Privacy Policy

This Privacy Policy explains how NextBill ("we," "us," "our") collects, uses, stores, and shares information about you when you use our website and services at nextbill-nti.com. We comply with the Philippines' Data Privacy Act of 2012 (Republic Act 10173) and its Implementing Rules and Regulations, and, for people in the European Union, the EEA and the United Kingdom, with the GDPR.

1. Who we are

NextBill is an online bill-splitting service operated by Nextcore Technology Inc., a domestic corporation registered in the Philippines (TIN 686-391-731-00000, BIR RDO 039 — South Quezon City). Our registered office is at 17E Floor, Atherton Place Condominium, Tomas Morato cor. Roces Ave., Laging Handa, 1103 Quezon City, NCR, Philippines.

Nextcore Technology Inc. is the data controller for the information described below. You can reach us at support@nextbill-nti.com.

Privacy contact: for any question or request about your personal data, email our privacy contact at support@nextbill-nti.com with "Privacy" in the subject.

2. Information we collect

We collect only what we need to run the service:

• Account information: your name, email address, and a one-way hash of your password (we never store your password in readable form). Optionally, the name and email of an inviter if you joined via invitation. Your settings, such as how often you get the summary email.
• Signing in with Apple or Google (if you choose it): which one, the ID it gives us for your Apple or Google account, and the email address it gave when you first used it. With Apple, that may be a private relay address that forwards our emails to you. We also take your name from it when we make your account. If you use Sign in with Apple, we keep a token from Apple only so that we can end your Sign in with Apple when you delete your account. We never get your Apple or Google password.
• Two-step verification (if you turn it on): the secret your authenticator app shares with us, kept encrypted; a one-way hash of each recovery code; and when it was turned on or off, when a recovery code was used, and who turned it off if our support team did so at your request.
• Bill data: the title, description, currency, subtotal, tax, service charge, participant names and emails, and split mode for each bill you create. Plus your record of who has been marked paid.
• Group data: the name, description, default currency, and member list of any groups you own or join; a group's invite link, if its owner makes one; and who joined through it, and when. Someone with the link sees the group's name, its owner's first name and how many people are in it, nothing more, before joining.
• Payment information (Pro subscribers only): we do not store your full card number, expiry, or CVC. These fields are sent directly to our payment processor (PayMongo or Paddle). We store only the processor's customer and subscription IDs, plus subscription state (plan, period end).
• How you get paid, if you add it: the payment details you choose to share (such as a GCash or bank account name and number, and notes) and any payment QR images you upload. They are shown only to:
  • people in a group you own or have joined;
  • people named on a bill you made;
  • everyone on a bill that names you as the person who paid, including people without an account, through the bill's emails and its invoice page. On a bill someone else made, only if that person could already see your details under the two points above.
  Nobody can add you to a group: you join one only by accepting an invitation sent to your email address, or by opening a group's invite link and choosing Join, once you've confirmed your email address is yours. Joining by link is joining: the group's members see your payment details, and you see theirs. If you own a group and share its invite link, anyone who has the link can join it until you turn the link off or make a new one, so share it only with people you want in the group.
  When someone opens "Pay with GCash" (or another bank or wallet) to pay you, our server reads the QR code in the image you uploaded, to show which bank or wallet it pays into and, where it can, to draw it again with the amount filled in. That happens on our server; what it reads is kept only briefly, in the server's memory, and never stored.
• Images you upload: receipt photos, proof-of-payment screenshots, and profile and group photos.
• Device information (mobile app): a push-notification token and the platform (iOS or Android), stored with your account, so we can notify your phone.
• On your phone: the app keeps the lists you last loaded (bills, balances, groups, and the payment details shown in them) and any bill you added offline but haven't sent yet, so they work without a connection. They stay out of phone backups and are deleted when you sign out or delete your account.
• Session data: a signed session cookie identifying you while logged in, and a session ID and its start time for each browser or phone you're signed in on (up to 10), so you can sign out of the others and we can sign out old sessions.
• App store subscriptions: if you subscribe through the App Store or Google Play, the store's transaction identifier, so we can recognise your subscription. The store handles the payment.
• Crash and error reports: if the app crashes or the website hits an error, a report is sent so we can fix it: what went wrong, the device model and system version, the app version, and a random installation ID. It does not include your name, email or bills, and website reports have links' secret parts removed.
• People without an account: if someone puts you on a bill and you don't use NextBill, we hold the name and email they entered, your share, any payment you report through your invoice link, and whether you opened that link.
• People without an email: a group's members can add someone by name only ("Lola"). We hold that name, the group, who added them and when, and their shares and the payments marked on the bills they're on. We never email or notify them, and they have no payment details. If they later take their place with an account of their own (through a personal link from the group's owner, or from whoever added them when the owner lets members share the group's link), we note which account and when, and those bills become that account's.
• Feature usage: a count of a few actions (receipt scans, reminders, exchange-rate lookups) to enforce plan limits.
• Email verification + password reset tokens: short-lived random tokens used to confirm your email or reset your password.
• Operational metadata: request IP addresses and timing used for rate limiting; standard server logs that may include IP address, user agent, and request path.

