Privacy Policy

1. Overview and Who We Are

Claimable ("the Service", "we", "us", "our") is a cloud-based application that helps Canadian individuals, self-employed people, small businesses, landlords, and the accountants who serve them track tax-deductible expenses and organize records by Canada Revenue Agency (CRA) form line items.

Claimable is operated as a sole proprietorship by Vlad Bors, carrying on business as "Claimable", based in British Columbia, Canada. References in this policy to "we", "us", and "our" mean that operator.

This Privacy Policy explains what information we collect, how and why we use it, who we share it with, how long we keep it, how we protect it, and the rights you have over it. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia's Personal Information Protection Act (PIPA), and, for residents of Quebec, the Act respecting the protection of personal information in the private sector (Quebec Law 25). By creating an account or using the Service, you consent to the practices described here.

2. Accountability and Privacy Officer

We are accountable for the personal information under our control. The person responsible for personal-information protection at Claimable is the owner and operator, acting as our Privacy Officer. You can reach the Privacy Officer with any question, access request, correction, withdrawal of consent, or complaint at [email protected].

We require any service provider that processes personal information on our behalf to protect it under terms comparable to this policy.

3. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Display name
• Province or territory (used at signup to set tax rates)
• Password, stored only as a one-way bcrypt hash. We never store or have access to your plain-text password
• For accountant accounts: your firm or practice name, and optionally a website and business description
• Email-verification and account-status timestamps, and a subscription/billing status from our payment processor (see Section 7)

Financial and Business Records

When you use the Service, you may provide:

• Income source details, including business names, websites, fiscal year end, and your own GST/HST registration number
• Expense records: dates, vendors, vendor GST/HST numbers, descriptions, amounts, currency and exchange rates, payment method, reference numbers, tax breakdowns (GST/HST, PST, input tax credits), deduction percentages, and free-text notes
• Invoices you create or upload, which may include your client's name and email address, invoice numbers, amounts, and the province of supply
• Vehicle records, including make, model, year, and license plate, plus per-trip logs with odometer readings, distance, destination, business purpose, and the client or reason for the trip
• Home office measurements and detailed-method amounts (rent, mortgage interest, property tax, utilities, insurance, maintenance, and internet)
• Capital cost allowance (CCA) asset records and opening balances
• GST/HST filing figures and tax-year status (including whether a year is filed)

We do not collect or store your Social Insurance Number, bank account or routing numbers, full payment card numbers, CVV, date of birth, or street address.

Receipt and Document Files

• Images and PDFs of receipts and invoices you upload
• Text extracted from those files by optical character recognition (OCR) and stored with the record
• Categorization suggestions, alternatives, questions, and warnings generated by our AI scanner and stored alongside the expense (see Section 5)
• SHA-256 integrity hashes computed for verification purposes

Activity and Audit Records

To maintain an accurate record of changes (which matters for tax record-keeping), we log changes to your financial records in an audit trail. Each entry records the action, the record affected, the before and after values, a timestamp, and the IP address and browser user-agent of the request. For account-profile edits we record only which fields changed, not their values.

Technical Data

When you connect to the Service, our servers process limited technical data needed to operate and secure it, such as your IP address (including approximate region), browser and device type, and timestamps of account activity. The mobile app and the marketing website do not embed third-party analytics, advertising, or tracking SDKs; the only device permissions the app requests are the camera and photo library (to capture receipts) and secure on-device storage (to hold your login token).

Payment Information

If you subscribe to a paid plan, payments are handled by our third-party payment processor, Stripe. We do not store or have access to your full card number, CVV, or bank details. We receive and store only a customer and subscription identifier, your plan, billing status, and current period end (see Section 7).

4. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service, including expense tracking, receipt scanning, tax calculations, GST/HST and CCA figures, and report generation
• Authenticate your identity and secure your account
• Calculate GST/HST, exchange rates, CCA depreciation, and other tax-related values you ask us to compute
• Generate export packages (PDF, CSV, audit reports) at your request
• Enable shared access to a book by an accountant or co-owner you authorize
• Process subscription payments and manage your account and practice billing
• Send transactional emails (verification codes, password resets, billing notices, book invitations, and accountant/client question notifications)
• Maintain an audit trail of changes to your records
• Monitor, debug, and improve the performance, reliability, and security of the Service
• Measure the effectiveness of our advertising (see Section 6)
• Comply with our legal obligations and enforce our Terms

We collect and use only the information reasonably needed for these purposes. If we ever want to use your information for a materially different purpose, we will ask for your consent first.

5. Automated Processing and AI Scanning

Claimable's receipt and document scanner uses optical character recognition and an artificial-intelligence model to read your uploaded receipts, invoices, and documents and to suggest structured values: the vendor, date, amounts, tax breakdown, currency, and a likely CRA expense category.

The principal factors the scanner relies on are the text and image content of the file you upload, the business context you provide (such as your industry or business description), and the CRA category and tax rules built into the Service. The model is run at a fixed, low-variability setting to make results as consistent as possible.

