1. Introduction and Who We Are
This Privacy Policy explains how 1001800000 Ontario Inc., an Ontario corporation carrying on business under the registered business name “QuoteAndBill” and operating the website https://www.QuoteAndBill.ca (the “Company”, “we”, “us” or “our”), collects, uses, discloses, stores, retains and protects personal information in connection with QuoteAndBill.ca, its website, account portal, software, and related services (collectively, the “Platform”).
QuoteAndBill and QuoteAndBill.ca are business and website names used by 1001800000 Ontario Inc. They are not separate legal entities. References in this Policy to “QuoteAndBill” mean 1001800000 Ontario Inc.
This Policy applies to visitors to our website, account holders, prospective customers, subscribers, and individuals whose information is entered into the Platform by a business customer. It should be read together with our Terms of Use. If you do not agree with this Policy, you should not create an account or submit personal information through the Platform. Certain information may nevertheless be collected where permitted or required by law, such as essential technical or security information.
We aim to handle personal information in accordance with applicable Canadian privacy laws, which may include the Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta’s Personal Information Protection Act, British Columbia’s Personal Information Protection Act, Quebec’s Act respecting the protection of personal information in the private sector, and other applicable laws. Which law applies depends on the facts, the individuals involved, the location of the information and the activities being carried out. This Policy does not replace or limit any legal obligation that applies to the Company.
2. What Is Personal Information?
“Personal information” generally means information about an identifiable individual, as defined by applicable privacy law. It may include information about you personally and information about your customers, employees, contractors or other individuals that you enter into the Platform. Business information relating solely to a corporation may not be personal information, but information about an identifiable sole proprietor or individual may be.
3. Categories of Information We May Collect
3.1 Account and registration information
Name, business or operating name, business legal name, email address, telephone number and business address.
Login credentials and authentication information, such as password hashes, session identifiers or authentication tokens. We do not intend to store passwords in readable plain text.
Business profile details and information needed to configure an account, such as business type, province or territory, tax registration details and applicable business settings.
Information used to administer trial eligibility, subscriptions, account status, user seats, fraud prevention and customer support.
3.2 Estimates, invoices and customer records
When a business customer uses the Platform, that customer may enter information about its own customers, suppliers, employees or other contacts. Depending on how the customer uses the Platform, this may include:
Names, business names, billing addresses, shipping addresses, email addresses and telephone numbers.
Descriptions of work, products or services, line items, quantities, rates, prices, discounts, taxes, invoice and estimate numbers, dates, payment terms, notes and other document details.
Payment records or milestones entered by the User, including amounts, dates, references and payment status. A payment record entered into the Platform is not necessarily proof that funds were received or cleared.
Related estimates, quotations, invoices, receipts, customer account details and business reports.
The business customer that enters information about its customers is responsible for ensuring it has the legal authority and any required notices or consents to provide that information to us. We process such information to provide the Platform to that business customer and in accordance with this Policy, our Terms of Use and applicable law.
3.3 Subscription and billing information
We may receive information about subscription plan, trial status, billing status, transaction amount, payment date, payment method type, processor transaction identifiers, invoice or receipt references, and payment success or failure. Payment card and bank account details are handled by the applicable payment processor as described in Section 7.
3.4 Technical, device and usage information
Internet Protocol (IP) address, approximate location inferred from IP address, browser type, device type, operating system and language settings.
Pages, screens and features viewed, actions taken, dates and times of access, referring pages, session information, error logs and diagnostic information.
Security and audit information, such as login attempts, account events, access logs and information used to detect suspicious activity or protect the Platform.
3.5 Communications and support
If you contact us, we may collect your name, email address, contact details, the content of your message, attachments you choose to provide, and records of our communications with you.
3.6 Information from other sources
We may receive limited information from payment processors, authentication providers, hosting or infrastructure providers, fraud-prevention tools, or other service providers where needed to provide the Platform, verify a transaction, protect an account or comply with law. We do not knowingly purchase personal customer lists for the purpose of adding people to marketing lists.
4. How We Collect Information
We collect information directly from you when you visit the website, register, complete business setup, use the Platform, subscribe, contact support or otherwise provide information. We may also collect information automatically through cookies, server logs, session technologies and similar tools. In addition, we may receive information from service providers and third parties as described in this Policy.
You may choose not to provide certain information. However, some information is necessary to create an account, authenticate users, provide invoicing functions, process a subscription, respond to a request or meet legal and security requirements. If you do not provide required information, some or all features may not be available.
5. Purposes for Which We Use Information
Subject to applicable law and any required consent, we may use personal information for the following purposes:
Create, authenticate, administer and secure accounts and provide the Platform’s estimates, invoices, customer records, payment-entry tools and reports.
