Privacy Policy

Who we are

Quitslip is a digital receipt platform that lets merchants send paperless receipts to customers via NFC stickers. We are based in Ontario, Canada.

When we say "Quitslip", "we", "us", or "our" in this policy, we mean the Quitslip service and its operators. When we say "you", we mean either a merchant using our platform or a customer receiving receipts.

What we collect and why

We only collect information that is genuinely needed to provide the service.

For merchants:

• Name, email address, and business name — to create and identify your account
• Business location and category — to personalise your receipt page
• Square OAuth tokens — to read your transaction data and generate receipts
• Transaction and receipt data from Square — to create the digital receipts your customers receive

For customers:

• Email address — only if you choose to create a Quitslip account
• Receipt data — the itemised receipts you choose to save to your account
• Nothing else — if you tap an NFC sticker and view a receipt without creating an account, we collect nothing about you

How we use your data

• To deliver digital receipts to customers at the point of sale
• To display your receipt history in your Quitslip account
• To show merchants their sales analytics and dashboard data
• To send service-related emails (e.g. account confirmation, password reset)

We do not use your data for advertising. We do not build profiles to sell to data brokers. We do not share your data with any third party without your explicit consent — except as described below.

Who we share data with

We use a small number of trusted infrastructure providers to run the service:

• Supabase — our database and authentication provider. Data is encrypted at rest and in transit.
• Railway — our server hosting provider. They host the backend that processes webhooks and serves receipts.
• Square — we receive transaction data from Square via webhooks when merchants process payments.

These providers act as data processors on our behalf and are bound by appropriate data processing agreements. We do not sell your data to any of them or to any other party.

Data retention and deletion

You can delete your account and all associated data at any time from your account settings. When you delete your account:

• Your profile information is permanently deleted immediately
• Your saved receipts are permanently deleted immediately
• We do not retain backups of your personal data beyond 30 days

Merchant receipt data (transaction records) may be retained for up to 12 months for legitimate business record-keeping purposes, after which it is automatically purged.

Security

We take reasonable precautions to protect your data:

• All data is encrypted in transit using TLS
• Passwords are hashed using bcrypt — we never store plain-text passwords
• Database access is restricted to authenticated server processes only
• Square access tokens are stored encrypted and never exposed to the frontend

If you discover a security vulnerability, please report it to noah@quitslip.com.

Your rights

Regardless of where you live, you have the right to:

• Access the personal data we hold about you
• Correct any inaccurate data
• Delete your data and account at any time
• Export your data in a machine-readable format
• Withdraw consent at any time

To exercise any of these rights, email noah@quitslip.com and we'll respond within 30 days.

Canadian residents (PIPEDA)

Quitslip complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). We collect, use, and disclose personal information only with your knowledge and consent, for the purposes described in this policy. You have the right to access and correct your personal information and to file a complaint with the Office of the Privacy Commissioner of Canada.

European residents (GDPR)

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR). Our legal basis for processing your personal data is your consent (for optional account creation) and the performance of a contract (to deliver receipts). You have the right to lodge a complaint with your local supervisory authority.

Cookies

We do not use tracking cookies or advertising cookies. Supabase Auth uses a single session cookie to keep you logged in. This cookie is strictly necessary for the service to function and is not used for tracking.

Children

Quitslip is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us and we will delete it promptly.

Changes to this policy

We may update this policy from time to time. When we do, we'll update the "Last updated" date at the top and, for significant changes, notify merchants by email. Continued use of Quitslip after changes means you accept the updated policy.

Contact

Questions, requests, or concerns? We're easy to reach:

noah@quitslip.com
Quitslip, Ontario, Canada