Legal
Privacy policy
Last updated 2026-09-17
Draft. This text has not yet been reviewed by a lawyer.
Who is responsible
[Legal entity operating Snapbill], [Postal address], Québec, Canada. The person responsible for the protection of personal information is [Name of the person responsible for the protection of personal information], reachable at hello@snapbill.sbs.
What we collect
Your email address and password hash. The documents you upload (photos and PDFs of bills) and the data extracted from them, which may contain personal information such as names, addresses and partial card numbers printed on receipts. Project details you enter, such as claim details. Technical logs needed to run the service (IP address, browser, timestamps). If you subscribe to Pro, Stripe holds your payment details; we hold only a customer reference and subscription status.
Why
To provide the service you asked for: read your documents, store the results, and produce exports. To secure accounts and prevent abuse. To email you about your account (confirmation, password reset, invitations). We do not use your information for advertising and do not sell it.
Who it is shared with
Anthropic (reading documents via the Claude API). DigitalOcean (hosting the API and database). Netlify (hosting this website). Stripe (payments). Our email provider (account emails). Frankfurter / the European Central Bank (exchange rates; only currency codes and dates are sent). Some of these providers are outside Québec and Canada; your information may be processed in the United States or the European Union, where different laws apply.
Cookies and analytics
This website sets no cookies. The app sets only the cookies needed to keep you signed in. We do not use tracking or advertising cookies.
How long we keep it
As long as your account exists. Deleting a bill deletes its file immediately. Deleting your account deletes everything immediately. Technical logs are kept for a short period for security and then discarded.
Security
Passwords are hashed with Argon2id. Connections are encrypted. Sessions are short-lived. See the Security and privacy page for details.
Your rights
You can access, correct and delete your personal information from the account page, or by writing to the person responsible. You can withdraw consent by deleting your account. You can complain to the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada.
Privacy incidents
If a confidentiality incident presents a risk of serious injury, we will notify affected persons and the Commission d’accès à l’information as required by law.
Changes
We will post changes here and note the date above.