3. How we use your information, and on what basis

Each use below names the reason the law allows it: contract (we need it to give you the service you signed up for), legitimate interest (a reasonable need of ours, or of the people you split bills with, that doesn't override your rights), consent (you said yes, and can change your mind at any time) or legal obligation.

• Running NextBill: your account, bills, groups, shares and balances, and the emails and notifications about them, including the summary email of your balances (as often as you choose) and due-date reminders. Contract.
• Signing you in (with your password, or with Apple or Google if you choose), confirming your email and letting you reset your password. Contract.
• Showing your payment details to the people listed in section 2, so they can pay you. Contract: you choose to add them, and can remove them at any time.
• Reading a receipt when you scan one. Contract.
• Holding the name, email and share of someone without an account whom a user puts on a bill, and emailing them their share, reminders and invoice link. Legitimate interest: the people they split the bill with need to tell them what they owe, and to get paid.
• Holding the name and shares of someone a group's member adds without an email, so the group's bills and balances count them. Legitimate interest: the people they split bills with need to keep track of who owes what.
• Keeping NextBill secure: rate limits, signing out old sessions, server logs. Legitimate interest.
• Checking a new password against passwords known from data breaches, with Have I Been Pwned's Pwned Passwords: only the first five characters of a one-way hash of it leave our servers ("k-anonymity"), never the password or its whole hash, and the match is made here. Legitimate interest: keeping accounts safe.
• Reading the QR codes you upload, on our server, when someone pays you with them (section 2). Contract.
• Crash and error reports, and counting a few actions to apply plan limits. Legitimate interest: keeping NextBill working, and its plans fair.
• Push notifications on your phone. Consent: your phone asks you first (Android phones older than version 13 allow them unless you turn them off). Turn them off in your phone's settings at any time.
• Measuring sign-ups from our ads on our public pages. Consent: Google's ad tag loads only if you choose "Allow analytics" when we ask, wherever you are, and you can change your answer (section 5).
• Subscriptions: taking payment and giving you Pro. Contract. The payment records the payment processors keep for tax law: legal obligation.
• Answering your support requests. Contract.
• Meeting the law, and answering lawful requests from authorities. Legal obligation.

4. Who we share information with

We use a small number of trusted subprocessors. We never sell your information to anyone, and we share only what is necessary for each service to do its job.

• Neon (Postgres database hosting): stores your account, bill, group, and subscription state. Data is stored in encrypted form at rest.
• Vercel (application hosting): runs the NextBill application and handles incoming HTTPS traffic.
• PayMongo (payment processing — Philippines customers): processes card payments and recurring charges for Pro subscriptions billed in PHP. Card details are submitted directly to PayMongo and never reach our servers in readable form. PayMongo's privacy policy applies to the information they receive.
• Paddle (payment processing — international customers): processes card, Apple Pay, Google Pay, and PayPal charges for Pro subscriptions billed in USD. Paddle acts as the Merchant of Record: they are the seller from a billing/tax perspective and handle global VAT/sales tax. Your name, email, card details, and billing address are sent directly to Paddle; their privacy policy applies.
• Postmark (email): sends transactional emails (bill shares, reminders, invitations, password resets, email verification), and tells us when one bounces or is reported as spam, so we stop emailing that address. Postmark is run by ActiveCampaign (formerly Wildbit) in the United States, and keeps a copy of each email for 45 days (section 7).
• Microsoft Azure Communication Services (email, fallback): sent these emails before Postmark, and is kept as a fallback: it sends them again only if we switch back to it, for example while Postmark is unavailable.
• Upstash (rate-limit cache): stores short-lived, one-way hashes of IP addresses and email addresses, keyed with a secret of ours so they can't be turned back into addresses, to enforce rate limits on sensitive endpoints.
• Have I Been Pwned (breached passwords): receives the first five characters of a one-way hash of a password being set, and nothing else (section 3).
• Microsoft Azure Blob Storage (files): stores the images you upload in a private container. In the app and on the website they are shown through links that expire within an hour; payment QR codes inside emails use links that last up to 7 days, so the email still works when it is opened later.
• Google Firebase Cloud Messaging (push notifications): delivers notifications to the mobile app using your device's push token.
• Sentry (website error reports): receives reports of errors on our website and servers, without your name, email or cookies, and with links' secret parts removed.
• Google Firebase Crashlytics (app crash reports): receives crash reports from the mobile app: technical details and a random installation ID, not who you are.
• Anthropic (receipt scanning): when you scan a receipt, the image is sent to Anthropic's Claude model to read the items and amounts. Anthropic processes it under its commercial terms and does not use it to train its models.
• Apple and Google (signing in, if you choose it): when you continue with Apple or Google, they confirm who you are and give us an ID for your account with them, your email address and, the first time, your name; their privacy policies apply. On our sign-in, sign-up and group invite pages, their sign-in buttons load from Apple and Google when the page opens, so they can see that you visited it, and Google's button may use Google's cookies.
• Apple and Google (app store subscriptions): process in-app subscription payments made through the App Store or Google Play; their privacy policies apply.
• Google Ads (advertising measurement): if you allow it, our public pages (home, pricing, sign-up and sign-in) load Google's ad tag to measure how many people sign up after seeing our ads. It is not loaded until you allow it, nor once you are signed in, nor in the app. Addresses we report to it have links' secret parts removed.

