Privacy Policy

1. Who we are

NearbyStore ("NearbyStore", "we", "us") operates the NearbyStore website at nearbystore.ca and the NearbyStore application at app.nearbystore.ca (together, the "Service"). We are based in Vancouver, British Columbia, Canada.

We are the organization responsible for the personal information described in this policy. Questions, requests and complaints go to our contact form, which reaches our privacy contact directly.

2. What this policy covers

This policy explains what personal information we collect through the Service, why we collect it, how we handle it, and what you can ask us to do with it. It applies to the website and the application, including the current beta.

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA).

3. What we collect

Information you give us

• Account details: your email address and authentication credentials, so you can sign in and so your receipts stay attached to you and nobody else.
• Receipt images: the photographs of receipts you choose to upload.
• Corrections you make: when you fix a misread line item, we keep the correction so your totals are right and so the scanner improves.
• Messages you send us: your name, email address and whatever you write in the contact form.

Information we derive from your receipts

• The merchant name and store, the purchase date and time.
• Each line item: description, quantity, unit price, line total, and any discount or tax indicator printed on the receipt.
• The receipt subtotal, taxes and total.

This derived data is the product. It is what makes your monthly spending breakdown and your price history possible.

Information collected automatically

• Basic technical information needed to serve and secure the Service: IP address, device and browser type, and timestamped request logs.
• Error and diagnostic logs, which record identifiers such as a request ID and a receipt ID, never the receipt image or its contents.

We do not use advertising trackers, and the marketing website sets no cookies.

4. What we deliberately never keep

A grocery receipt very often prints payment details along the bottom. The Service does not need any of it, and does not keep any of it. The following are detected and removed before your receipt data is stored:

• Card numbers (full or partial)
• Masked card numbers
• Authorization codes
• Retrieval reference numbers (RRNs)
• Application identifiers (AIDs)
• Terminal IDs
• Cardholder names
• Other payment references, including card network names

Two things are worth knowing about how that works. First, the data structures we store receipts into have no fields for payment information at all, so there is nowhere for it to legitimately land. Second, the detection that strips it is ordinary deterministic code: pattern matching plus a Luhn checksum on card-like digit sequences, run independently of the AI model that reads the receipt. It does not rely on the model correctly flagging its own output, and it cannot be talked out of it. If a line item matches a payment pattern, that whole line is discarded rather than partially kept.

5. Why we use your information

• To provide the Service: read your receipts, calculate your spending, build your price history, and let you search what you have bought.
• To keep your account secure: authenticate you, and detect abuse.
• To improve accuracy: use corrections and low-confidence reads to make the scanner better.
• To support you: reply to messages you send us.
• To meet legal obligations: where the law requires it.

We rely on your consent for these purposes. You give it by creating an account and uploading receipts, and you can withdraw it at any time (see section 9).

6. Aggregated and de-identified price data

We use price information derived from receipts, in aggregated and de-identified form, to build price records for products. For example, how the price of a common grocery item has moved over time in a given area. Aggregated price data contains no identifier that points back to you, no receipt image, and nothing about your basket as a whole.

We do not publish, sell or share your individual receipts or your individual purchase history. If we ever intend to use your information for a purpose not described in this policy, we will ask you first.

7. Who can see your information

Your receipts and their contents are visible to you. Every request for a receipt image or its data requires you to be signed in, and is checked against the account that owns it. We do not generate public links to receipt images.

We share personal information only in these limited cases:

• Service providers who host and operate the Service on our behalf: cloud hosting, database and storage, and the AI provider that performs text extraction on receipt images. They act on our instructions, are bound to protect the information, and may not use it for their own purposes.
• Legal requirements: where we are required by law, a court order, or a lawful request from a public authority.
• A business transfer: if NearbyStore is acquired or merged, information may transfer as part of that transaction. You would be notified, and this policy would continue to apply until replaced.

We do not sell personal information, and we do not share your receipts with retailers, advertisers or data brokers.

8. Where your information is stored

Personal information may be stored and processed on servers located in Canada, the United States, or other countries where our service providers operate. When information is held outside Canada, it is subject to the laws of that jurisdiction, and may be accessible to courts and law enforcement there. We use providers that apply protections comparable to those required under Canadian law.

9. Your rights

Under PIPEDA and BC PIPA you can:

• Access the personal information we hold about you, and be told how it has been used and to whom it has been disclosed.
• Correct information that is inaccurate or incomplete, including directly in the app, for any misread line item.
• Delete individual receipts, or your entire account. Deleting a receipt removes its image and the line items derived from it. Deleting your account removes your account and the receipt data attached to it.
• Withdraw consent to our handling of your information, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent generally means closing your account, since the Service cannot function without receipt data.
• Complain: to us first, and if you are not satisfied, to the Office of the Privacy Commissioner of Canada or to the Office of the Information and Privacy Commissioner for British Columbia.

Use the contact form and choose "Privacy or data request". We respond within 30 days, as required by law, and we will tell you if we need longer and why.

10. How long we keep it

We keep your receipts and derived data for as long as your account is open, because the value of the Service is precisely that your history sticks around. When you delete a receipt or close your account, we remove the associated personal information from our active systems, and it ages out of routine backups in the ordinary course. We may retain limited records where the law requires it, or where we need them to resolve a dispute or enforce our agreements.

Aggregated and de-identified price data, which cannot be linked back to you, may be retained after deletion.

11. Security

We protect personal information with safeguards appropriate to its sensitivity: authenticated and ownership-checked access to every receipt, encryption in transit, access controls on our systems, and a logging policy that forbids writing receipt images, full extracted text, payment values or raw model responses into logs.

No system is perfectly secure, and we will not pretend otherwise. If a breach creates a real risk of significant harm to you, we will notify you and the relevant regulator as required by law.

12. Children

The Service is not directed at children. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Beta software

The Service is currently in beta. Features change, and occasionally break. We apply this policy to beta data exactly as we would to production data, but you should keep your own copies of anything you cannot afford to lose.

14. Changes to this policy

If we change this policy we will update the date at the top of this page. For changes that materially affect how we handle your information, we will give you notice through the Service or by email before the change takes effect.

15. Contact us

Privacy questions, access requests, deletion requests and complaints all go to the same place: the contact form, with "Privacy or data request" selected. It reaches our privacy contact directly.

NearbyStore · Vancouver, British Columbia, Canada.