Configure business profiles and tax-related settings based on information entered by the User. The Platform’s calculations and outputs must be independently checked by the User and are not professional tax or accounting advice.
Administer free trials, subscriptions, recurring billing, cancellations, payment status, account limits and customer support.
Communicate with Users about account setup, service changes, maintenance, security alerts, subscription matters, support requests and other service-related matters.
Monitor service performance, troubleshoot errors, maintain and improve functionality, develop features and understand general usage patterns.
Detect, investigate and prevent fraud, duplicate or abusive trial use, unauthorized access, security incidents, misuse and violations of our Terms of Use.
Protect the rights, property, safety and security of the Company, Users and others, and establish, exercise or defend legal claims.
Comply with applicable laws, regulations, court orders, lawful requests, recordkeeping duties and regulatory requirements.
Carry out a corporate transaction, such as a merger, financing, restructuring, acquisition or sale of all or part of the business, subject to appropriate safeguards and applicable law.
We will not use personal information for a new purpose that is materially different from the purposes described here without providing any notice or obtaining consent required by applicable law.
6. Consent and Your Choices
We seek consent for the collection, use and disclosure of personal information where required by applicable law. Consent may be express or, where legally permitted and appropriate in the circumstances, implied through your actions or the nature of your relationship with us. By creating an account, submitting information or using the Platform after being given access to this Policy, you acknowledge the practices described here; this acknowledgement does not replace any separate consent that the law requires.
You may withdraw consent, subject to legal or contractual restrictions and reasonable notice, by contacting us. If you withdraw consent for information that is necessary to provide an account or essential feature, we may be unable to continue providing that feature or the Platform to you. We will explain the reasonably foreseeable consequences where appropriate.
Service-related communications, such as account, billing, security, maintenance and support messages, may be necessary to operate your account and are not the same as optional promotional messages. If we send promotional electronic messages, we will comply with applicable anti-spam and consent requirements and provide an unsubscribe mechanism where required.
7. Payment Processing and Stripe
Subscription payments are processed through Stripe, which may include Stripe Canada or another Stripe entity selected for the transaction. When you enter payment details through a Stripe-hosted or Stripe-provided payment interface, those details are collected directly by Stripe and are handled under Stripe’s own terms and privacy documentation.
The Company’s current intended configuration is not to collect or store complete payment card numbers or bank account credentials on its own application servers. We may receive limited payment-related information from Stripe, such as transaction identifiers, payment status, card brand, limited card digits, billing details or other information necessary to administer a subscription. The precise information exchanged depends on the payment integration and settings.
Stripe is an independent service provider and may process information in accordance with its own privacy practices. Please review Stripe’s privacy information at https://stripe.com/privacy. We do not control Stripe’s independent systems or privacy practices.
8. When and With Whom We Share Information
We do not sell personal information for money. We do not rent or trade customer lists. We may disclose or make personal information available only as reasonably necessary for the purposes described in this Policy, with appropriate authority and safeguards, or as otherwise permitted or required by law.
8.1 Service providers and technology vendors
We may use third-party companies to provide hosting, cloud infrastructure, database storage, authentication, security, payment processing, email delivery, analytics, customer support, backup, monitoring and other technical services. Based on the current design and information in our existing policy materials, providers may include Vercel, Supabase and Stripe. The actual providers and services may change as the Platform develops.
These providers may process or store information on our behalf and may have personnel or infrastructure in Canada or other countries. We seek to use service providers subject to contractual, technical or other safeguards appropriate to the services they perform. Each provider’s own terms and privacy practices may also apply to its processing.
8.2 Legal, regulatory and safety disclosures
We may disclose information where we reasonably believe disclosure is required or authorized by applicable law, regulation, court order, subpoena, warrant, lawful government request or legal process, or where disclosure is reasonably necessary to investigate fraud, protect the Platform, enforce our Terms of Use, protect rights or safety, or establish, exercise or defend legal claims.
8.3 Business transfers
If the Company is involved in a merger, acquisition, financing, corporate reorganization, insolvency proceeding, sale of shares, sale of assets or transfer of some or all of its business, personal information may be disclosed to prospective or actual counterparties and transferred as part of the transaction, subject to appropriate confidentiality measures and applicable privacy law. Any successor or recipient will be expected to handle the information in accordance with applicable law and any commitments that continue to apply.
8.4 With your direction or consent
We may disclose information when you direct us to do so, authorize an integration, connect a third-party service, or otherwise provide consent where required.
