Effective date: January 1, 2026
This policy explains which cookies and similar technologies Smartbills Technologies Inc. ("Smartbills", "we") uses on smartbills.io, our sign-up and sign-in pages, our web app and our mobile apps, and how you control them. It supplements our Privacy Policy.
1. In short
- Nothing that tracks you runs until you choose. Analytics and marketing tools stay off until you accept them in the cookie banner. This applies to every visitor, wherever you are, because Quebec's Law 25 requires tracking to be off by default.
- We count visits without cookies. Cloudflare Web Analytics gives us page counts without storing anything on your device.
- You can change your mind at any time from the Cookie preferences link at the bottom of every page.
- Our apps do not show third-party ads and do not track you across other companies' apps or websites.
2. What these technologies are
- Cookies are small text files a website stores in your browser. First-party cookies are set by Smartbills; third-party cookies are set by another company whose tool runs on our pages.
- Local storage is a similar store in your browser that a page can read and write.
- Pixels and tags are small pieces of code that tell a service a page was viewed or an action was taken.
- SDKs are code libraries inside mobile apps that do the same job as cookies and tags.
We use "cookies" in this policy to mean all of them.
3. Your choices
When you first visit, a banner lets you Accept all, Refuse all, or choose by category under More choices. Refusing is as easy as accepting, and the site works the same either way.
- Your choice is saved for 180 days in your browser and on the smartbills.io domain, so the website, sign-up pages and web app all respect the same choice. After that we ask again.
- Change or withdraw your choice at any time with the Cookie preferences link in the footer. Tools you turn off stop running on the next page. Cookies they already set can be deleted in your browser settings.
- You can also block or delete cookies in your browser. Blocking strictly necessary cookies may stop sign-in from working.
- To limit ad personalization by the companies below on other sites, use Google's ad settings, Meta's ad preferences, LinkedIn's ad settings or the Digital Advertising Alliance of Canada and US opt-out tools.
4. Strictly necessary
These keep the site and the service working and secure. They do not need consent, and they are never used for advertising.
| Name | Set by | What it does | Lasts |
| --- | --- | --- | --- |
| sb_consent | Smartbills | Remembers your cookie choice across smartbills.io, sign-up and the web app | 180 days |
| smartbills_cookie_consent (local storage) | Smartbills | Same record, kept in your browser | 180 days |
| i18next | Smartbills | Remembers the language and region you chose | 1 year |
| Sign-in and session cookies | Smartbills (auth.smartbills.io, app) | Keep you signed in, protect forms against forgery, and enforce multi-factor authentication | Session to 30 days |
| Cloudflare security cookies, such as __cf_bm | Cloudflare | Protect the site against bots and attacks, when that protection is active | Up to 30 minutes |
| Stripe cookies (__stripe_mid, __stripe_sid) | Stripe | Fraud prevention on checkout and payment pages only | 30 minutes to 1 year |
Visit source. We note which campaign or site brought you here (for example an ad, a newsletter link or a search engine) and the first page you saw, in a first-party cookie (sb_attribution) and in local storage (lastExternalReferrer). Until you accept analytics or marketing cookies, the cookie lasts only until you close your browser. If you send a form or create an account during that visit, the source is saved with your request or account. If you accept, we keep it for 90 days so that a later visit counts too. It is never shared with advertising companies unless you accept marketing cookies.
Cookieless counting. Cloudflare Web Analytics counts page views, countries and referring sites. It sets no cookie, stores no identifier and does not follow you across sites.
5. Analytics (only if you accept)
These help us understand how the site and sign-up pages are used so we can improve them.
| Tool | Cookies | What it does | Lasts |
| --- | --- | --- | --- |
| Google Analytics 4 | _ga, _ga_SKM023FYPM | Measures pages viewed, buttons and links clicked, forms started or sent, page speed and where visits came from. In the web app, it also records your account and workspace identifiers so we can measure features, not who you are. Data is kept for 14 months in Google Analytics, and we keep an export in Google Cloud in Montréal | 2 years |
| Microsoft Clarity | _clck, _clsk | Records how pages are used (clicks, scrolling, mouse movement) to find what is confusing or broken. It masks what you type. Clarity does not run in the web app, because the app shows financial data | 1 year; 1 day |
6. Marketing (only if you accept)
These measure whether our advertising works, by telling the ad company that someone who saw or clicked an ad then visited the site, created an account or sent a form. They may also be used to show you Smartbills ads on other sites.
| Tool | Cookies | What it does | Lasts |
| --- | --- | --- | --- |
| Google Ads (Conversion Linker) | _gcl_au, _gcl_ls (local storage) | Links an ad click to a sign-up or form. With Google signals, Google may connect this to Google accounts whose owners allow ad personalization, for cross-device reports. When you send a form or create an account, Google may receive a hashed (one-way encrypted) copy of the email address you entered, used only to match the conversion to an ad click | 90 days |
| Meta Pixel (Facebook, Instagram) | _fbp | Measures visits and sign-ups that follow a Meta ad. Sign-ups may also be confirmed to Meta from our server, using the same event identifier, so they are not counted twice | 90 days |
| Microsoft Advertising (UET) | _uetsid, _uetvid | Measures visits, sign-ups and forms that follow a Bing or Microsoft ad | 1 day; 13 months |
| LinkedIn Insight Tag | li_fat_id and LinkedIn cookies | Measures demo requests and sign-ups that follow a LinkedIn ad | Up to 30 days |
| Apollo.io | apolloAnonId (local storage) | Identifies which company a visit comes from, using its network address, so our sales team knows which businesses are interested. It does not identify you personally unless you send us a form | Until cleared |
7. In our apps
- Web app (app.smartbills.io). Uses the strictly necessary cookies above, Google Analytics if you accepted analytics cookies, and Sentry to capture errors. To fix a bug, Sentry can replay what happened on screen just before an error, with all text masked, so it never sees your receipts, amounts or names.
- Mobile apps (iOS and Android). Use Firebase Analytics and Firebase Performance Monitoring (Google) to measure screens used and app speed, and Sentry for crash reports. They do not use advertising identifiers, do not show third-party ads, and do not track you across other companies' apps or websites. You can limit app analytics in your device's privacy settings.
8. Emails
Our marketing emails contain a small image that tells us whether the email was opened and which link was clicked, so we can send less of what nobody reads. To block it, turn off automatic image loading in your email app.
9. Who receives the data
Data collected by analytics and marketing cookies goes to the companies named above, mostly in the United States. They act as our service providers, except that Google, Meta, LinkedIn and Microsoft may also use it for their own purposes under their own privacy policies when you accept marketing cookies. Some US state laws call that "sharing" for cross-context behavioural advertising. You can refuse it in the banner, or withdraw it later from Cookie preferences. See Sections 9 and 13 of our Privacy Policy for international transfers and your rights.
10. Changes
We update this policy when we add or remove a tool, and change the effective date above. If a change needs your consent, we ask again through the banner.
11. Contact
Questions about cookies: privacy@smartbills.ca, or Smartbills Technologies Inc., Attn: Privacy, 105 Rue Pierre-Mercure, Montréal, Québec H1A 5S7, Canada.