Privacy policy

What we collect

Bill photos. The photos you upload of your NTTA bills. They can show your name, address, license plate and account numbers.

Numbers from your bill. What we read from your photos and what you confirm: the notice type, account and invoice numbers, invoice dates, toll and fee amounts, the total, and the last few characters of your plate. We don't keep your name, your address or your full plate.

Your name and mailing address for the letters. You type these on your kit page. They stay in your browser on your device. They're never sent to us.

Email address. You give this at checkout, on Stripe's payment page. We use it to send your kit link and the emails described below.

Payment information. Stripe, our payment processor, collects and processes it, along with the billing country and postal code needed to work out sales tax. We never see or store your full card number.

Updated NTTA statements. If you tell us how it went or ask for a refund, you upload a statement and tell us what you owe now and what happened. For a refund request you can also give us the date of your call to NTTA or its reference number. We read a refund statement the same way we read your bill and compare it with your original bill (same account or invoice numbers, same plate, its date and its balance), so a person can review your request. We keep the result of that comparison and the statement's date and balance, not the account numbers or plate read from it.

Visit and ad information. Pages you visit on our site, the ad or link that brought you here (such as UTM tags and a Meta click ID), your browser type and your IP address. See “Advertising and measurement” below.

How we use it

• To read your bill and show your summary and estimate.
• To build and deliver your kit.
• To check our accuracy. A person at TollAid may read your kit and compare what we read from your bill with the numbers you confirmed.
• To send you your kit link, a reminder on day 3 if you haven't started, check-ins on day 14 and day 45, and your refund decision.
• To process refund requests.
• To answer support emails.
• To understand which ads bring people to TollAid, and to fix bugs and improve the service.

We don't sell your personal information. We don't use your bill photos for advertising.

How we handle bill photos and statements

• They're stored privately. They aren't public and aren't shared with other users.
• Bill photos are deleted automatically 30 days after upload.
• Uploaded NTTA statements are deleted automatically 30 days after upload.
• After that we keep only the numbers: what your bill showed, the before and after totals, and the result of any refund comparison.

Advertising and measurement

We use two services to understand which ads work:

• Meta (Facebook and Instagram). The Meta Pixel runs on our public pages (the home page, the upload page, the recovery page). Our server also tells Meta when someone confirms their bill numbers, views their result, starts checkout and buys a kit. With those server messages we send your IP address and browser type, Meta's browser identifiers, and, for purchases only, your email address in a scrambled (hashed) form. Meta's privacy policy: facebook.com/privacy/policy.
• Datalyr. An attribution service that receives the same events, identified by a random visitor ID and your kit's ID. We never send Datalyr your email address. Datalyr's privacy policy: datalyr.com/privacy.

Neither service runs on your bill result page or your kit page, and we never send them the private links to those pages. We keep your IP address, browser type and these identifiers for 30 days, then delete them.

Who we share it with

We share data only with service providers that help us run TollAid:

• Stripe, which processes payments, works out sales tax and handles refunds (privacy policy).
• Anthropic, which provides the AI that reads your bill photos and refund statements and writes your kit (privacy policy).
• Supabase, for our database and private file storage.
• Vercel, which hosts the site.
• Resend, which sends our emails.
• Meta and Datalyr, as described above.

We may also share data if the law requires it, or to protect our rights or users' safety.

We never send your information to NTTA. Anything that goes to NTTA, you send yourself.

How long we keep it

• Bill photos and uploaded statements: 30 days, then deleted automatically.
• IP address, browser type and ad identifiers: 30 days, then deleted.
• Numbers from your bill and your email address: 24 months after your purchase or scan, so you can use your kit and we can handle refunds. Then they're deleted or made anonymous.
• Your name and address for letters: never stored by us. They stay on your device until you clear them.
• Stripe, Meta and Datalyr keep their own records under their own policies.

Your choices

You can ask us to see or delete your data. Email help@gettollaid.com from the address you bought with. We'll answer within 30 days. Deleting your data turns off your kit link.

You can limit Meta ad measurement in your Facebook and Instagram ad settings, and block tracking with your browser settings. Datalyr respects your browser's Do Not Track and Global Privacy Control signals.

Security

We use reasonable safeguards like encryption in transit, private storage, unguessable private links and limited access. No system is perfect, so we can't promise data will never be exposed.

Kids

TollAid isn't for anyone under 18. We don't knowingly collect data from kids.

Changes

We'll post updates here and change the effective date.

Contact

help@gettollaid.com