paybiil
Create account
Privacy policy

Your data, handled with care.

What we collect when you create an account, verify your identity and send money; why we collect it; who sees it; how long we keep it; and how to delete it.

LAST UPDATED: 5 SEPTEMBER 2026

1. Who we are and what this covers

PayBiil LTD (company number 17374104), 66 Paul Street, London, England, EC2A 4NA (“PayBiil”, “we”) is the controller of the personal data described in this policy. It covers the website at paybiil.com, the PayBiil app at paybiil.com/app, the PayBiil Android app (which opens that same app in a secure browser surface and collects nothing of its own), our enquiry forms and our communications with you (together, the “Services”).

PayBiil is a technology company. The regulated parts of the service — holding and moving money, and verifying who you are — are performed by a licensed payment and identity verification partner (the “Partner”). When you verify your identity or a payment is executed, the Partner processes your data as an independent controller under its own terms and privacy notice, which you accept inside the verification flow. Where this policy says “we share”, it means sending data to the Partner for those purposes, and to the service providers listed in section 5.

2. Information we collect

  • Account: your name, email address, password (stored only as a one-way hash by our authentication provider), phone number, country of residence, account type (personal or business) and, for a business, the registered company name.
  • Identity verification: the information you give in the Partner-hosted verification flow — legal name, date of birth, address, nationality, phone number, government identity document images and a selfie — together with the verification outcome the Partner returns to us. We receive the outcome and an account identifier; the documents themselves are held by the Partner.
  • Recipients and transfers: the recipients you save (name, country, bank account or IBAN details), and for each transfer the amount, currencies, exchange rate, fees, reference, status, timestamps and the account you paid from.
  • Support and enquiries: what you send us by email or through our forms, including your name, email address, company and message.
  • Technical and security data: IP address, browser and device type, requested pages, timestamps and security logs generated when you use the Services.

We do not collect precise or approximate location, contacts, calendar, microphone, health data, advertising identifiers or app-usage analytics, and we do not use analytics or advertising SDKs.

3. Why we use it and the legal basis

  • To provide the service you asked for — creating and running your account, saving recipients, quoting and arranging transfers, and telling you where a transfer stands (performance of a contract).
  • To meet legal obligations — identity verification, sanctions and fraud screening, record keeping and reporting under anti-money-laundering, counter-terrorist-financing and tax law, and responding to lawful requests from authorities (legal obligation).
  • To keep the Services secure and working — preventing fraud and abuse, monitoring, troubleshooting and improving the Services (our legitimate interests, which we balance against your rights).
  • To answer you — replying to enquiries and support requests (legitimate interests, or contract where you are a customer).
  • With your consent — only where we ask for it, for example optional product updates, which you can withdraw at any time.

We do not sell personal data, and we do not use it for advertising.

4. Automated checks

Identity verification, sanctions screening and fraud checks are carried out with automated tools, by the Partner and by us. A check that fails does not lock you out for good: you can ask for a person to review the decision by emailing privacy@paybiil.com, and the Partner offers the same in its flow.

5. Who we share it with

  • The Partner, to verify your identity and to execute payments — an independent controller for those regulated services.
  • Banks and payment networks involved in receiving your payment and delivering funds to your recipient, who see the details needed to route the payment.
  • Service providers acting on our instructions: website hosting, content delivery and serverless functions (Netlify), database and authentication (Supabase), email (Zoho) and form processing (Netlify). They may process data only to provide their service to us.
  • Authorities, regulators and law enforcement where the law requires it or to protect the Services, our customers or others.
  • Professional advisers and a successor in the event of a reorganisation, financing or sale of the business, under confidentiality.

6. International transfers

We are based in the United Kingdom. Some providers and the Partner process data in the European Economic Area and the United States. Where data leaves the UK we rely on UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with supplementary measures where appropriate. You can ask us about the safeguard that applies to your data.

7. How long we keep it

  • Account data: for as long as your account is open, then deleted within 30 days of closure, except where a longer period below applies.
  • Identity verification, transaction and compliance records: five years after your account closes or after the transaction they relate to, whichever is later, as required by the UK Money Laundering Regulations 2017 and equivalent rules binding the Partner. During that time the records are used only for legal and regulatory purposes.
  • Enquiries and support correspondence: for as long as needed to deal with the matter, and normally no more than 24 months afterwards.
  • Technical and security logs: up to 12 months.
  • Anything needed for an open dispute, complaint or legal claim: until it is resolved.

When a period ends, we delete the data or anonymise it irreversibly.

8. Deleting your account

You can close your account and ask for your personal data to be deleted at any time. The steps, what is deleted straight away and what the law makes us keep are set out on Delete your account. You can also remove some data — saved recipients, your phone number — without closing the account.

9. Your rights

Subject to the conditions and exemptions in UK GDPR and the Data Protection Act 2018, you may ask us for access to your personal data, correction, erasure, restriction, data portability, and to object to processing based on legitimate interests. Where processing relies on consent you may withdraw it at any time. Write to privacy@paybiil.com; we respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, though we would welcome the chance to help first.

10. Cookies

The app sets a strictly necessary cookie to keep you signed in and to protect your session. The website sets no analytics or advertising cookies. Because these cookies are essential, no consent banner is shown.

11. Security

All traffic is encrypted in transit. Passwords are stored only as one-way hashes. Access to personal data inside PayBiil is limited to the people who need it, our systems are monitored for abuse, and identity documents never pass through PayBiil systems: they go directly to the Partner's verification flow. No system is perfectly secure; if a breach affects your rights we will tell you and the ICO as the law requires.

12. Children

The Services are for people aged 18 or over. We do not knowingly collect personal data from anyone younger. If you believe a child has provided personal data through the Services, contact us and we will review and delete it where appropriate.

13. Changes to this policy

We update this policy when the Services, providers or legal requirements change. We publish the revised policy here, change the “Last updated” date, and give you additional notice where a change materially affects how we use your personal data. Our Google Play Data safety declaration is kept consistent with this policy.

14. Contact

PayBiil LTD is the controller and privacy contact. For questions, rights requests or deletion requests, email privacy@paybiil.com or write to PayBiil LTD, 66 Paul Street, London, England, EC2A 4NA, United Kingdom.