Privacy Policy

Last updated: August 7, 2026 · Questions or requests? noah@quitslip.com

1. Scope and your consent

This Privacy Policy explains how Quitslip ("we", "us", "our") collects, uses, discloses, stores and protects personal information. It applies to the Quitslip website, mobile applications, NFC receipt links and dashboards (the "Service"), and forms part of our Terms of Service.

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, and other applicable Canadian privacy legislation.

"Personal information" means information about an identifiable individual. By using the Service, you consent to the practices described here. If you do not agree, please do not use the Service.

2. Privacy Officer

We have designated a Privacy Officer who is accountable for our compliance with this policy and with applicable privacy law, and who is responsible for responding to access requests, complaints and breach notifications.

Privacy Officer — Noah Bulbring, Founder
Email: noah@quitslip.com
Phone: (705) 230-5066
Quitslip, Ontario, Canada

3. What we collect and why

We collect only what is reasonably necessary to provide the Service. What we collect depends on how you use it.

We do not collect or store full payment card numbers, CVV codes, PINs, bank account credentials, government identification numbers, or precise geolocation. Subscription payments are handled by our payment processor; we receive only confirmation and status, not your full card details.

4. Tapping a receipt anonymously

We retain ordinary server logs for security and reliability, as described above. You only become identifiable to us if you choose to create an account and save the receipt.

5. How we recognise repeat customers

We want to be transparent about one thing merchants see. To produce merchant analytics such as repeat-customer rate and visit frequency, the Service groups transactions using the last four digits of the payment card together with the card brand, as supplied by the merchant's point-of-sale system.

• These four digits are not sufficient to identify you by name, and we do not link them to your identity, your account, or any other dataset.
• We never receive or store the full card number.
• Merchants see aggregate patterns — for example "34% of customers returned" — and a masked identifier such as "•••• 4242". They do not receive your name or contact details from us.
• This grouping is used only for the merchant's own business analytics and never for advertising, cross-merchant tracking or sale to third parties.

6. Business accounts — what your employer can see

• Your employer, not Quitslip, decides to enable this, who is added, what is monitored and how the information is used. In privacy terms, your employer is the organization accountable for that information, and we process it on their behalf and on their instructions.
• Your employer is responsible for notifying you and obtaining any consent required by law before adding you and before viewing your purchase activity. We require them to do so in our Terms of Service.
• Your personal receipts — those you save to your own personal account outside the Business Account — are not shared with your employer.
• If you have questions about what your employer collects or how they use it, contact your employer directly. You may also contact our Privacy Officer, and we will assist and direct you appropriately.

7. How we use personal information

We use personal information only for the following purposes:

• To create and administer accounts and authenticate users;
• To generate, deliver, display and store digital receipts;
• To produce merchant and business analytics and expense reports;
• To process subscriptions, billing and plan management;
• To provide customer support and respond to your enquiries;
• To send service and transactional messages, such as confirmations, password resets and material changes to our terms;
• To secure the Service, prevent fraud and abuse, and investigate suspected violations;
• To maintain, debug and improve the Service; and
• To comply with legal, regulatory and record-keeping obligations.

We do not use personal information for advertising, ad targeting or profiling, and we do not sell, rent or trade it. We may create aggregated, de-identified statistics that cannot reasonably identify any individual, and may use those to operate and improve the Service.

We will not use or disclose personal information for a new purpose materially different from those above without first obtaining your consent, unless permitted or required by law.

8. Consent and withdrawing it

• You provide consent when you create an account, save a receipt, subscribe, or otherwise use the Service after being presented with this policy.
• We rely on implied consent for uses that are obvious and expected — for example, storing a receipt you asked us to save.
• We seek express consent where the law requires it, including for any sensitive information and for any materially new purpose.
• You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide part or all of the Service. The simplest way to withdraw fully is to delete your account.
• Withdrawal does not affect processing already carried out on the basis of your consent.

9. Who we share information with

We do not sell personal information. We disclose it only in these limited circumstances:

• Service providers (processors). We use a small number of trusted providers that process data on our behalf under contractual confidentiality and security obligations, and only for the purposes we specify:
  • Supabase — database, authentication and storage;
  • Railway — application and API hosting;
  • Square — point-of-sale integration and subscription payment processing;
  • Netlify — website hosting and delivery;
  • Apple and Google — mobile app distribution and, if you enable them, push notifications.
• Merchants. A merchant receives the transaction and analytics information described in sections 3 and 5 for their own sales.
• Employers. As described in section 6, for Business Accounts.
• Legal and safety. Where required or permitted by law — for example in response to a valid court order, subpoena, warrant or lawful government request — or where necessary to investigate fraud, enforce our Terms, protect our legal rights, or protect the safety of any person. Where lawful and reasonable, we will notify affected users of such a request.
• Business transaction. In connection with a merger, acquisition, financing, reorganization or sale of assets, personal information may be disclosed to the parties involved, subject to confidentiality obligations and to this policy continuing to apply. We will notify affected users of any change of control.

10. Where your data is stored and processed

Some of our service providers store or process data outside Canada, including in the United States. This means that personal information may be subject to the laws of those jurisdictions, and may be accessible to foreign courts, law enforcement and national security authorities under those laws.

Before transferring personal information outside Quebec or Canada, we assess whether it will receive adequate protection, and we use contractual and technical safeguards — including encryption in transit and at rest, access controls and data processing agreements — to protect it. By using the Service, you acknowledge this transfer. If you would like details about a specific provider or jurisdiction, contact our Privacy Officer.

