Privacy Policy

This Privacy Policy explains what waybill.ge collects when you use the service, why we collect it, where it is stored, and how you can have it deleted. waybill.ge is operated as a hosted multi-tenant service that connects AI agents (such as Claude, ChatGPT, or Grok Bot) to Georgia's Revenue Service (rs.ge) waybills, to read-only questions about your cloud.balance.ge companies, and to read-only questions about your QuickShipper deliveries, through the Model Context Protocol (MCP). One approval covers all of them. Balance access does not post or write the ledger, and QuickShipper access does not create, change or cancel deliveries.

waybill.ge also connects them to read-only questions about the Bank of Georgia accounts you connect: their balances and statements. The same approval covers it. Bank access only reads: it cannot make payments or transfers, or sign anything at the bank.

waybill.ge also connects them to read-only questions about the TBC Bank accounts you connect: their balances and statements. The same approval covers it. TBC Bank access only reads: it cannot make payments or transfers, or sign anything at the bank.

waybill.ge also connects them to read-only questions about the ProCredit Bank accounts you connect: their balances and statements of the last 90 days. The same approval covers it. ProCredit Bank access only reads: it cannot make payments or transfers, or sign anything at the bank.

waybill.ge also connects them to read-only questions about a 1C publication you connect (the 1C platform's standard OData interface, hosted by OneSoft), such as items, customers and suppliers, contracts, stock, prices, balances, cash and documents. The same approval covers it. 1C access only reads: it cannot post, change or delete anything in 1C.

waybill.ge also answers questions from two public sources, with nothing to connect: Georgia's public registry (the National Agency of Public Registry, NAPR) about a company, the liens that name it or a property, and the official exchange rates of the National Bank of Georgia (NBG). These lookups only read, and they look up companies and property, not people.

If anything below is unclear, email hello@waybill.ge.

