nabbit
Privacy Policy
This Privacy Policy explains how Nabbit (“we,” “us,” or “our”) collects, uses, and protects information when you use our receipt management platform at app.nabbit.ca and nabbit.ca (the “Service”). By using the Service you agree to the practices described here.
1. Information We Collect
- Account information: your name, email address, and company name when you register.
- Receipt data: images and extracted data (vendor, amount, date, tax) from receipts you upload or capture.
- Payment information: billing details are handled by Stripe. We never store your credit card number.
- Usage data: pages visited, features used, and error logs to help us improve the Service.
- Integration credentials: OAuth tokens for QuickBooks Online, Google Drive, and Microsoft SharePoint, stored encrypted and used only to sync your data.
2. How We Use Your Information
- To provide, maintain, and improve the Service.
- To sync receipt data to your connected accounting software (QuickBooks Online) and storage services (Google Drive, SharePoint) as directed by you.
- To send transactional emails (receipts, account notices, support replies) from hello@nabbit.ca.
- To detect and prevent fraud, abuse, or security incidents.
- To comply with applicable Canadian law, including CRA record-keeping requirements.
3. Data Storage & Retention
Your data is stored on servers located in Canada and the United States via Supabase (PostgreSQL). Receipt images you back up to Google Drive or SharePoint are stored in your own cloud storage accounts — we do not retain copies beyond what is needed to process your request.
We retain your account data for as long as your subscription is active and for 30 days following cancellation, after which it is permanently deleted. Receipt records exported to QuickBooks or your cloud storage remain in those services according to their own retention policies.
4. Sharing of Information
We do not sell your personal information. We share data only with:
- Supabase — database and authentication infrastructure.
- Stripe — payment processing.
- Intuit (QuickBooks) — accounting sync, at your direction.
- Google / Microsoft — cloud storage backup, at your direction.
- Resend — transactional email delivery.
- Law enforcement or regulators — when required by applicable law.
5. Security
We use industry-standard security practices including TLS encryption in transit, encrypted storage at rest, row-level security on all database tables, and OAuth 2.0 for third-party integrations. We do not store passwords in plain text. Sessions automatically expire after 60 minutes of inactivity.
6. Your Rights (PIPEDA)
Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) you have the right to:
- Access the personal information we hold about you.
- Request correction of inaccurate information.
- Withdraw consent and request deletion of your data (subject to legal retention obligations).
- File a complaint with the Office of the Privacy Commissioner of Canada.
To exercise these rights, email us at hello@nabbit.ca.
7. Cookies
The Service uses essential cookies and local storage for authentication and session management only. We do not use advertising or tracking cookies.
8. Children’s Privacy
The Service is not directed to children under 13. We do not knowingly collect personal information from children.
9. Changes to This Policy
We may update this policy from time to time. We will notify you by email or in-app notice at least 14 days before material changes take effect. Continued use of the Service after changes constitutes acceptance.
10. Contact
Questions about this policy? Email hello@nabbit.ca or write to:
1001583085 Ontario Inc. (Nabbit)
Burlington, Ontario, Canada