9. Processing and Storage Outside Your Province or Canada
The Company and its service providers may process, access or store personal information in locations outside your province or outside Canada, depending on the location of the Company’s systems, service providers, support personnel and infrastructure. In those locations, information may be subject to the laws of that jurisdiction and may be accessible to courts, law enforcement or government authorities under those laws.
We take reasonable steps to select and manage service providers and to use contractual, organizational and technical safeguards appropriate to the information and services involved. However, the Company does not control the laws or independent actions of foreign governments or third-party providers. We do not promise that all information will be stored exclusively in Canada.
If a particular law requires additional notice, consent, assessment or safeguards for an international transfer or processing arrangement, the Company will take the steps required by that law.
10. Cookies and Similar Technologies
The Platform may use cookies, local storage, session identifiers, pixels or similar technologies. These technologies may be used to:
Authenticate users, maintain login sessions and remember account or security settings.
Protect against unauthorized access, fraud, abuse and suspicious activity.
Remember preferences and improve the operation and usability of the Platform.
Understand website and feature usage through analytics, where such tools are enabled.
Essential cookies and session technologies may be necessary for login, security and core Platform functions. Blocking or deleting them may prevent some or all account features from working. Where non-essential analytics or advertising technologies are used, we will provide choices or obtain consent where required by applicable law. You can also manage cookies through your browser settings, although browser controls may not disable every technology or preserve all preferences.
Our current policy materials state that the Platform is not intended to use invasive third-party advertising tracking scripts. If analytics, advertising or other tracking tools are added or changed, this Policy and any required consent controls should be updated accordingly.
11. Data Security and Safeguards
The Company uses or intends to use reasonable administrative, technical and organizational safeguards designed to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, modification or destruction. Safeguards may include access controls, authentication, role-based permissions, secure connections, encryption features provided by infrastructure vendors, logging, backups, monitoring, vendor controls and staff confidentiality practices, as appropriate to the nature and sensitivity of the information.
No website, cloud service, database, electronic transmission or storage system can be guaranteed to be completely secure. Despite reasonable safeguards, information may be exposed through cyberattacks, vulnerabilities, human error, compromised credentials, service-provider incidents, telecommunications failures or other events.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE COMPANY DOES NOT WARRANT OR GUARANTEE THAT THE PLATFORM OR ANY TRANSMISSION, STORAGE SYSTEM OR THIRD-PARTY SERVICE WILL BE COMPLETELY SECURE, UNINTERRUPTED OR FREE FROM UNAUTHORIZED ACCESS, LOSS OR CORRUPTION. This statement does not exclude the Company’s obligations to use safeguards or meet breach-response duties imposed by applicable law.
Users must protect their passwords and devices, restrict account access, use strong authentication where available, keep contact details current, and notify us promptly if they suspect unauthorized access or disclosure. Users should maintain independent copies of important business records.
12. Privacy Breaches and Incident Response
If the Company becomes aware of a security incident involving personal information, we will take steps appropriate to the circumstances to investigate, contain and address the incident, assess the risk of harm, preserve relevant records and implement reasonable corrective measures.
Where applicable privacy law requires notification to affected individuals, a privacy commissioner or another authority, the Company will provide notifications within the time and in the manner required by law. Under PIPEDA, for example, organizations must report certain breaches that create a real risk of significant harm, notify affected individuals and keep records of all breaches of security safeguards as required by the Act and regulations.
We cannot promise that every incident will be prevented or that every incident will be detected immediately. Nothing in this Policy limits any mandatory notification, reporting, cooperation or recordkeeping obligation imposed by law.
13. Retention and Secure Disposal
We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, to provide the Platform, administer accounts and subscriptions, resolve disputes, enforce agreements, meet legal or regulatory obligations, maintain appropriate business records, protect security and establish, exercise or defend legal claims.
Our current intended account-data practice is that, after a subscription is cancelled or expires, account records and associated estimates, invoices and customer records may remain in an inactive state for up to 90 days to allow possible reactivation. After that period, the Company may permanently delete the data from active production systems, subject to legal requirements, technical limitations and the backup and archival practices described below.
Deletion from active systems may not immediately remove all copies from encrypted backups, disaster-recovery systems, logs, archives or records retained for legal, security or compliance reasons. Such copies will be retained only as reasonably necessary and will be deleted, overwritten or de-identified according to applicable retention schedules and technical processes.
Retention periods may vary depending on the type of information, account status, legal requirements, dispute holds, security needs and the services in use. We do not promise that data will remain recoverable after account closure or after the applicable retention period. Users should export and keep their own copies of business records they need.
14. Access, Correction, Deletion and Other Privacy Rights
Depending on the privacy law that applies to you and the circumstances, you may have rights to request access to personal information we hold about you, request correction of inaccurate or incomplete information, withdraw consent where permitted, ask questions about our handling of your information, or make a complaint to the applicable privacy regulator.
