Privacy Policy

This policy explains what information TentaBill collects, how we use it, and the choices you have. TentaBill (“we,” “us”) provides contractor time-tracking and invoicing software, including Percy, our AI assistant, and an optional integration with Microsoft 365 Copilot.

1. Information we collect

Account & identity

You sign in with Microsoft 365. From that sign-in we receive your name, email address, and Microsoft Entra object identifier (a stable user id), which we use to identify your account and keep your data separate from other users’.

Data you enter

The business records you create in TentaBill — customers, projects, time entries, invoices, payments, templates, and settings. This is your data; you control it.

Microsoft 365 data (with your consent)

If you grant the relevant permissions, we access Microsoft Graph to: read your profile, send invoice emails from your own mailbox (Mail.Send), and optionally read calendar and mailbox settings to help with availability. We request the minimum scopes needed and act only on your behalf.

Percy & AI

When you use Percy, we process your prompts, the tool results Percy retrieves from your workspace, and Percy’s responses, in order to answer you.

Usage & diagnostics

We record product-usage events (for example, which features are used) and error/diagnostic logs to operate and improve the service. We do not use this to build advertising profiles.

2. How we use your information

• Provide the service — track time, produce invoices, and, at your request, send them from your mailbox.
• Authenticate you and isolate your data from other tenants.
• Power Percy’s answers over your own workspace.
• Maintain security, prevent abuse, and troubleshoot problems.
• Improve features and reliability using aggregated, non-identifying usage data.

We do not sell your personal information.

3. Microsoft 365 & Copilot integration

TentaBill offers an optional agent for Microsoft 365 Copilot. When you use it, Microsoft’s identity platform issues a token representing you and passes it to TentaBill’s secure endpoint. We validate that token and return only your own workspace data. TentaBill never receives your Microsoft password or credentials, and the integration does not give TentaBill access to your broader Microsoft 365 content beyond the permissions you grant.

4. AI processing & Percy

Percy is powered by an AI model provider. Depending on your configuration, that is either a provider you connect with your own key (“bring your own AI”) or a provider we operate on your behalf. When Percy answers, the necessary prompt and workspace data are sent to that provider to generate a response, subject to that provider’s terms. We do not authorize AI providers to train their public models on your business data, and where a provider offers a no-training option for API usage, we rely on it. If you bring your own provider, your use of it is also governed by your agreement with them.

5. Sharing & service providers

We share data only with providers that help us run the service, under agreements that limit their use of it:

• Hosting — our application runs on Vercel.
• Database — your records are stored in a managed PostgreSQL database (Supabase), encrypted in transit and isolated per tenant.
• Microsoft — for sign-in and, with your consent, Microsoft Graph (e.g., sending invoices).
• AI provider — the model provider that powers Percy, as described above.

We may also disclose information if required by law, or to protect the rights, safety, and security of TentaBill and its users.

6. Data retention & deletion

We keep your data for as long as your account is active. You can export or delete your records from within the app. If you close your account, we delete or de-identify your data within a reasonable period, except where we must retain it to comply with legal obligations.

7. Security

We protect your data with encryption in transit (TLS), database-level tenant isolation (row-level security), and encryption at rest for sensitive secrets such as connected-mailbox tokens and AI keys. No system is perfectly secure, but we work to safeguard your information and to limit access to it.

8. Your rights & choices

• Access & export — view and export your data from the app.
• Correction & deletion — edit or delete your records at any time.
• Disconnect Microsoft 365 — revoke the app’s access from your Microsoft account settings.
• Turn off AI — disable Percy, after which no data is sent to an AI provider.

Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA; contact us to exercise them.

9. Changes to this policy

We may update this policy from time to time. When we do, we’ll revise the “Last updated” date above, and for material changes we’ll provide a more prominent notice.

10. Contact us

Questions about this policy or your data? Email privacy@tentabill.com.