Privacy policy

Maxwell Books is a bookkeeping service for small businesses, run by Parker Hudson, a sole proprietor, in Alberta, Canada ("we"). We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).

Our privacy officer is Parker Hudson, who is responsible for how we handle your information. Press Feedback at the bottom of any page while you're signed in. [Our privacy email goes here once our domain is set up.]

• Your account: your email address, your password (stored only in scrambled form by our sign-in provider), and, if you turn on two-step sign-in, the link to your authenticator app and scrambled backup codes.
• Your business: its name, whether it's a sole proprietorship or a corporation, its GST number and filing frequency, and its fiscal year-end.
• Your books: the bank and credit card statements you upload (the files and every transaction in them), your receipt photos and files, the categories you choose, your rules, and your ledger, reports and GST summaries.
• Accountants: your name, firm, designation, and whether we've confirmed you're a CPA in CPA Alberta's public directory.
• Notes you send us with Feedback.
• Referrals: if you sign up with someone's referral link, a record that they referred you. They see only how many people have signed up with their link, never who.
• Activity: a history of important actions in your books (for example confirming a transaction or an accountant viewing your books), when you signed in, and how much document reading your business has used today.
• Security: your internet address (IP address) when you sign in, which our sign-in provider records. We also keep a scrambled fingerprint of your internet address and email for one day to limit repeated sign-in attempts.

We don't collect anything we don't need to do your bookkeeping. We don't use analytics, advertising or tracking tools, and we don't sell or rent your information.

• To do your bookkeeping: read your statements and receipts, suggest categories and GST, keep your ledger and make your reports.
• To keep your account secure and to stop abuse.
• To know who referred whom, so referral rewards can be paid fairly once we offer them, and to check that nobody refers themselves.
• To share your books with an accountant, only if you invite them, until you remove them.
• To answer you when you contact us, and to send the emails you need for your account (like confirming your email or resetting your password).
• To send optional emails, like a monthly reminder to upload statements, only as set in your Profile. You can turn them off at any time.

We use Claude, an AI model made by Anthropic, to read your PDF statements and receipt photos, and to suggest a category for each transaction. To do that, we send Anthropic the whole file, or the transaction's description, date and amount.

Anthropic processes this in the United States. Under its commercial terms, Anthropic doesn't use what we send to train its models, and keeps it only for a limited time. [Bananastand: confirm Anthropic's current retention period and terms.]

AI suggestions can be wrong. Nothing an AI suggests is recorded in your books until you confirm it.

CSV statements, your own rules and transfers between your accounts are handled without AI.

These companies process your information on our behalf, only to provide the service, under contracts that require them to protect it:

• Supabase: our database, file storage and sign-in. Your books and files are stored in Canada (Canada Central). Its network is protected by Cloudflare, so your requests pass through Cloudflare's network.
• Vercel: runs the website. Our server code runs in Montréal; pages travel through Vercel's worldwide network to reach you.
• Anthropic: reads documents and suggests categories, as described above, in the United States.
• Supabase's email service sends sign-in emails for now. [Update when we switch to our own email service, such as Resend.]
• Cloudflare Turnstile: once we turn it on, it checks that people signing in or signing up aren't bots. It runs in your browser and may collect information about your browser and device to do that.
• Stripe: once billing starts, handles payments. We never see or store your full card number.

Some of these companies are outside Canada, or may process information outside Canada, so your information may be subject to the laws of those countries, including access by courts and government agencies there.

We may also share information if the law requires it, or to protect people's safety. If the business is ever sold, your information would go with it under this policy, and we'd tell you first.

We keep your books while your account is open. You can close your account from Profile at any time. We offer you a full download first, then delete everything 30 days after you ask (you can change your mind until then): your books, statements, receipts and account.

Backup copies kept by our database provider are deleted on their own schedule, within 7 days.

The Canada Revenue Agency generally requires businesses to keep their records for six years. That's your responsibility, so please keep your download.

Sign-in attempt fingerprints are deleted after a day.

• See and download your information: download your books any time from Reports, and your original files from Upload and Receipts. Ask us for anything else we hold about you.
• Correct it: change your details in Profile and Business settings, or ask us.
• Delete it: close your account from Profile.
• Withdraw consent: turn off optional emails in Profile, remove your accountant's access in Business settings, or close your account. Some things (like using AI to read PDFs) are part of how the service works, so if you don't want them, you can upload CSV statements instead.
• Complain: tell us first, and we'll try to fix it. You can also contact the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.

Press Feedback at the bottom of any page while you're signed in. [Our privacy email goes here once our domain is set up.] We'll answer within 30 days.

Each business can see only its own books, and the database itself enforces that. Data is encrypted on its way to us and where it's stored. Two-step sign-in is available to everyone and required for accountants. You're signed out after 30 minutes without activity. Links to your files last a minute.

If a breach ever put your information at real risk of significant harm, we'd tell you and the privacy commissioners as the law requires.

Maxwell Books is for adults running a business. You must be 18 or older to create an account, and we don't knowingly collect information from anyone younger.

If we change this policy in a way that matters, we'll tell you by email or in the app before the change takes effect, and ask you to agree again where the law requires it.