1. Data we store

• Account: your email address, the date you signed up, and timestamps for email verification. You sign in with a one-time code sent to your email. We store only an Argon2 hash of each code, and codes expire after 10 minutes. Accounts created before email-code sign-in, and review accounts we set up, may also hold an Argon2 hash of a password (never the password itself).
• RS.GE credentials: your rs.ge service-user username and password, plus your RS.GE payer id and service-user id. The service-user password is encrypted at rest using Fernet (AES-128-CBC with HMAC-SHA256) before it touches the database. The encryption key is held only by the waybill.ge application process; the database operator cannot read it.
• Balance.ge credentials: for each connected company, the API username, the company label, the cloud partition id, and the API password. The API password is encrypted at rest the same way as the RS.GE service-user password. You can connect several companies on one account. These credentials are for cloud.balance.ge only.
• QuickShipper login token: for each connected QuickShipper account, the name you give it, the QuickShipper shop id, and the login token QuickShipper issues when you connect. You enter your QuickShipper username and password once; we use them only to obtain that token and do not store them. The token is valid at QuickShipper for about a year and is encrypted at rest the same way as the RS.GE service-user password.
• 1C login: for each connected 1C publication, the name you give it, the publication's address, and the user name and password of the read-only 1C integration user you create for waybill.ge. 1C offers no token to exchange them for, so the user name and the password are both encrypted at rest the same way as the RS.GE service-user password. We also keep a keyed fingerprint of the user name (so the same login cannot be connected twice), how many data sets the last connection check found, and when the connection was made and last checked.
• Bank of Georgia API key: for each bank connection, the name you give it, the client ID and client secret of the Business Online API client you create for waybill.ge (its API key), the accounts you select (IBAN and currency) with the read methods Bank of Georgia allowed for each (balance, statement, statement summary), and when the connection was made, last checked and disconnected. The client ID and secret are encrypted at rest the same way as the RS.GE service-user password. The short-lived access tokens Bank of Georgia issues for that key are kept only in the application's memory, never in the database.
• TBC Bank API key: for each TBC Bank connection, the name you give it, the client ID and client secret of the API integration you create for waybill.ge in TBC Business Internet Banking (its API key), the accounts you select (IBAN and currency) with the reads TBC Bank allowed for each (balance, statement, statement summary), and when the connection was made, last checked and disconnected. The client ID and secret are encrypted at rest the same way as the RS.GE service-user password. The short-lived access tokens TBC Bank issues for that key are kept only in the application's memory, never in the database.
• ProCredit Bank service user: for each ProCredit Bank connection, the name you give it, the name and password of the synchronization service user you add for waybill.ge in ProCredit Internet Bank, the accounts you select (IBAN and currency) with the reads ProCredit Bank allowed for each (balance, statement, statement summary), and when the connection was made, last checked and disconnected. The name and the password are both encrypted at rest the same way as the RS.GE service-user password. The short-lived access token ProCredit Bank issues at each sign-in is kept only in the application's memory for the request it was issued for, never in the database.
• API keys: only the hashed prefix of each API key is stored. The plaintext is shown to you exactly once on creation and cannot be recovered afterwards.
• Usage events: one row per MCP tool call, recording the tool name, success/failure flag, latency, mapped error code (when applicable), and timestamp. The request and response payloads of tool calls are not stored. Waybill contents stay in rs.ge. Balance ledger lines, stock rows, and balances stay in Balance.ge. Delivery quotes and orders stay in QuickShipper. Bank balances, statements and transactions stay at Bank of Georgia. TBC Bank balances, statements and transactions stay at TBC Bank. ProCredit Bank balances, statements and transactions stay at ProCredit Bank. 1C records stay in your 1C publication. The one exception is a connection's list of contracts, which is kept in the application's memory so questions about several customers in a row do not read it again. A list is reused for at most 15 minutes. After that it is no longer used, and it leaves memory at the latest when you disconnect or when the application restarts. It is never written to the database. Public registry and NBG answers are kept only in a short in-memory cache (up to five minutes for the registry, up to a day for NBG rates) and are never written to the database.
• Billing: subscription state mirrored from our payment processor, plus an append-only log of payment-callback events. No card details ever reach our database - those are handled exclusively by our payment processor.
• Audit events: security-relevant actions (sign-in, credential verification, credential disconnect, API-key create/revoke). Each audit row may carry the request IP and a short user-agent string.

2. What we do not store

• The plaintext of your rs.ge service-user password.
• The plaintext of a Balance.ge API password.
• Your QuickShipper username or password, or the plaintext of a QuickShipper login token.
• The plaintext of any waybill.ge account password or sign-in code.
• The plaintext of issued API keys after the moment of creation.
• Waybill bodies, goods rows, buyer details, or invoice contents.
• Balance ledger lines, stock quantities, prices, or party balances.
• Delivery quotes, order details, recipient names, phone numbers or addresses from QuickShipper.
• The plaintext of a Bank of Georgia API key (client ID and secret).
• Bank balances, statements or transactions, including the counterparty names, tax IDs, IBANs and payment purposes in them.
• The plaintext of a TBC Bank API key (client ID and secret).
• TBC Bank balances, statements or transactions, including the counterparty names, tax IDs, IBANs and payment purposes in them.
• The plaintext of a ProCredit Bank service user's name or password.
• ProCredit Bank balances, statements or transactions, including the counterparty names, tax IDs, IBANs and payment purposes in them.
• The plaintext of a 1C integration user's name or password.
• 1C items, customers, suppliers, contracts, stock, prices, balances, cash or documents (apart from the short in-memory list of contracts described in Section 1).
• The companies, liens, properties or exchange rates you look up in the public registry or at NBG, or what those sources answer.
• Any payment-card information.

3. Where data is stored

Application servers and the PostgreSQL database run on Railway's EU-Frankfurt region. Backups remain inside the EU. We do not transfer data to non-EU jurisdictions for storage.

