Tenant Bill Notifier privacy

In the local-first workflow, approved settings, original utility messages, cleaned proofs, payment instructions, and complete email bodies stay on the customer's computer. The service receives account identity, opaque billing and draft hashes, and operational Gmail IDs for duplicate and send status. A one-time migration exports previously approved hosted settings to the owner; after the local copy is confirmed, the hosted configuration, templates and detailed summaries are removed. Linked images are omitted because their URLs can contain private identifiers. This pilot policy requires final owner review before public use.