Privacy Policy

Effective date: January 1, 2026

This policy explains how Smartbills Technologies Inc. ("Smartbills", "we", "us") handles personal information when you use our websites, our web and mobile apps, our APIs and MCP server, our digital receipt network, or when you deal with us as a customer, partner, candidate or prospect.

We wrote it to meet the laws that apply to us in 2026, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, the private-sector privacy laws of Alberta and British Columbia, Canada's Anti-Spam Legislation (CASL), the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the CPRA (CCPA), and the comprehensive privacy laws of the other US states where they apply to us.

Where a law gives you more rights than this policy describes, you have those rights.

1. Summary#

• We run a finance platform. Smartbills captures receipts and invoices, manages expenses, bills, payments and invoices, and syncs them to accounting software. That data is often about people: who bought what, where, when and on which card.
• When your employer uses Smartbills, your employer is in charge of that data. We process it on their behalf and on their instructions. Section 3 explains the two roles.
• We never store full card numbers. Bank connections go through Plaid, card payments through Stripe, and both handle the credentials.
• Your data is stored in Canada (Amazon Web Services in Montréal and Microsoft Azure in Toronto). Some of our service providers process data in the United States or elsewhere. Section 9 lists them and explains the safeguards.
• We use AI to read documents, suggest categories and coding, flag spend that breaks a policy, and power the assistant and MCP server. We do not train AI models on your data, and our AI providers may not either. Section 7.
• We do not sell personal information for money. Our website uses advertising cookies only if you accept them, which some US laws call "sharing". You can refuse or withdraw at any time. Section 10.
• You have rights to access, correct, delete, port and object, among others. Write to privacy@smartbills.ca. Section 12.

2. Who we are and how to reach us#

Smartbills Technologies Inc. is a company incorporated in Canada with its head office at 105 Rue Pierre-Mercure, Montréal, Québec H1A 5S7, Canada.

Person in charge of the protection of personal information (Quebec) and Privacy Officer (PIPEDA): Sébastien Labine, Chief Executive Officer, privacy@smartbills.ca.

People in the European Union and the United Kingdom can send any request or complaint to the same person.

| For | Contact | | --- | --- | | Privacy questions and requests | privacy@smartbills.ca | | Security issues and vulnerability reports | security@smartbills.ca | | Account and billing help | support@smartbills.ca | | Mail | Smartbills Technologies Inc., Attn: Privacy, 105 Rue Pierre-Mercure, Montréal, Québec H1A 5S7, Canada |

3. Our two roles: controller and service provider#

Privacy laws treat a company differently depending on who decides why data is processed.

When we act for a business customer (processor / service provider). When an organization subscribes to Smartbills, it decides what its people upload, which mailboxes, bank accounts and accounting systems it connects, and which policies and approvals apply. The data in its workspace (receipts, expenses, reports, bills, vendors, invoices, customers, bank transactions, employee details) is Customer Data. For Customer Data, the organization is the controller (in Quebec, the enterprise that holds the information) and Smartbills is its processor, service provider or mandatary. We process Customer Data only to provide the service, on the customer's documented instructions, under our Data Processing Agreement and the Terms and Conditions.

If you are an employee, contractor or vendor of a Smartbills customer, send requests about your data to that organization first. If you write to us, we will pass your request on to them and help them answer it.

When we decide (controller). We are the controller for:

• account and sign-in data of everyone who registers;
• billing and subscription data;
• individual users on the Free plan or a personal account, for the data in their own workspace;
• recipients of digital receipts sent through our merchant network, where we deliver and store the receipt;
• website visitors, newsletter subscribers, prospects, event contacts and people who contact support;
• job applicants;
• de-identified and aggregated data we create (Section 6).