4. Who we share data with

• rs.ge (Georgian Revenue Service). When you ask waybill.ge to read or write a waybill, we make the request on your behalf using the service-user credentials you provided.
• Balance.ge. When you ask a question about a connected company, we call cloud.balance.ge with that company's API user. Those calls only read. We do not post or write the ledger.
• QuickShipper. When you ask about deliveries, we call QuickShipper's Delivery API with that account's login token to read delivery quotes, your orders and their status. Those calls only read: we do not create, change or cancel deliveries. The order details QuickShipper returns (such as addresses as text, the recipient's name and the tracking link) go to the AI client you use and are not stored by us; phone numbers and coordinates are left out.
• Bank of Georgia. When you ask about a connected bank account, we call Bank of Georgia's Business Online API with that connection's API key: first for a short-lived access token, then to read the balance, the statement or the statement summary of the accounts you selected, and nothing else. Those calls only read: we cannot make payments or transfers, or sign anything. What Bank of Georgia returns (balances and transaction details, including counterparty names, tax IDs, IBANs and payment purposes) goes to the AI client you use and is not stored by us.
• TBC Bank. When you ask about a connected TBC Bank account, we call TBC Bank's Business Integration Service with that connection's API key: first for a short-lived access token, then to read the balance, the movements or the statement of the accounts you selected, and nothing else. When you press "Find my accounts" while connecting, we read the last 30 days of movements without naming an account and keep only the IBANs and currencies in them, as suggestions; nothing is saved until you confirm the accounts. Those calls only read: we cannot make payments or transfers, or sign anything. What TBC Bank returns (balances and transaction details, including counterparty names, tax IDs, IBANs and payment purposes) goes to the AI client you use and is not stored by us.
• ProCredit Bank. When you ask about a connected ProCredit Bank account, we sign in to ProCredit Bank's synchronization service with that connection's service user, then read the statement of the accounts you selected (their balance, entries and totals), and nothing else. Those calls only read: we cannot make payments or transfers, or sign anything. What ProCredit Bank returns (balances and transaction details, including counterparty names, tax IDs, IBANs and payment purposes) goes to the AI client you use and is not stored by us.
• Your 1C publication (hosted by OneSoft). When you ask about a connected 1C publication, we call its standard OData interface at the address you gave, with the integration user you connected. Those calls only read: our 1C client can send nothing but read requests, so it cannot post, change or delete anything in 1C. What 1C returns (such as customer and supplier names, tax IDs, contracts, balances and document lines) goes to the AI client you use and is not stored by us.
• The National Agency of Public Registry (NAPR) and the National Bank of Georgia (NBG). When you ask about a company, its liens or a property, we send NAPR's public search the identification code, company name, cadastral code or registration number you asked about. When you ask for exchange rates, we send NBG's public rates service the date. Nothing about your account is sent, and these lookups only read. They refuse personal ID numbers as input. Before NAPR's answers go to the AI client you use, we remove any personal ID number from them and replace the name of any private individual among a property's applicants with "[private individual]".
• Our payment processor. They receive only what is needed to process a transaction (order id, amount, currency, success URL). They issue you a separate receipt and have their own privacy policy that governs that relationship.
• AI clients you connect. When you authorize an MCP client (Claude, ChatGPT, Grok Bot, or another) to access waybill.ge, that client sees the responses of MCP tools you invoke. We do not proactively push data to AI clients - they only see what they explicitly request via an authorized session.
• Email delivery. Verification emails are sent through a transactional email provider; that provider sees the destination address and subject line.
• Cloudflare Web Analytics. Customer-visible pages load a small first-party-script-style beacon from static.cloudflareinsights.com. Cloudflare records the page URL, referrer, screen size, approximate country (derived from IP - the IP itself is not retained), and a coarse user-agent summary. No cookies are set, no cross-site identifier is assigned, and no client-side state persists between visits. We use this data only to count page views and understand which pages are reached.
• Self-hosted Chatwoot live chat instance. Customer-visible pages carry a small inline bootstrap snippet that fetches the Chatwoot SDK (/packs/js/sdk.js) from our self-hosted Chatwoot deployment on Railway. If you open the chat panel and send a message, our Chatwoot instance stores: your conversation messages, your name and email if you provide them in the pre-chat form, your visitor IP address, user-agent / browser metadata, the page URL and referrer at the time of the chat, and a chat session identifier. Railway is the infrastructure provider hosting the Chatwoot application and database underneath. We use this data only to provide and audit customer support conversations.