You may be able to view, update or download certain business records through your account. You may also contact us to request access to or correction of personal information. We may need to verify your identity and authority before responding.
You may request deletion of personal information, but deletion is not absolute. We may retain information where permitted or required by law, where necessary to complete a transaction, maintain records, resolve disputes, prevent fraud, protect security, comply with legal obligations or establish, exercise or defend legal claims. If we cannot fulfil a request in full, we will explain the reasons to the extent required by law.
If you are a customer, employee or other individual whose information was entered into QuoteAndBill by one of our business customers, please understand that the business customer may control the purpose for which your information was collected. You may need to direct your request to that business. We will assist or respond as required by applicable law and our role in relation to the information.
We will respond to privacy requests within the time limits required by applicable law. We may charge a permitted fee for certain requests only where the law allows it and after providing any required notice.
15. Children’s Privacy
The Platform is designed for business users and is not intended for individuals under 18 years of age to create accounts or subscribe. We do not knowingly seek to collect personal information directly from children under 18 for account creation. If we become aware that an account has been created by a person under 18 without legally valid authority, we may restrict the account and take reasonable steps to address or delete the information, subject to applicable law.
Business customers may enter limited information about individuals in the ordinary course of business records. They are responsible for ensuring that any such collection and disclosure is lawful and appropriate.
16. Third-Party Websites and Services
The Platform may contain links to third-party websites or use third-party integrations. This Policy does not govern the privacy practices of independent third parties. When you leave our Platform or interact directly with a third-party service, that third party’s privacy policy and terms apply. We encourage you to review those policies before providing information.
17. No Guarantee of Accuracy of User-Entered or Generated Information
The Platform may store, display, organize or process information entered by Users and may generate documents, calculations or reports from that information. The Company does not independently verify the identity, accuracy, completeness, legality or quality of information entered by Users, nor does it audit the underlying transactions or source records.
The Company does not warrant that information entered by a User, customer records, estimates, invoices, payment entries, tax settings, calculations or reports are accurate, complete, current or suitable for any particular purpose. Users remain responsible for the information they enter, the legal authority to provide it, and the verification and use of all outputs. This section concerns the reliability and use of Platform content; it does not remove the Company’s privacy obligations regarding personal information it handles.
18. Corporate Structure and Personal Liability
The Platform is operated by 1001800000 Ontario Inc. The Company is the organization responsible for the privacy practices described in this Policy, subject to applicable law. The business name QuoteAndBill.ca is not a separate legal person.
To the extent permitted by law, no director, officer, shareholder, employee or family member of a shareholder assumes personal responsibility for the Company’s privacy practices solely because of their share ownership, family relationship, title or association with the Company. The Company acts in its corporate capacity.
This Policy does not create a personal guarantee by any shareholder, including a spouse or family member who may hold shares in the Company. However, no provision of this Policy releases any individual from that person’s own legal duties, personal acts or omissions, statutory obligations, fraud, wilful misconduct, personal guarantee or other liability that cannot legally be excluded. Nothing in this section limits the Company’s own obligations or any individual’s non-waivable privacy rights.
19. Changes to This Privacy Policy
We may update this Policy from time to time to reflect changes in the Platform, service providers, business practices, technology or applicable law. The revised version will be posted on the website with an updated “Last Updated” date. If a change is material or applicable law requires it, we will provide additional notice or obtain consent as required.
The updated Policy will apply from its stated effective date, subject to applicable law. Continued use of the Platform is not treated as consent where the law requires a different form of consent. We encourage you to review this Policy periodically.
20. Contact Our Privacy Officer
If you have a privacy question, wish to request access or correction, request deletion, withdraw consent where permitted, or make a privacy complaint, please contact:
Privacy Officer\n1001800000 Ontario Inc.\nDoing business as QuoteAndBill\nWebsite: https://www.QuoteAndBill.ca\nEmail: myaccountsmanager@yahoo.ca
Please include enough information for us to identify your request, but do not send passwords, full payment card numbers or other highly sensitive information by ordinary email. We may ask you to verify your identity before processing a request.
If you are not satisfied with our response, you may have the right to contact the privacy commissioner or other regulator with jurisdiction over your complaint, including the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.
21. Important Notice
This Privacy Policy describes the Company’s intended privacy practices and does not promise that risk can be eliminated or that every third-party system is under the Company’s direct control. The Company will take the steps required by applicable law and the safeguards described in this Policy. Nothing in this Policy is intended to waive, exclude or limit a privacy right, remedy, duty or liability that cannot legally be waived, excluded or limited.