Privacy Policy

This policy explains how Nomad Stack, LLC, 390 NE 191st STE 56284, Miami, FL 33179, USA ("NomadBill", "we") handles personal data in the NomadBill web app at app.nomadbill.co and in the NomadBill mobile apps. Controller contact: office@nomadstack.io, +1 239 508 7567.

1. Data we collect

• Account data: name, email address, password hash, language and currency preferences, role, support-widget preference.
• Company and billing data you enter: company name, address, tax/VAT identifiers, logo, signature, bank details shown on documents, branding colors, slug.
• Business content: customers and contacts, products, invoices, quotes, receipts, custom fields, templates, attachments, notes, reminders.
• Payment data: subscription status, plan, billing period and payment identifiers. Card data is entered directly with Stripe or Apple and never stored on our servers.
• Connected integrations (optional, only if you enable them): mailbox messages and attachments (Nylas), bank account and transaction data (Plaid), payout and charge data (Stripe Connect).
• Technical data: IP address, device and browser type, timestamps, error and access logs.
• Usage and marketing analytics: aggregated page and event data (Google Analytics, Meta Pixel) on our website. The iOS app does not use advertising tracking and does not request the App Tracking Transparency permission.

2. Why we use it (purposes and legal bases)

• Providing the Service and your account — performance of a contract (Art. 6(1)(b) GDPR).
• Billing, subscriptions, fraud prevention — contract and legal obligation (Art. 6(1)(b), (c)).
• Support, security, abuse prevention, service improvement — legitimate interests (Art. 6(1)(f)).
• Analytics and marketing pixels on the website — consent (Art. 6(1)(a)), withdrawable at any time.
• AI-assisted document reading and branding extraction, when you use those features — contract.

We do not sell personal data and do not use your business content to train third-party AI models on our initiative.

3. Processors and recipients

• Supabase — database, authentication, file storage and hosting.
• Cloudflare / Lovable — application hosting and delivery.
• Stripe — payments, subscriptions and Stripe Connect payouts.
• Apple — in-app purchases and subscription billing for App Store purchases.
• Plaid — bank account and transaction retrieval, if you connect a bank.
• Nylas — mailbox provisioning, sending and receiving of documents, if you use the Inbox.
• Resend — transactional email (invoices, reminders, account emails).
• Crisp — support chat.
• Google Analytics, Meta Pixel — website analytics and advertising measurement, subject to consent.
• AI providers (via the Lovable AI Gateway) — document and website content processing for the features you trigger.
• Frankfurter — exchange rates (no personal data transmitted).

We may also disclose data where legally required, to enforce our terms, or in connection with a merger or acquisition. Processing may take place in the United States and other countries; transfers rely on standard contractual clauses or comparable safeguards.

4. Retention

Account and business data are kept while your account exists. After account deletion we delete or anonymise data within 30 days, except where retention is legally required (e.g. invoice and tax records, typically up to 10 years) or needed to resolve disputes. Technical logs are kept up to 90 days.

5. Your rights and data deletion

You have the right to access, correct, delete and export your data, to restrict or object to processing, to withdraw consent, and to lodge a complaint with a supervisory authority. Depending on where you live you may also have rights under the CCPA/CPRA, including the right to know, delete and to opt out of sharing.

You can export data at any time in the app, delete your account in Settings, or email office@nomadstack.io to request full deletion. We answer requests within 30 days.

6. Cookies and local storage

We use strictly necessary cookies and local storage for login sessions, language, currency and interface preferences. Analytics and marketing cookies are only set with your consent and can be withdrawn at any time.

7. Security

Data is encrypted in transit (TLS) and at rest by our hosting providers. Access is restricted by row-level security so that each company only sees its own data, and administrative access is limited and logged.

8. Children

The Service is intended for businesses and adults. We do not knowingly collect data from children under 16.

9. Changes

We will update this policy as the Service evolves and announce material changes in the app or by email before they take effect.

10. Contact

Nomad Stack, LLC, 390 NE 191st STE 56284, Miami, FL 33179, USA — office@nomadstack.io, +1 239 508 7567. See also our Terms of Service and legal notice.