Draft – not legal advice. This is a plain-English template. It has not yet been reviewed by a lawyer.
Privacy policy
Last updated: 2 November 2026
Who we are
Bill Fighter (mybillfighter.co.uk) is run by Mitchell Humby, a sole trader in the UK trading as Bill Fighter (website: https://mybillfighter.co.uk, email: hello@mybillfighter.co.uk). We are the "controller" of your personal data under UK GDPR and the Data Protection Act 2018. ICO registration number: pending (registration in progress; we will add the number here once issued).
The short version
- Bills you upload are read and then deleted immediately. We never keep the file.
- We only store what you choose to save: your email, and for each saved contract its type, provider, monthly cost and end date.
- We don't sell your data or use it for advertising.
What we collect and why
| Data | Why | Lawful basis | How long |
|---|---|---|---|
| Uploaded bill photos/PDFs | To read the details for you | Contract (you asked us to) | Deleted straight after reading, usually within seconds. Not stored. |
| Details you type or confirm in the bill tool (name, account number, prices) | To show your savings and build your letter | Contract | Kept only in your own browser (local storage), not on our server, unless you save the contract to your account. |
| Account: email, password (stored only as a secure hash), whether your email is confirmed, reminder setting | To let you log in, confirm your address and reset your password | Contract | Until you delete your account |
| Login session (a random code stored as a hash, with an expiry date) | To keep you logged in | Contract | Up to 30 days, or until you log out |
| Saved contracts: type, provider, monthly cost, end date | To show your dashboard and send reminders | Contract | Until you delete them or your account |
| Reminder emails sent | To avoid sending duplicates | Legitimate interests | Until the contract is deleted |
| Waitlist email | To send launch updates | Consent | Until you ask us to remove it (email hello@mybillfighter.co.uk; it isn't removed when you delete an account) |
| Server logs (IP address, time, page address) | Security and preventing abuse | Legitimate interests | Up to 30 days |
| Emails we send you (sign-up confirmation, password reset, reminders) | To run your account | Contract | Our email provider keeps delivery records (Resend) under its own retention policy. We don't keep copies. |
We keep a short-term count of requests per IP address in memory to stop abuse (cleared within an hour, never written to disk).
We don't store account numbers or your name on our server. Please black out anything you don't want read before uploading.
Who we share it with
Only service providers who help us run Bill Fighter, under contract: our hosting provider Hetzner Online GmbH (servers in Germany) and our email provider Resend, Inc. (USA; we use its EU sending region). Bill reading happens on our own server; we don't send bills to third-party AI services. We may disclose data if the law requires it.
International transfers
Our server is in Germany; the EU is covered by UK adequacy regulations. Our email provider, Resend, is a US company, so your email address and the emails we send you may be accessed from the USA. Those transfers rely on the safeguards in the provider's data processing terms (such as the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework, where applicable).
Cookies
We use only strictly necessary cookies: a login session cookie and a security (CSRF) cookie. No analytics or advertising cookies, so no cookie banner is needed. The bill tool saves your typed details in your browser's local storage so they're there when you come back; clear it with "Start again" or your browser settings.
Your rights
You can ask us to access, correct, delete or export your data, restrict or object to how we use it, and withdraw consent at any time. You can delete saved bills and your whole account yourself from My bills, and stop reminders with the link in any email. For anything else, contact us at hello@mybillfighter.co.uk. We'll reply within one month.
Complaints
Please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113.
Security
The site uses HTTPS, passwords are hashed with scrypt, password-reset links expire after 1 hour and work once, and uploads are size-limited and deleted after processing. No system is perfectly secure, but we'll tell you and the ICO if a breach affects you where the law requires.
Changes
We'll update this page and the date above if anything changes, and email account holders about significant changes.