4. What we collect#

4.1 Information you give us

• Account details: name, work or personal email, phone number, password (stored only as a salted hash) or single sign-on identity, language, time zone, role, department, manager and profile photo.
• Organization details: business name, address, business numbers (GST/HST, QST, EIN, VAT), tax registrations, chart of accounts, locations, departments and policies.
• Financial documents and records: receipts, invoices, bills, statements, credit notes, purchase orders, mileage logs and anything you upload, forward by email or photograph, with the data we extract from them (merchant, date, amounts, taxes, line items, payment method type and last four digits, loyalty or membership numbers when printed).
• Expenses and workflows: categories, comments, attendees, trips, budgets, approvals, rejections, reimbursements and audit history.
• Vendors and customers you manage: contact names, emails, addresses, tax numbers and banking details for payments.
• Payment details: for your subscription, Stripe collects your card or bank account and gives us a token plus the brand, last four digits and expiry. If you subscribe in our mobile app, Apple or Google processes the payment and tells us only the status of your subscription. Bank details you record for vendors or for reimbursements are stored encrypted. Smartbills does not move money between accounts.
• Portal credentials: if you use bill fetching, the user name and password for supplier or utility portals you choose to connect. They are kept in a managed secrets vault, never written to logs, and passed to Deck, our bill-fetching provider, only to sign in to the portals you choose.
• Communications: support messages, chat transcripts, feedback, survey answers, and recordings of sales or support calls when you are told the call is recorded.
• Job applications: résumé, work history, references and anything else you send.

4.2 Information from the services you connect

You or your administrator decide what to connect. You can disconnect at any time.

• Bank and card accounts (Plaid): account names, types, masked numbers, balances and transactions. Plaid's handling of your credentials is described in the Plaid End User Privacy Policy. We never see your banking password.
• Mailboxes (Google Gmail, Microsoft Outlook / Microsoft 365): we read messages and attachments that look like receipts, invoices or bills, so we can import them. We do not read unrelated personal messages for any other purpose. See Section 8 for the Google and Microsoft commitments.
• Accounting and ERP software (QuickBooks, Xero, Sage, FreshBooks, NetSuite, SAP, Oracle and others): accounts, classes, tax codes, vendors, customers and posted transactions.
• Point-of-sale, commerce and productivity apps (Shopify, Square, Clover, Lightspeed, Dropbox, Slack and others): sales and receipt data, files you choose to import, and the messages needed to send you notifications.
• Single sign-on and directories (Google, Microsoft Entra ID, SAML or OIDC providers, SCIM): name, email, group membership and employment status.
• AI assistants and agents you connect to our MCP server or API: the requests they send and the results we return.

4.3 Information from merchants and partners

• Digital receipts: participating merchants and their point-of-sale providers send us the transaction details needed to issue your receipt (store, items, amounts, taxes, payment method type, loyalty number where relevant) and, for delivery, your email or mobile number.
• Bank partners: where a bank shows Smartbills receipts in its own app, the bank sends transaction details linked to a random identifier. We do not receive your name from the bank.
• Business contact data: for business-to-business marketing and sales, we may obtain professional contact details (name, title, employer, work email and phone) from data providers, events, referrals and public professional sources.

4.4 Information collected automatically

• Device and log data: IP address, device and browser type, operating system, app version, crash reports, pages and screens viewed, actions taken, referring page and timestamps.
• Approximate location derived from IP address. We collect precise location only if you turn on a feature that needs it (for example, recording mileage trips, detecting drives, or notifying you when you arrive at a store that accepts Smartbills) and your device asks you for permission.
• Cookies, SDKs and similar technologies (Section 11).
• Security records: sign-in history, multi-factor events and an audit log of views and changes inside each workspace.

4.5 Sensitive information

We do not ask for health, religious, ethnic, biometric or political information. A receipt can still reveal it (a pharmacy purchase, a donation, a union due). We treat document contents as confidential, use them only to provide the service, and do not use them to infer sensitive characteristics or to target ads.

Some laws treat financial account information, account credentials and precise location as sensitive. We use them only to provide the service you asked for, which is a permitted purpose under the CCPA, and we ask for express consent where Quebec or other law requires it.

5. Why we use it, and our legal bases#

| Purpose | Examples | Legal basis (GDPR / UK GDPR) | | --- | --- | --- | | Provide the service | Create accounts, capture and extract documents, match receipts to bank transactions, run approvals, record payments, sync to accounting software, deliver digital receipts | Performance of a contract; for Customer Data, the customer's instructions | | Payments and billing | Charge subscriptions, issue invoices, collect taxes, prevent payment fraud | Contract; legal obligation | | AI features | Read documents, suggest categories and GL codes, detect duplicates and policy issues, answer assistant and MCP requests | Contract; legitimate interests in an accurate, efficient service | | Support and communication | Answer requests, send service, security and billing notices | Contract; legitimate interests | | Security and fraud prevention | Detect abuse, protect accounts, investigate incidents, keep audit logs | Legitimate interests; legal obligation | | Improve and develop the service | Measure usage, fix bugs, test features, build aggregated benchmarks | Legitimate interests; consent where required for analytics cookies | | Marketing | Newsletters, product news, events, B2B outreach, ads for Smartbills on other sites | Consent where required (CASL, ePrivacy, Law 25); otherwise legitimate interests | | Hiring | Assess applications and contact candidates | Steps before a contract; legitimate interests | | Legal and compliance | Keep tax and accounting records, answer lawful requests, enforce our terms, defend claims | Legal obligation; legitimate interests |