We may also disclose information when legally required (court order, subpoena, government request) or to protect the rights, property, or safety of NextBill, our users, or the public.

5. Cookies and similar technologies

We use a first-party cookie named nextbill_session to keep you logged in. A second, nextbill_known, remembers that you have signed in on this browser or phone, so that someone guessing your password elsewhere can't slow down your own sign-in here. It holds a random device code and a signature, is sent only when you sign in, lasts a year, and stops working when your password changes. If you tick "Remember this device" when signing in with a two-step verification code, it also records when, so that device isn't asked for a code again for 30 days. Both are HTTP-only, secure (in production), and SameSite=lax. On our public pages we ask whether you allow analytics; only if you choose "Allow analytics" does Google's ad tag load and set cookies to measure sign-ups that came from our ads. Your answer is kept in your browser (local storage, nextbill-analytics), not in a cookie. The tag is not loaded once you are signed in, nor in the mobile app. Where you can continue with Google (the sign-in, sign-up and group invite pages), Google's button comes from Google, whether or not you allow analytics, so that you can choose it, and may use Google's own cookies (section 4). We do not use Google Analytics, Facebook Pixel, or similar trackers.

We do count visits to our home and pricing pages ourselves, without cookies. For each page view we record the page, the site that linked to it, the country, and the type of device and browser. Your IP address is used only to tell repeat views on the same day apart and is never stored. Nothing is counted once you are signed in.

6. Email communications

We send transactional emails (account verification, password resets, bill shares you initiate, payment notifications). We do not send marketing or promotional emails.

The summary email of what you owe and are owed comes while you have an open balance: weekly, on Mondays, unless you choose daily, or turn it off. You can choose how often in the account menu on the website or under Account in the app, and turn it off with the unsubscribe link in the email itself, in one click.

Turning it off doesn't stop the other emails: reminders someone sends about a bill, due-date reminders, emails about payments waiting for your answer, and emails about your account's security. You can stop receiving those by deleting your account or by ceasing to use the service.

7. Data retention

We keep your account, and the bills, groups and payment details in it, for as long as you have the account. Deleting it (in the app, or from the account menu on the website) takes effect at once; if you can't sign in, email us and we'll do it within 14 days. The Account Deletion page says what goes and what passes to the people you split bills with, with your name and email removed. Records of subscription payments are kept by the payment processor (PayMongo, Paddle, Apple or Google) under their own policies and tax rules.

Some data goes sooner, or is kept on its own schedule:

