Privacy Policy

Last updated: March 23, 2026

1. Who We Are

NimBill ("we", "our", "us") is a Canadian invoicing and billing platform operated by Northern System Solutions, based in Yukon, Canada. We are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

2. Information We Collect

We collect only what is necessary to provide the service:

• Account information: your name, email address, and (if applicable) hashed password
• Business profile: company name, address, logo, tax numbers (GST/HST), and payment settings you enter
• Client data: client names, emails, addresses, and invoice records you create
• Usage data: IP addresses and user-agent strings logged when portal or pay links are opened (for fraud/security purposes)
• Payment data: Stripe handles all card processing — we never see or store full card numbers
• Google OAuth (if used): your Google account email and display name, provided by Google during sign-in

3. How We Use Your Information

• To provide and operate the NimBill service
• To send transactional emails (account verification, password resets, invoices)
• To process payments via Stripe
• To detect and prevent fraud or abuse
• To comply with Canadian legal and tax obligations

We do not sell your data, use it for advertising, or share it with third parties except as described below.

4. Third-Party Services

• Stripe — payment processing. Subject to Stripe's Privacy Policy
• Resend — transactional email delivery
• Google — optional OAuth sign-in. Subject to Google's Privacy Policy

5. Data Storage and Security

NimBill is operated by a Canadian company and built for Canadian users. Our web hosting infrastructure is provided by Hostinger, a third-party hosting provider, with servers located in the United States (Boston, MA). As a result, your data may be stored on and transmitted through servers in the United States.

By using NimBill, you acknowledge that your information may be subject to access by U.S. authorities under applicable U.S. law. We have no control over this. We do not voluntarily share your data with any government or third party except as required by law.

We take security seriously regardless of server location: each account's data is isolated in its own database, all connections are encrypted with HTTPS (TLS), session tokens are stored as httpOnly cookies, and passwords are hashed with bcrypt and never stored in plain text.

We are committed to transitioning to Canadian-based hosting infrastructure in the future as the service grows.

6. Your Rights Under PIPEDA

You have the right to:

• Access a copy of your personal information (use Settings → Export My Data)
• Correct inaccurate information
• Withdraw consent and delete your account (use Settings → Delete Account)
• File a complaint with the Office of the Privacy Commissioner of Canada

7. Data Retention

We retain your data for as long as your account is active. When you delete your account, all associated data is permanently removed from our servers within 30 days.

8. Cookies

We use a single httpOnly session cookie (nb_token) to keep you logged in. We do not use tracking cookies or third-party analytics cookies.

9. Children's Privacy

NimBill is not directed at children under 13. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this policy from time to time. We will notify you by email or a notice in the app if we make material changes.