When we rely on legitimate interests, we have weighed them against your rights. You can object (Section 12). When we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that already took place.

Under Canadian law we rely on your consent, which is express or implied depending on how sensitive the information is and what you would reasonably expect, or on an exception the law allows. We use personal information only for the purposes stated when it was collected, or for compatible purposes the law permits. Otherwise we ask for new consent.

6. De-identified and aggregated data#

We may create statistics that no longer identify a person or a customer, for example average spend per category, processing times or merchant coverage. We use them to improve Smartbills, to publish benchmarks and insights, and to report to merchant and bank partners. We take reasonable technical and contractual steps to stop the data being re-identified, as required by Quebec law and the CCPA, and we do not try to re-identify it ourselves. We do not share transaction details about an identified customer with merchants or banks except to deliver a service you or your organization asked for.

7. Artificial intelligence and automated decisions#

What AI does in Smartbills. We use machine learning and large language models to:

• read receipts, invoices and statements (optical character recognition and field extraction);
• suggest categories, vendors, tax treatment, GL codes and departments, and learn from your corrections;
• detect duplicates and match documents to bank transactions;
• flag spend that may break your organization's policies;
• power the Smartbills assistant and answer requests from AI agents connected through our MCP server or API.

Providers. These features run on Amazon Web Services (including Amazon Textract and Amazon Bedrock), Anthropic and OpenAI. Under our agreements, these providers process your data only to return results to us and may not use it to train their own models.

We do not train AI models on your data. We do not train or fine-tune machine-learning models on your documents or Customer Data, and our AI providers may not either. To suggest categories and GL codes, we turn chart-of-accounts entries and line-item descriptions into embeddings (numerical representations of the text) using OpenAI. We store them in a search index in our cloud environment, tagged to your workspace, and use them only to find matches for that workspace. Smartbills also learns coding rules from the choices people make in your workspace, vendor by vendor. Those rules apply only in your workspace, and administrators can review and delete them at any time.

You stay in control. AI suggestions can be wrong. They are labelled as suggestions, and you or your organization's reviewers can change them. When you talk to the assistant, you are talking to an AI system.

Automated decisions. Smartbills does not on its own make decisions about you that have legal or similarly significant effects. An organization can configure rules that act automatically, for example rejecting an expense over a limit or approving one under a threshold. Where a decision about you is based only on automated processing, as Quebec law defines it, you will be told. You can ask which personal information and which main factors led to the decision, have the information corrected, and ask a person to review it. Send the request to your organization or to us.

8. Google and Microsoft data#

If you connect a Gmail or Google Workspace account, Smartbills' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Gmail data only to find and import receipts, invoices and bills, and to show them to you in Smartbills;
• we do not use it for advertising, sell it, or use it to train generalized AI or machine-learning models;
• people at Smartbills do not read it unless you ask us to (for example, in a support request), it is necessary for security or to comply with law, or the data has been aggregated and anonymized for internal operations.

We apply the same limits to data from Microsoft Outlook and Microsoft 365. You can revoke access at any time in Smartbills or in your Google or Microsoft account settings.

9. Who we share it with#

We do not sell personal information for money. We share it only as described here.

Within your organization. Administrators, approvers and finance staff in your workspace can see the data their role allows.