We do not sell personal data. We do not run advertising or behavioural analytics on this dashboard. The Cloudflare Web Analytics integration above is cookieless and aggregate-only; it cannot identify a visitor across sessions.

Personal data in tool answers

Tool answers can contain personal data about the people your business deals with. We pass it to the AI client you authorized only to answer the request you made, we do not store it (Section 2), and we do not use it for anything else, including training AI models. Your AI client handles it under its own privacy policy. By source:

• RS.GE waybills and e-invoices: the names and tax ID numbers of sellers, buyers and transporters (for a person or a sole proprietor, the tax ID is the 11-digit personal ID number), the addresses goods leave from and go to, drivers' names and personal ID numbers, vehicle registration numbers, goods, amounts and comments. The taxpayer lookups return what RS.GE publishes for a tax ID, which can be a person's: the registered name, status, registration date and tax flags such as VAT payer.
• Balance.ge: the names, tax IDs and contact details of clients and vendors, their balances, and employee records as they are kept in Balance.ge (such as an employee's name and personal ID number).
• QuickShipper: recipients' names, delivery addresses as text and tracking links. Phone numbers and coordinates are left out.
• Bank of Georgia: the counterparty names, tax IDs, IBANs and payment purposes in your statements.
• TBC Bank: the counterparty names, tax IDs, IBANs and payment purposes in your statements.
• ProCredit Bank: the counterparty names, tax IDs, IBANs and payment purposes in your statements.
• 1C: the names, tax IDs and contact details of customers and suppliers, their contracts and balances, and the lines of the documents you ask about.
• NAPR and NBG: company names, legal forms, status, liens and property registrations from the public registry. Personal ID numbers are removed, and a private individual among a property's applicants is shown as "[private individual]". NBG answers hold no personal data.

ChatGPT and Codex. In the ChatGPT app from OpenAI's directory and in our Codex plugin, which connect to https://waybill.ge/mcp/openai, personal ID numbers stay out of the conversation. In their tool answers, every 11-digit personal ID number, and every driver's ID, is replaced by a sealed person reference (it starts with "pid_") that only waybill.ge can open, and only for your account. The tools take that reference back where they need the person, and refuse a personal ID number typed into the chat. We open a reference only to pass the number on to the system your request goes to, such as RS.GE, and we store neither the number nor the reference. A company that adds waybill.ge to ChatGPT or Codex itself, at https://waybill.ge/mcp, gets personal ID numbers as in any other AI app.

5. Retention

• Account and credentials: kept while your account exists. Deleted on request (see Section 7).
• Usage events: kept for at least the current and previous billing period for quota and dispute resolution. Older rows may be aggregated or pruned for capacity.
• Audit events: kept for at least 12 months. They may survive account deletion for legal hold, redacted of personal identifiers where possible.
• Payment callbacks: kept for at least the duration required by Georgian tax law (currently 6 years).

