but the notice does not explain whether previously collected information will then be deleted.