Service providers (subprocessors). They act on our instructions, under contracts that require confidentiality, security and use only for our purposes. The main ones are:

| Provider | Purpose | Where data may be processed | | --- | --- | --- | | Amazon Web Services | Hosting, storage, databases, OCR, AI (Bedrock), email (SES), SMS and messaging | Canada (primary); United States for some AI and messaging services | | Anthropic | AI models for extraction, categorization and the assistant | United States | | OpenAI | AI models for specific features | United States | | Plaid | Bank and card account connections | United States, Canada | | Deck | Bill fetching: signs in to the supplier and utility portals you connect, with the credentials you provide, and retrieves your bills | Canada, United States | | Stripe | Subscription payments, card and bank payments | United States, Canada | | Apple and Google | Mobile app distribution, in-app subscription payments, mobile analytics and performance monitoring (Firebase) | United States | | Google (Cloud, Workspace APIs, Firebase, Maps) | Mailbox import, analytics, address validation, app infrastructure, content hosting | United States, Canada | | Microsoft | Outlook and Microsoft 365 mailbox import, sign-in | United States, Canada | | Twilio and SendGrid | SMS, voice verification and transactional email | United States | | Expo | Mobile push notifications | United States | | Microsoft Azure | Search index across your documents (Elasticsearch, operated by us) and the MCP server | Canada | | Sentry | Error and performance monitoring | United States | | Amplitude | Product analytics | United States | | HubSpot | Customer relationship management and marketing email | United States | | Apollo.io | Business contact data and sales outreach | United States | | Fireflies.ai | Transcription of sales and support calls | United States |

The full, current list of subprocessors for Customer Data, and how we notify customers of changes, is available from privacy@smartbills.ca and comes with our DPA.

Services you connect. When you connect an accounting system, bank, mailbox, payment partner, AI agent or other app, we exchange data with it as you direct. Its own terms and privacy policy apply.

Payment processor. To charge your subscription and let you collect invoice payments online, we share the necessary details with Stripe.

Merchants and banks in the receipt network. We share receipt data with the merchant that issued it and with the bank or app that displays it to you, as needed to deliver that receipt and its returns, warranty and loyalty features.

Advertising partners. Only if you accept marketing cookies on our websites, Google, Meta, LinkedIn, Microsoft and Apollo receive cookie identifiers and the pages viewed, and Google may receive a hashed copy of the email address you enter in a form, to measure our ads. They never receive the contents of your receipts or documents. Our apps show no third-party ads. Our Cookie Policy lists each tool.

Professional advisers and auditors, under a duty of confidentiality.

Authorities. When the law requires it, or to respond to a valid legal request after we have checked it, to protect the rights, property or safety of people or of Smartbills, or to investigate fraud. Where the law allows, we tell the customer or person concerned first.

Business transfers. If we are involved in a merger, financing, acquisition or sale of assets, personal information may be disclosed to the other party under a confidentiality agreement and used only for that transaction, as the law permits.

With your consent, for any other purpose we describe at the time.

9.1 International transfers

Our main databases and file storage are in Canada (AWS in Montréal). Our search index and MCP server run on Microsoft Azure in Toronto. Personal information may also be processed in the United States and other countries where our providers operate. Those countries' laws may let courts and authorities access the data.

• Quebec: before we communicate personal information outside Quebec, we carry out a privacy impact assessment and put written agreements in place that provide adequate protection, as section 17 of the Quebec Act requires.
• European Union and United Kingdom: Canada has an EU adequacy decision for commercial organizations subject to PIPEDA. For transfers to other countries, we rely on adequacy decisions (including the EU-US Data Privacy Framework and the UK Extension for certified providers), the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, with additional safeguards where needed. You can request a copy of the relevant safeguards from privacy@smartbills.ca.

10. Your choices about marketing and advertising#

• Email and SMS. We send commercial electronic messages only with your consent or where CASL, CAN-SPAM or other law allows. Every marketing email has an unsubscribe link, and we process unsubscribes within 10 business days. Reply STOP to an SMS to stop texts and HELP for help. Message and data rates may apply. Service, security and billing messages are not marketing and we will keep sending them while you have an account. Mobile phone numbers and SMS consent we collect for text messaging are never shared with, sold or rented to third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third party, except the service providers that deliver the messages on our behalf.
• Push notifications. Turn them off in your device settings.
• Ads on our websites. We do not use the contents of your documents to target ads. Marketing cookies stay off unless you accept them. To refuse or withdraw, choose Refuse all or More choices in the cookie banner, or use the Cookie preferences link in the footer of our site.
• Profiling. Where Quebec law applies, any feature that identifies, locates or profiles you is off by default until you turn it on.

11. Cookies and similar technologies#

We use cookies, local storage, pixels and mobile SDKs. Our Cookie Policy lists each one, what it does and how long it lasts.