• Accounts never verified: if you sign up but never verify your email, and the account has nothing in it (no bills, no groups, no payment claims, no subscription or purchase), we email you 23 days after sign-up, and delete the account 7 days after that email unless you verify. An account that is verified, or that is on any bill or in any group, is never removed this way.
• Verified accounts you no longer use: kept until you delete them. We don't delete them for being unused, because their bills are also the record of what other people owe and are owed. If that ever changes, we'll email you well before.
• Receipt photos: deleted once everyone on the bill has paid and the bill has been left unchanged for 7 days.
• Proof-of-payment screenshots: deleted 30 days after the payment they back was approved or rejected. One sent through an invoice link: 30 days after the bill was last changed, once everyone on it has paid.
• People without an email: deleted with their group. Whoever added them, or the group's owner, can remove them sooner while no bill names them. Their name stays on the bills they were on, like everyone's, as the record of what was paid, until the group's owner erases it: then it reads "Removed person" everywhere, the amounts kept. The group's owner, and whoever added them, get them in Download my data.
• Payment log and payment claims: who marked what paid, and when, is kept with the bill as the record of who paid whom, for as long as the bill is kept (deleted bills included, below). A payment claim is kept as the record of both people in it. When one of them deletes their account, their side of it reads "Deleted user", a claim still waiting is withdrawn, and its proof images are deleted; the other person keeps the amounts and dates.
• Deleted bills: a deleted bill disappears for everyone, and its receipt, and any proof images sent through its invoice links, are deleted at once. We keep the bill itself and its payment log as the record of payments made on it, with no set end date. When someone on it deletes their account, their name and email are removed from it.
• Emails we queue (the summary email, due-date reminders, and notices of payments waiting for your approval): a queued email holds no one's payment details, which are looked up when it is sent. What it says is cleared once it is sent, and the record of it (address, kind, time) is deleted 30 days later. One that couldn't be sent is deleted 30 days after it was queued. A summary email or reminder not sent within 20 hours is dropped, and a reminder for a share that has since been paid isn't sent.
• Emails that failed to send: the record (address, subject, error) is deleted after 30 days.
• Copies of the emails we send: Postmark, our email provider, keeps each email and what happened to it (delivered or bounced) for 45 days, so a delivery problem can be looked into, then deletes it.
• Addresses that bounce or report our email as spam: kept on a do-not-email list for as long as we send email, so an address that can't or doesn't want to receive our email isn't emailed again. We can lift the block on request.
• Invitations: an invitation nobody accepts is deleted 90 days after it was last sent.
• Email verification and password reset links:deleted 7 days after they are used or expire.
• Two-step verification: the secret and recovery codes are deleted when you turn it off; the record of turning it on and off is kept until you delete your account.
• Sign-in sessions: each is deleted when you sign out there, when you use "Sign out of other devices" elsewhere or change your password, when you reset your password (all of them), and once you are signed in on more than 10 (the oldest first).
• Your linked Apple or Google account: kept until you delete your account. Deleting it also ends your Sign in with Apple with Apple.
• Push tokens: deleted when you sign out on that phone, when Google's or Apple's push service tells us the token no longer works, or when you delete your account.
• Crash and error reports: Sentry keeps website error reports for up to 90 days, and deletes its backups of them 90 days after making them. Firebase Crashlytics keeps app crash reports for 90 days, then deletes them.
• Server logs: kept by our hosting provider for up to 30 days. They include sign-in attempts, password resets and payment processors' notices, which may show your user id or email. We keep no other copy of them.
• Backups: our database provider keeps a short history so we can restore the database after a mistake or an outage. Deleted data is gone from it within 35 days. A deleted photo or file can be recovered for up to 7 days, then is gone for good.

8. Your rights under the Data Privacy Act

You have the right to:

• be informed of how we process your personal data;
• access a copy of the data we hold about you: download it yourself at any time from your account (Download my data, on the website or in the app). It includes your payment details and QR codes' account names and numbers, deleted bills that name you, promo codes you redeemed and receipt scans you used, and links to your photos and files (profile photo, payment QR codes, receipts, payment proofs, and proofs you sent through an invoice link) that work for 24 hours;
• request correction of inaccurate data;
• delete your data, subject to legal retention requirements: all of it by deleting your account, or some of it while you keep the account (bills you made, your payment details and QR codes, your profile photo, groups you own once they're settled up);
• object to processing or withdraw consent (where applicable);
• file a complaint with the National Privacy Commission (privacy.gov.ph).

If you're in the European Union, the EEA or the United Kingdom, the GDPR gives you the same rights, plus the right to take your data to another service (the download above is in a common format, JSON) and to complain to your local data protection authority.

People added to a group by name only, without an email, have the same rights, though they can't sign in to use them. They can ask the group's owner, who can erase their name (it then reads "Removed person" on every bill, with the amounts kept), or email us, and we'll do it with the owner.

To exercise any of these rights, email our privacy contact at support@nextbill-nti.com. We will respond within 30 days.

9. Security

We protect your data with industry-standard measures: HTTPS for all traffic, bcrypt-hashed passwords, signed session cookies that are revoked on sign-out and on password reset, rate limiting on authentication endpoints, and encrypted database storage at rest. No system is perfectly secure; if we ever experience a data breach affecting your personal information, we will notify you and the National Privacy Commission as required by law.

10. Children's privacy

NextBill is for people aged 18 or over, or the age of majority where they live, as our Terms of Service say. We do not knowingly collect personal data from anyone younger. If you believe someone under that age has given us their information, please contact us so we can delete it.

11. International data transfers

Our subprocessors operate globally and may process data in regions outside the Philippines (typically the United States, the EU, and Singapore). We rely on contractual safeguards offered by each subprocessor to ensure your data continues to be protected at a comparable standard.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top, and for material changes we will email account holders.

13. Contact us

Questions, requests, or concerns: support@nextbill-nti.com. About your personal data, write to our privacy contact at the same address, with "Privacy" in the subject.