Politique de confidentialité

Version 2026.12 — effective October 29, 2026. This Privacy Policy explains how Books Auto Solutions Ltd. ("BooksAuto", "we") collects, uses, discloses and protects personal information, in line with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL) and applicable provincial laws, including British Columbia's and Alberta's Personal Information Protection Acts and Québec's Act respecting the protection of personal information in the private sector.

1. Who is responsible

Books Auto Solutions Ltd., 201-45863 Yale Road, Chilliwack, BC V2P 2N6. Our Privacy Officer is responsible for our compliance with this Policy and can be reached at support@booksauto.online (subject: "Privacy Officer") or by mail at the address above. This title and these contact details are also the ones required to be published under Québec law.

2. Two kinds of information, two roles

Account information — about our customers and their users: names, business names and addresses, emails, phone numbers, billing records, sign-in and security records, records of acceptance of our agreements, and support communications. We are responsible for this information.

Customer Data — what our customers put into BooksAuto about their companies, their clients, employees and signers, including SINs, dates of birth, addresses, pay, bank and tax information, time-clock photos and documents. The customer (the employer or accounting firm) is the organization in control of Customer Data and is responsible for having the right to collect it, for giving the individuals concerned the notices and obtaining the consents the law requires, and for answering their requests. We process Customer Data only as the customer's service provider, under our Data Processing Addendum. If you are an employee, client or signer of one of our customers, please contact that business first; we will help them respond.

3. What we collect

Account details you give us when you sign up or update your profile (including the name of the person who accepts our agreements and the business address); Customer Data entered or imported by our customers; billing records (card payments are processed by Stripe — we never see or store full card numbers); records of acceptance of our agreements (name, email, business details, the words agreed to, document versions, date and time, IP address and browser); signing records for e-signatures (name, email, signature drawn, date and time, IP address and browser); support emails, problem reports and the files attached to them; and technical records needed for security (sign-ins, IP addresses, devices and computers linked to an account, error logs).

4. Consent

We collect, use and disclose personal information with the knowledge and consent of the individual, except where the law permits otherwise. By creating an account, using the Service or giving us your information, you consent to the purposes in this Policy. Consent to the purposes that are necessary to provide the Service (such as processing payroll data and billing) is a condition of the Service. You may withdraw consent at any time, subject to legal and contractual limits, by writing to our Privacy Officer; withdrawing may mean we can no longer provide the Service. We ask for express consent for anything not described here.

5. Why we use it

Only to provide, secure, maintain, support and bill for the Service; to keep records of agreements, payments and support; to send service messages (receipts, reminders, security codes, notices of changes); to prevent fraud and misuse; to improve the Service using aggregated information that does not identify anyone; and to meet legal obligations. We do not sell personal information, use Customer Data for advertising, or use it to train AI models.

6. Automated processing and AI

BooksAuto uses automated processing, including the Claude AI service from Anthropic, to read statements and bills and to suggest how transactions are categorized. These are suggestions reviewed by our customers; BooksAuto does not make decisions about individuals based exclusively on automated processing. Payroll amounts are calculated with the formulas published by the government authorities. You may ask our Privacy Officer about the information and factors used.

7. Who we share it with

Only service providers we need to run the Service, under contracts or terms that require them to protect it and use it only for that purpose: our hosting provider (servers, databases and backups); Stripe (payments); email delivery providers; and Anthropic (the Claude AI service), which may receive scanned or photographed statements and bills and the descriptions and amounts of transactions BooksAuto can't recognize, only to read or categorize them. An up-to-date list of these service providers is available from our Privacy Officer. Customers who use online invoice payments use their own Stripe accounts. We also disclose information where the law requires it (for example, a valid court order or a request from a regulator with lawful authority), to protect our rights in a dispute (for example, records of acceptance and payment given to a card issuer), and to a successor if our business is sold, under the same protections.

8. Where it is kept

Information may be stored or processed outside your province and outside Canada, including in the United States and other countries where our service providers operate, and may then be accessible to courts and authorities there under their laws. Before information about people in Québec is communicated outside Québec, we assess whether it will receive adequate protection, as Québec law requires. Windows company files stay on the customer's own computers unless the customer moves or syncs them online.

9. How we protect it

Encrypted connections; encryption of stored data; separate encryption of SINs and bank account numbers (only the last digits are shown on screen); hashed passwords, recovery codes and signing tokens; email sign-in codes; role-based access so staff see only the companies assigned to them; access and change logs; and regular backups. Our own staff access Customer Data only when needed to provide support or keep the Service secure. No method of transmission or storage is completely secure, and each customer is responsible for the security of its own devices, passwords and exported files.

10. If there is a breach

If a breach of security safeguards involving personal information in our systems creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and other regulators (including the Commission d'accès à l'information du Québec) where the law requires it, notify affected customers without unreasonable delay, and keep a record of every breach for at least 24 months. Where the customer is in control of the information, we will give the customer the details it needs to notify affected individuals.

11. How long we keep it

Account information and Customer Data are kept while the account is active. After an account closes, online Customer Data can be exported on request for 90 days and is then deleted from our active systems; copies in backups are overwritten in the normal backup cycle. Trial companies that are never paid for may be deleted 12 months after the trial ends. Records of acceptance of our agreements are kept for as long as the account exists and for at least seven years after it closes, as evidence of the agreement. Billing, consent and tax records are kept for as long as the law requires (generally six years). Customers are responsible for keeping their own records for the periods the law requires of them.

12. Your rights

You may ask to access or correct your personal information, to receive a copy of computerized information you gave us in a structured, commonly used technological format, to withdraw consent, or to ask how it is handled. We may need to confirm your identity first. Requests about Customer Data are passed to the customer in control of it. We respond within 30 days and tell you if we need more time, as the law allows. Access is free, except where the law allows a reasonable fee, which we will tell you about first.

13. Cookies and similar technologies

The Service uses only the cookies and browser storage needed to sign you in, keep your session secure, protect forms against forgery and remember settings such as "remember my email". We do not use advertising or cross-site tracking cookies. Blocking these cookies will stop the Service from working.

14. Emails we send

We send service messages that are needed for your account (codes, receipts, reminders, notices of changes, security alerts); you cannot opt out of these while you have an account. We may also send messages about BooksAuto — for example during a free trial — under the consent you gave or the business relationship we have with you, as CASL allows. Every such message identifies us, gives our mailing address and has a one-click unsubscribe link, which we honour within 10 business days.

15. Time clock and staff app

If an employer turns on punch photos, the time clock takes a photo of the employee at each punch, to confirm who punched. Photos are Customer Data under the employer's control; the employer is responsible for telling its employees and for the consent required, decides whether to use the feature and how long to keep photos. BooksAuto does not use photos for facial recognition or for any purpose other than showing them to the employer.

16. E-signature and government news

Signing records are kept with the sending firm's account as evidence of the signature. Signing links are private, are stored only as a one-way fingerprint, and stop working when replaced by a reminder. The Latest news section shows public releases from Government of Canada feeds; reading them sends nothing about you or your clients, and each user can turn the section off.

17. Children

The Service is for businesses and is not directed to children. Employers who pay employees who are minors are responsible for the consents the law requires for them.

18. Changes

We may update this Policy; the effective date at the top shows the latest version, and material changes are announced as described in the Terms of Service.

19. Contact and complaints

Privacy Officer, Books Auto Solutions Ltd., 201-45863 Yale Road, Chilliwack, BC V2P 2N6 · support@booksauto.online. If you are not satisfied with our answer, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca), or the privacy commissioner of your province (in Québec, the Commission d'accès à l'information).