• Strictly necessary cookies keep you signed in, secure the service and remember your choices. They are always on.
• Analytics (Google Analytics, Microsoft Clarity) and marketing (Google Ads, Meta, LinkedIn, Microsoft Advertising, Apollo) tools run only after you accept them. This applies to every visitor, wherever you are, because Quebec law requires tracking to be off by default.
• We count visits with Cloudflare Web Analytics, which sets no cookie.

You can change your choice at any time from the Cookie preferences link in the footer, and you can also block cookies in your browser. Marketing emails may contain pixels that tell us whether they were opened. You can block them by turning off automatic image loading in your email app.

12. Your rights#

Depending on where you live, you may have the right to:

• know and access the personal information we hold about you and how it is used and disclosed;
• correct inaccurate or incomplete information;
• delete information, subject to legal exceptions;
• portability: receive information you provided in a structured, commonly used technological format, or have it sent to another organization;
• withdraw consent at any time;
• object to processing based on legitimate interests, and to direct marketing at any time;
• restrict processing while a dispute is resolved;
• opt out of the sale or sharing of personal information, targeted advertising, and profiling that produces legal or similarly significant effects;
• limit the use of sensitive personal information;
• de-indexing (Quebec): ask us to stop disseminating information or to de-index a hyperlink where the law allows;
• information and review of automated decisions (Section 7);
• not be discriminated against for exercising your rights. We will not deny you service or charge you a different price because you exercised them;
• appeal our decision on your request, and complain to a regulator.

How to make a request. Email privacy@smartbills.ca, or use Settings → Privacy in the app to export or delete your account. We will verify your identity using information we already hold, usually by confirming your email address. We will not ask for more information than we need. An authorized agent can make a request for you with proof of authority. We may ask you to confirm the request directly.

Timing. We answer within 30 days (Canada, Quebec), one month (EU, UK) or 45 days (US states). Where the law allows, we may extend that once if the request is complex and will tell you why. Requests are free unless they are manifestly unfounded or excessive. If we refuse a request, in whole or in part, we will explain why in writing and tell you how to appeal or complain.

Data in an employer's workspace. If your request concerns Customer Data, we will refer it to the organization that controls it and help them answer, as our agreements require (Section 3).

Appeals (US). If we decline your request, reply to our decision with "Appeal" in the subject line. We will answer within the time your state's law requires. If you are not satisfied, you may contact your state Attorney General.

13. Notice for California and other US states#

This section adds information required by the CCPA and by the privacy laws of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states, to the extent they apply to us.

Categories collected in the last 12 months, with their sources (Section 4), purposes (Section 5) and recipients (Section 9):

| Category (CCPA) | Examples | Disclosed for a business purpose to | Sold or shared? | | --- | --- | --- | --- | | Identifiers | Name, email, phone, IP address, account ID, device ID | Service providers, connected services, payment partners | Shared with advertising partners (cookie IDs only, if you accept marketing cookies) | | Customer records (Cal. Civ. Code § 1798.80) | Address, bank account details, payment card brand and last four digits | Service providers, payment partners | No | | Commercial information | Purchases on receipts, subscriptions, transaction history | Service providers, connected services, merchants and banks in the receipt network | No | | Internet and network activity | Pages viewed, clicks, app usage | Service providers, analytics providers | Shared with advertising partners, if you accept marketing cookies | | Approximate geolocation | Location derived from IP; precise location only with permission | Service providers | No | | Audio and electronic information | Recorded support or sales calls | Service providers | No | | Professional information | Employer, title, department, manager | Service providers, connected services | No | | Inferences | Product preferences, likely interest in a plan | Service providers | No | | Sensitive personal information | Account log-in, financial account details, precise location | Service providers and payment partners, only to provide the service | No |

We do not sell personal information for money. Using marketing cookies on our websites, when you accept them, may count as "sharing" for cross-context behavioral advertising or a "sale" under some state laws. You can opt out as described in Section 10. We do not knowingly sell or share the personal information of anyone under 16.

We use sensitive personal information only for purposes the CCPA permits without a right to limit, such as providing the services you asked for, security and fraud prevention.

Retention is described in Section 14.

Financial incentives. We may offer discounts, for example the first-year discount on Professional. These are not conditioned on giving us personal information beyond what is needed to create the account. If we offer an incentive tied to personal information, we will describe its terms and how to withdraw before you join.

Metrics. We publish the number of CCPA requests received and how we responded each year, if the law requires it.

