Privacy policy

Last updated 3 November 2026

1. Who we are

MakeMeABill (makemeabill.com) is a free online tool for creating invoices and similar business documents. It is operated by UKKALO-F.Z.E (“we”, “us”). We are responsible for the personal data described in this policy. You can contact us about privacy at hello@makemeabill.com.

2. Information you put into documents

Everything you type or upload into the generator stays in your browser. That includes business and customer details, addresses, tax numbers, line items, amounts, bank details, notes, logos and signatures. Calculations, previews and PDF creation all happen on your device. This information is not sent to our servers, our API, our analytics or any third party, and we have no way to see it.

When you download or print a document, the file is created by your browser. Where you store or send it is up to you.

3. Information stored on your device

To make the tool work smoothly, your browser stores some information locally. It stays on your device and is not sent to us:

• Your unfinished draft, so a refresh doesn’t lose your work. It is deleted automatically after 30 days. You can turn draft saving off, or delete the draft immediately, from the “⋯” menu in the generator.
• The last invoice number you used, to suggest the next one.
• Your choice to save drafts or not.

We do not use cookies, and we don’t store anything on your device for analytics or advertising. See the cookie & analytics notice for details.

4. Usage analytics

To understand how the service is used, fix problems and prevent abuse, we record usage events such as “generator opened”, “template selected”, “PDF downloaded”, “invoice printed” and “PDF failed”. An event can contain:

• the event name and, where relevant, the template chosen;
• for errors, a short technical error code such as “TypeError: Failed to fetch”, with no document content;
• the page path, without query parameters;
• the hostname of the website that linked to us (for example www.google.com) and a utm_source campaign tag, if present in the link;
• your approximate country;
• your device type (desktop, mobile or tablet), browser family and operating system family, without version numbers;
• a shortened IP address and a visitor identifier, described below;
• the time the event was received.

Events never contain the content of your documents, or any names, addresses, email addresses, phone numbers, bank details, amounts or line items.

How we process country and IP address

Your IP address is sent to us automatically, as with any website. We handle it like this:

1. Our hosting provider (Vercel) determines your approximate country from your IP address when your browser contacts our website. We store only the two-letter country code, never your city or precise location.
2. Our server uses your full IP address only in memory, for two purposes: rate limiting (to block floods of automated requests), and calculating a visitor identifier. The full address is never written to our database or our application logs.
3. We store a shortened IP address with the last part removed (for example 203.0.113.0, or the first 48 bits of an IPv6 address). This identifies a network, not a device. We use it to investigate abuse and errors, and delete it after 30 days.
4. The visitor identifier is a one-way code calculated from your IP address, your browser’s user-agent string, the current calendar month and a secret key. It lets us count unique visitors without cookies. It changes every month, cannot be turned back into your IP address, and is not combined with any other information to identify you.

Automated traffic, such as search-engine crawlers and scripts, is recognised from its user agent, flagged, and excluded from our statistics.

Opting out: if your browser sends a Global Privacy Control or Do Not Track signal, the site sends no usage events at all.

5. Feedback and messages

If you choose to send feedback through the site, we store your rating, any comment you write, your approximate country and device type, and the time it was sent. Please don’t include personal or document information in comments. If you email us, we receive your email address and message and use them only to reply.

6. Server and security logs

Our hosting providers keep technical logs of requests, which can include IP addresses, to deliver the service and protect it against attacks. Our own application logs record only the type of request, the path and the result code. They do not include your IP address or the content of requests.

7. Why we use this information

We process the information above for these reasons:

• Running, securing and improving the service: usage analytics, error reports, rate limiting and security logs. This is in our legitimate interest in operating a reliable, abuse-free tool and understanding which features help people. We keep the data minimal and pseudonymous, so the impact on you is low.
• Responding to you: feedback and messages you choose to send.
• Meeting legal obligations, where they apply.

We don’t use your information for advertising or profiling, we don’t sell it, and we don’t make automated decisions about you.

8. Hosting and third-party providers

We use a small number of service providers. They process data on our behalf and only to provide their service to us:

• Vercel Inc. hosts the website and delivers it through a global network. Vercel processes request data, including IP addresses, to serve pages and determine approximate country. Its servers are located in several countries, including the United States.
• Hostinger provides the virtual private server that runs our API and database. Analytics and feedback are stored there.
• An offsite backup storage provider holds copies of our database, transferred over encrypted connections, so we can recover from failures.

We don’t use third-party analytics, advertising or social-media tracking scripts. We may disclose information if the law requires it, or to protect the rights and safety of our users and the service.

Some providers process data outside your country. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the providers’ standard contractual clauses.

9. How long we keep information

10. Security

Our database is not reachable from the internet. It is accessible only to our API, using an account with the minimum permissions needed. Connections are encrypted with HTTPS. Access to analytics is restricted to authorised administrators. No system is perfectly secure, but we limit what we collect so that very little could be exposed.

11. Your rights

Depending on where you live, you may have the right to access, correct or delete personal data about you, to object to or restrict its processing, and to complain to a data protection authority. This includes, for example, the GDPR in the EU and UK, the UAE Personal Data Protection Law and US state privacy laws.

Because we don’t ask for your name or email and our analytics are pseudonymous, we usually can’t tell which records relate to you. If you contact us, we will do our best to help. For example, if you tell us the approximate date and time of your visit and your IP address, we may be able to find and delete matching records from the last 30 days. We will never ask you for document contents. To stop analytics entirely, enable Global Privacy Control or Do Not Track in your browser.

12. Children

The service is intended for businesses and adults. It is not directed at children, and we don’t knowingly collect information from them.

13. Changes to this policy

If our practices change, we will update this page and the date at the top. If the change is significant, for example a new type of data or a new purpose, we will make it clear on the site.

14. Contact

For any privacy question or request, contact us at hello@makemeabill.com.