11. How long we keep information

• Unclaimed receipt links expire automatically a short time after the transaction and are no longer viewable.
• Saved personal receipts are kept until you delete them or delete your account.
• Merchant transaction and analytics records are retained while the account is active, and for a limited period afterwards for business record-keeping, tax and legal purposes.
• Business Account expense records are retained as directed by the employer, subject to their own legal retention obligations.
• Technical and security logs are kept for a short period for security and diagnostics.
• When information is no longer required for the purpose it was collected, we delete it or irreversibly de-identify it, unless a law requires us to keep it longer.

Deletion: when you delete your account, your profile and saved receipts are deleted from our active systems promptly. Residual copies may persist briefly in encrypted backups, which are overwritten on a rolling cycle not exceeding 30 days.

Because we may be legally required to retain certain records, and because merchants keep their own independent records of their sales, deleting your Quitslip account does not delete the merchant's own record of a transaction.

12. How we protect information

We maintain physical, organizational and technological safeguards appropriate to the sensitivity of the information, including:

• Encryption of data in transit using TLS, and encryption at rest by our infrastructure providers;
• Passwords stored only as salted one-way hashes — we never store or have access to your plain-text password;
• Row-level database access controls so accounts can only reach their own records;
• Authentication tokens stored in secure device storage on mobile;
• Point-of-sale access tokens stored encrypted and never exposed to the browser;
• Rate limiting, security headers and restricted administrative access on a need-to-know basis.

If you believe you have found a security vulnerability, please report it responsibly to noah@quitslip.com and allow us a reasonable opportunity to address it before public disclosure.

13. If there is a data breach

We maintain procedures to detect, assess, contain and record confidentiality incidents. If a breach of security safeguards occurs:

• We will assess whether it creates a real risk of significant harm to any individual;
• If it does, we will report it to the Office of the Privacy Commissioner of Canada as soon as feasible, and notify affected individuals as soon as feasible with a description of the incident, the information involved, and steps they can take;
• Where Quebec's Law 25 applies, we will also notify the Commission d'accès à l'information promptly, and in any event within the timeframe required by that legislation;
• We will notify affected organizations, including employers and merchants, where required; and
• We will maintain a record of every breach of security safeguards, and provide it to a regulator on request.

14. Your privacy rights

Subject to limited legal exceptions, you have the right to:

• Access the personal information we hold about you, and be told how it has been used and to whom it has been disclosed;
• Correct information that is inaccurate, incomplete or out of date;
• Delete your account and associated personal information;
• Withdraw consent to further collection, use or disclosure;
• Port your data — receive it in a structured, commonly used technological format, where the law provides that right;
• De-index or cease dissemination in the circumstances provided by Quebec law; and
• Complain without fear of reprisal.

To exercise any right, email noah@quitslip.com. We will respond within 30 days. We may need to verify your identity before acting, and will only request the minimum information necessary to do so. Access is provided free of charge; if a request is manifestly excessive or repetitive we may charge a reasonable, pre-approved fee or decline it, and we will explain why in writing.

In limited cases we may be unable to provide access — for example where doing so would reveal personal information about another individual, breach solicitor-client privilege, or interfere with a lawful investigation. We will explain the reason and your options.

15. Automated processing

The Service performs automated calculations, such as categorising a receipt by merchant type and computing analytics. We do not use automated decision-making that produces legal or similarly significant effects about you without human involvement — we do not use it to deny service, set individual pricing, assess creditworthiness, or evaluate employment. If that ever changes, we will update this policy, tell you it is happening, and give you the ability to submit observations to a member of our team.

16. Cookies and tracking

We do not use advertising cookies, third-party tracking pixels, cross-site trackers or behavioural profiling.

• Strictly necessary only. We use a session cookie or equivalent local storage to keep you signed in and to protect against cross-site request forgery. These are required for the Service to function.
• We load web fonts from Google Fonts to render the site. Your browser's request to that service is subject to Google's own privacy practices.
• You can block or delete cookies in your browser settings, but you may not be able to stay signed in.
• Because we do not track you across sites, we have no behavioural profile to respond to "Do Not Track" or Global Privacy Control signals with — there is nothing to opt out of.

17. Children

The Service is not directed to children. We do not knowingly collect personal information from anyone under 13, and accounts require users to be at least 16 or the age of majority in their province. If you believe a child has provided us personal information, contact our Privacy Officer and we will delete it promptly.

18. Changes to this policy

We may update this policy as the Service evolves or the law changes. We will update the "Last updated" date, and for material changes we will provide notice by email or in-Service notice before they take effect. Material changes that expand how we use personal information will, where required by law, be made only with your consent. Continued use after the effective date constitutes acceptance of the updated policy.

19. Complaints and escalation

If you have a privacy concern, contact our Privacy Officer first — we take complaints seriously, will acknowledge promptly, investigate, and tell you the outcome and any corrective action taken.

If you are not satisfied, you may escalate to the appropriate regulator:

• Office of the Privacy Commissioner of Canada — 1-800-282-1376, priv.gc.ca
• Commission d'accès à l'information du Québec (Quebec residents) — cai.gouv.qc.ca
• Or your provincial privacy commissioner, where applicable.

20. Contact us

Questions, requests or concerns about privacy:

Noah Bulbring — Privacy Officer, Quitslip
Email: noah@quitslip.com
Phone: (705) 230-5066
Ontario, Canada