Shine the Light. California residents may ask once a year whether we disclosed personal information to third parties for their direct marketing. We do not.

Consumer health data. We do not collect consumer health data within the meaning of Washington's My Health My Data Act or Nevada's equivalent law in order to identify a person's health status. If receipts you upload contain health-related purchases, we use them only to provide the service.

14. How long we keep it#

We keep personal information only as long as needed for the purposes in this policy, then we destroy it or anonymize it for serious and legitimate purposes, as the law permits.

| Data | Retention | | --- | --- | | Customer Data in an active workspace | For the life of the subscription, under the customer's control | | Customer Data after a workspace or account is closed | Deleted from the live service after a 30-day recovery period. Encrypted database backups expire on a rolling schedule within 12 months. Earlier versions of uploaded documents and their extracted text stay in write-protected backup storage for up to 7 years, to protect financial records against loss, tampering and ransomware. They are not used for anything else, and are restored only at the customer's request or to recover from an incident | | Documents the customer must keep for tax purposes | The customer controls them. Export them before closing the account. Tax authorities generally require six years in Canada and Quebec, up to ten years in some EU countries, and three to seven years in the United States | | Our own billing and accounting records | Seven years after the end of the fiscal year they relate to | | Digital receipts delivered through the network | As long as the recipient's account or the merchant program is active, then deleted under the merchant agreement | | Application and security logs | 30 days. Logs of privileged administrative access: 12 months. The activity log inside a workspace is kept for the life of the workspace | | Support tickets | 3 years after the ticket closes | | Call recordings and transcripts | 12 months | | Marketing contacts | Until you unsubscribe or 3 years without engagement. We keep a suppression list so we do not contact you again | | Job applications | 12 months after the position is filled, unless you agree to a longer period |

Where we use personal information to make a decision about a person, we keep it for at least one year after the decision, as Quebec law requires.

15. How we protect it#

• encryption in transit (TLS) and at rest, with managed keys;
• tenant isolation: every record belongs to one organization and every query is limited to it;
• role-based access to production, granted for a stated reason, reviewed, and protected by multi-factor authentication;
• a managed vault for credentials and secrets;
• an audit log of views and changes in each workspace;
• vulnerability management, monitoring, backups and incident response procedures;
• confidentiality commitments and privacy and security training for staff and contractors.

More detail is on our Security page. No system is perfectly secure, so please use a strong, unique password and multi-factor authentication, and tell us at security@smartbills.ca if you think your account has been compromised.

Confidentiality incidents and breaches. We keep a register of confidentiality incidents. If an incident creates a risk of serious injury (Quebec), a real risk of significant harm (PIPEDA), or a risk to people's rights and freedoms (GDPR), we notify the Commission d'accès à l'information, the Office of the Privacy Commissioner of Canada, the competent supervisory authority and the people affected, within the time limits those laws set. For Customer Data, we notify the customer without undue delay so it can meet its own obligations.

16. Children#

Smartbills is a business and personal finance tool for adults. It is not directed to children, and you must have reached the age of majority where you live to create an account. We do not knowingly collect personal information from children under 14 (Quebec), 13 (US) or 16 (EU and UK). If you believe a child has given us personal information, contact privacy@smartbills.ca and we will delete it.

17. Links and third-party services#

Our sites, apps and receipts link to merchants, banks, app stores and other services that we do not control. Their privacy policies apply when you use them.

18. Changes to this policy#

We will update this policy when our practices or the law change, and we will change the effective date at the top. If a change is significant, we will tell you in advance by email or in the app, and where the law requires it we will ask for your consent again. Earlier versions are available on request.

19. Complaints#

Please contact us first at privacy@smartbills.ca. We will acknowledge your complaint, look into it, and answer within 30 days. You may also complain to a regulator:

• Quebec: Commission d'accès à l'information du Québec, www.cai.gouv.qc.ca, 1-888-528-7741.
• Canada: Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3, www.priv.gc.ca, 1-800-282-1376.
• Alberta: Office of the Information and Privacy Commissioner of Alberta. British Columbia: Office of the Information and Privacy Commissioner for British Columbia.
• European Union: the data protection authority where you live or work, or where the issue arose.
• United Kingdom: Information Commissioner's Office, ico.org.uk.
• United States: your state Attorney General, or the California Privacy Protection Agency at cppa.ca.gov.