6. Security

• Database connections are over TLS.
• The web surface is HTTPS only.
• RS.GE and Balance.ge passwords and QuickShipper login tokens are Fernet-encrypted at rest.
• Bank of Georgia API keys are Fernet-encrypted at rest. Our bank client can send only read requests to a fixed list of Business Online addresses (and one request for an access token); it has no way to make payments, transfers or signatures.
• TBC Bank API keys are Fernet-encrypted at rest. Our TBC Bank client can send only read requests to a fixed list of Business Integration Service addresses (and one request for an access token); it has no way to make payments, transfers or signatures.
• ProCredit Bank service users' names and passwords are Fernet-encrypted at rest. Our ProCredit Bank client can send only two kinds of request to ProCredit Bank's synchronization service, a sign-in and a statement request; it has no way to make payments, transfers or signatures.
• 1C integration users' names and passwords are Fernet-encrypted at rest. Our 1C client can send only read requests, and only to the standard OData interface of the publication you connected.
• Public registry and NBG lookups can reach only a fixed list of public NAPR and NBG addresses, and only to search and read.
• One-time sign-in codes, and any legacy account passwords, are stored as Argon2 hashes, salted per row.
• Sensitive state-changing actions (disconnect RS.GE, disconnect a Balance company or a QuickShipper account, generate or revoke API key) require a signed CSRF token bound to your authenticated session.
• Bank connection changes (connect, a new API key, adding or removing accounts, disconnect) need the same signed CSRF token.
• TBC Bank connection changes (connect, a new API key, adding or removing accounts, disconnect) need the same signed CSRF token.
• ProCredit Bank connection changes (connect, a new service user name or password, adding or removing accounts, disconnect) need the same signed CSRF token.
• 1C connection changes (connect, a new login, a new check, a new default, disconnect) need the same signed CSRF token.
• We do not claim a SOC 2 audit; we are an early-stage product and will update this section when our compliance posture changes.

7. Your rights and how to exercise them

You can request data export, correction, or deletion at any time by emailing hello@waybill.ge. We will respond within 30 days. Deletion removes your account, credentials, API keys, usage events, subscription records, and audit rows where legal retention does not require preservation.

You can disconnect your rs.ge credentials yourself at any time on the Business integrations page. That clears the rs.ge fields from your tenant record and stops every MCP tool that needs rs.ge until you reconnect.

You can disconnect a Balance company on the Business integrations page. That removes that company's stored API password and stops Balance tools for that company until you connect it again. Other companies on the same account are left in place.

You can disconnect a QuickShipper account on the Business integrations page. That deletes the stored login token and stops QuickShipper tools for that account at once. QuickShipper offers no way for us to revoke the token at their end, so it stays valid at QuickShipper until it expires; change your QuickShipper password if you want it to stop sooner.

You can disconnect a Bank of Georgia connection on the Business integrations page. That deletes the stored API key and stops bank tools for that connection at once. It does not revoke the key at Bank of Georgia: to end access there, delete that API client in Business Online. Removing a disconnected connection also deletes its name and account list.

You can disconnect a TBC Bank connection on the Business integrations page. That deletes the stored API key and stops bank tools for that connection at once. It does not revoke the key at TBC Bank: to end access there, delete that integration on the API Integration page of Business Internet Banking. Removing a disconnected connection also deletes its name and account list.

You can disconnect a ProCredit Bank connection on the Business integrations page. That deletes the stored service user name and password and stops bank tools for that connection at once. It does not block the service user at ProCredit Bank: to end access there, block or delete it in ProCredit Internet Bank, under My profile, Users. Removing a disconnected connection also deletes its name and account list.

You can disconnect a 1C publication on the Business integrations page. That deletes the stored user name and password, drops any list of contracts kept in memory for it and stops 1C tools for that connection at once. It does not disable the integration user in 1C: to end access there, disable that user in 1C.

8. Cookies

waybill.ge itself sets two first-party cookies. The first is a signed session cookie (HttpOnly, SameSite=Lax, Secure on HTTPS) that carries only your tenant id. The second, rsmcp_lang, remembers your language preference: it holds only en or ka, is HttpOnly and SameSite=Lax (Secure on HTTPS), lasts one year, and is set when you pick a language with the switcher or open a page link that includes ?lang=. We do not set advertising cookies. The Cloudflare Web Analytics beacon described in Section 4 is cookieless by design - it does not write any browser storage and cannot persist a visitor identifier.

The self-hosted Chatwoot live-chat widget (Section 4) writes its own first-party cw_conversation cookie so an open chat session persists when you navigate between pages or return later. The widget also writes to localStorage on your browser to keep the chat panel state in sync. Both are scoped to waybill.ge and are cleared when you clear your site data.

9. Changes to this policy

Material changes will be announced on this page with a new "Last updated" date. Continued use after a change constitutes acceptance.

10. Contact

Privacy questions: hello@waybill.ge.