This policy explains how [Operating Entity Name] (“Ledgerline”, “we”) handles personal information when you use our website and Service. We follow the principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Québec's Law 25.
1. What we collect
- Account information: name, email, password hash, MFA settings, and the businesses and roles you belong to.
- Customer Data: the financial records and documents you or your team upload or create — for example bank statements, invoices, receipts, payroll records and customer and vendor details.
- Usage and security data: sign-in times, IP address, device and browser information, and the audit log of changes you make.
- Messages: what you send us when you contact support.
2. How we use it
- To provide the Service: keep your books, read and verify documents, produce reports and statements, and send the emails you ask us to send.
- To keep accounts secure, prevent fraud and abuse, and maintain the audit log.
- To provide support and tell you about important changes.
3. AI processing and data-processing statement
To read documents and suggest categories, we send the relevant document content — such as the text or image of a statement page or receipt — to our AI inference provider, Groq, Inc., which acts as our subprocessor. This happens over an encrypted connection and only for the purpose of returning the extraction or classification to us.
- Customer Data is not used to train AI models — ours or the provider's.
- We send only the content needed for the task, not your whole account.
- Results are treated as suggestions: amounts are confirmed by arithmetic, and low-confidence suggestions require a person's approval.
- Groq may process data outside Canada, including in the United States. [Confirm current retention terms in the Groq data-processing agreement and list them here.]
5. Where data is stored
You can choose to keep documents and data in a Canadian region. Some subprocessors, including our AI provider, may process data outside Canada; when they do, they are bound by contract to protect it to a comparable standard.
6. How we protect it
Encryption in transit and at rest, field-level encryption for account numbers and MFA secrets, tenant isolation, role-based access, multi-factor authentication and a complete audit log. See Security for details.
7. Retention and deletion
We keep Customer Data while your account is active and as long as you need it for your records. When you delete data or close your account, we remove it from active systems promptly and from backups on a published schedule, except where the law requires us to keep it longer.
8. Your rights
You can ask to access, correct, export or delete your personal information, or withdraw consent, by writing to our contact page. If you are not satisfied with our answer, you may contact the Office of the Privacy Commissioner of Canada or your provincial regulator.
10. Changes and contact
We'll post any changes here and notify you of material ones. Our privacy officer can be reached at our contact page, [mailing address].