1. Plain-English summary
The short version. We collect your bookkeeping data (transactions, classifications, business name, contact info) so we can run the product. We store it in Canada. We don't sell it. We share it only with the narrow list of sub-processors required to run a SaaS business (hosting, email, billing). You can export everything or delete everything by emailing privacy@loonieledgr.ca.
2. Who we are
LoonieLedgr Inc. is a corporation incorporated in British Columbia, Canada (corporation number BC1456789). Our registered office is in Vancouver, BC. We are the data controller for the personal information described in this policy.
For privacy questions: privacy@loonieledgr.ca. Our Privacy Officer is Shabda Ghimire, CPA.
3. What we collect
3.1 Information you provide directly
- Account info: name, email, password (hashed), phone number (optional, for 2FA only)
- Business info: legal business name, GST/HST number, address, SIN (encrypted, only used for tax form pre-fill)
- Payment info: handled by Stripe; we never see your card details
3.2 Information you authorize us to fetch on your behalf
- Bank transactions (via Flinks read-only API)
- Platform payouts and supporter data (via YouTube, Patreon, Stripe, Twitch APIs — only the scopes you explicitly grant)
- Receipt images you upload through the mobile app
3.3 Information we collect automatically
- Log data (IP address, browser, OS, pages visited within the app)
- Performance metrics (page load times, error reports — never including the content of your books)
- Device identifiers if you use our mobile app
4. How we use it
- Run the product. Classify your transactions, prepare your tax forms, send you alerts.
- Improve the product. Aggregated, anonymized analytics on which features get used. We never train any ML model on identifiable customer data without explicit opt-in consent.
- Communicate with you. Transactional emails (receipts, security alerts, deadline reminders). You can opt out of optional marketing emails at any time; you cannot opt out of essential service emails while you have an active account.
- Comply with law. CRA s.230 record retention. PIPEDA breach reporting. Quebec Law 25 requirements.
5. Sharing and sub-processors
We do not sell your data. We do not share your data with advertisers. We share data with the following sub-processors, each of which has signed a Data Processing Agreement obligating them to confidentiality and Canadian data residency where applicable:
- Amazon Web Services (ca-central-1) — infrastructure hosting
- Flinks (Montreal, QC) — bank connection brokerage
- Stripe — subscription billing
- Postmark — transactional email delivery
- Plausible Analytics (Germany; cookie-free, anonymized) — basic usage analytics
We will share your data without your consent only when required by law (e.g., a valid CRA records request under s.231, a court order, or to prevent imminent harm). We will notify you of any such disclosure unless we are legally prohibited from doing so.
5.1 Sharing with your accountant
If you grant your CPA access to your books through the accountant portal, you authorize us to share all your bookkeeping data with them for the purpose of tax preparation. You can revoke this access at any time from your settings. The CPA is bound by their professional code of conduct (CPA Code of Professional Conduct) regardless of any agreement with us.
6. Retention
We retain your data for as long as your account is active, plus a 6-year period after cancellation to comply with CRA record-keeping requirements under s. 230 of the Income Tax Act. After 6 years, we permanently delete your data unless you have explicitly requested longer archival.
You may request immediate deletion before the 6-year retention period ends; we will comply within 30 days, subject to legal obligations that may require retention (e.g., an open CRA audit).
7. Your rights
Under PIPEDA (federal) and Law 25 (Quebec, if applicable to you), you have the right to:
- Access your data — download a complete export at any time from your settings.
- Correct inaccurate data — edit directly in the product, or email us if a system field is incorrect.
- Delete your data — see retention above.
- Withdraw consent — disconnect any integration or close your account.
- Object to specific processing — email privacy@loonieledgr.ca.
- Lodge a complaint with the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d'accès à l'information du Québec.
8. Cookies and analytics
We use a small number of strictly-necessary cookies: session identifier, 2FA state, theme preference. No advertising cookies. No third-party tracking pixels.
For analytics we use Plausible, a privacy-focused service that does not use cookies and does not collect personal data. Aggregate usage data only.
9. Children
LoonieLedgr is not directed to children under 16. We do not knowingly collect data from anyone under 16. If you believe a minor has signed up, contact us and we'll delete the account.
10. International data transfers
Your data is stored and processed in Canada. The narrow exception is Stripe (subscription billing) and Postmark (email), which may process limited data (your email address; the fact of a charge) in the United States and other jurisdictions. We've reviewed both providers and they offer Canadian-data-residency assurances under PIPEDA-comparable frameworks. If you require strict Canadian-only processing, contact us; we can route you through alternatives at the Incorporated plan level.
11. Changes to this policy
If we materially change this policy, we'll email you 30 days in advance. Minor edits (typos, clarifications) we'll just publish. The "last updated" date below always reflects the most recent change.
Questions, complaints, or data requests:
- Email: privacy@loonieledgr.ca
- Mail: Privacy Officer, LoonieLedgr Inc., 1055 W. Georgia Street, Suite 2400, Vancouver, BC V6E 3P3
Last updated May 24, 2026. This is a template. Get a Canadian privacy lawyer to review before launching publicly.