These outputs are suggestions only. No categorization, amount, or tax treatment is applied to your records automatically. You review and confirm (or change) every value before it is saved, so a human (you) is always in the loop. Scanning is entirely optional: you can enter all data manually. The first time you use scanning, you are asked to acknowledge that your file will be sent to our AI provider for processing (see Section 6).

If you would like more information about how the automated processing reached a particular suggestion, or you want a person to review how the feature handled your data, contact our Privacy Officer at [email protected].

6. How We Share Your Information

We do not sell your personal or financial information, and we do not share it for third-party advertising or cross-context behavioural targeting. We share information only in the limited circumstances described below.

Accountants and Shared Books

Claimable lets a set of financial records (a "book") be shared with another person you authorize, such as an accountant or a co-owner. This sharing only happens at your direction:

• When you (as the owner of a book) invite an accountant or co-owner, or when you accept an invitation to a book, that person gains access to that book.
• An accountant linked to your book can view and edit all of the financial records in that book, including expenses, receipts and their files, invoices, GST/HST figures, vehicles, home office, and tax years, and can export those records (including a CSV, PDF, and an audit package containing your decrypted receipt files and the change history) to their own device.
• An accountant can also see a practice dashboard summarizing your book (such as income, deductibles to date, GST status, and items needing review) and can ask questions about specific expenses, which you answer in the app.
• You remain the owner of your book. You can see who has access and revoke an accountant's access at any time, and your data stays with you when you do. An accountant cannot delete your book or remove you as its owner.
• An accountant may also create a book on your behalf before you have an account (a "ghost book") and invite you to claim it. When you claim it, ownership transfers to you and the accountant keeps only the view-and-edit access described above.

Once an accountant exports a copy of your records to their own device, that copy is outside Claimable's systems and control. The accountant is then independently responsible for it under their own professional and legal obligations to you. If you are an accountant using Claimable, you are responsible for having your client's authorization to access and store their information, and for handling any records you export (see our Terms).

Receipt and Document Scanning (OpenAI)

When you use scanning, the content needed to read your document is sent to OpenAI (OpenAI, L.L.C., San Francisco, CA, USA) through its API. Depending on the file, this includes the receipt or invoice image itself or the text extracted from a PDF, CSV, or photo, plus the business context you provide to improve accuracy. The parsed result may also be sent back for a compliance validation pass. If you add a business website to your profile, we may fetch your homepage and send a portion of its text to OpenAI to draft a business description.

OpenAI processes this data solely to return structured information to us. Under OpenAI's API data-usage policy, data submitted through the API is not used to train its models, and OpenAI states that it may retain API inputs for a limited period for abuse monitoring before deletion. This processing takes place in the United States (see Section 9).

Payments (Stripe)

Subscription payments are processed by Stripe. When you start a subscription, we provide Stripe with your email, name, and an account identifier. Stripe handles the card or bank details directly through its own hosted checkout; we never receive them.

Transactional Email (Resend)

We send account and notification emails through Resend, an email delivery provider. These include verification and password-reset codes, billing notices, book invitations (sent to the email address you specify), and notifications when an accountant or client asks or answers a question. The recipient address and message content pass through Resend to deliver the email.

Advertising Conversion Measurement (Meta)

We run ads to reach self-employed Canadians and measure whether they work, with no browser pixel and no advertising cookie. When you complete a signup or start a paid subscription, our server reports that event to Meta Platforms through its Conversions API. What we send:

• A one-way SHA-256 hash of your email address (not the address itself)
• A one-way hash of your account identifier
• Your IP address and browser user-agent, and the event name (such as signup or subscription) with its dollar value

We never send your receipts, expenses, income, or any other financial records. The purpose is limited to attributing and optimizing ad spend. Meta acts as an independent controller for this data and may match the hashed identifiers to an existing Meta account; their handling is governed by their own policies. Because the report comes from our server and sets nothing in your browser, it does not track you across other websites.

Error Monitoring

We may use an error-monitoring service (Sentry) to detect and diagnose technical problems. When enabled, it is configured not to capture request bodies or personal information, so your financial records are not sent to it.

Exchange Rates (Bank of Canada)

When you record an expense in a foreign currency, we fetch the daily exchange rate from the Bank of Canada's public Valet API. The request contains only the date and currency pair. No personal or financial data is sent.

Infrastructure and Legal

• Hosting and infrastructure providers process data on our behalf under confidentiality and data-protection obligations.
• Legal and safety: we may disclose information if required by valid legal process (such as a subpoena or court order) under applicable law, or where necessary to protect our rights, your safety, or the safety of others. Where permitted, we will notify you of such a request.
• Business transfers: if the Service is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this policy.

7. Subscription and Practice Billing Data

For consumer plans, we store the subscription identifiers and status returned by Stripe so we can manage your access. For accountant (practice) accounts, billing is per managed client and is tied to the accountant, not the client; we store the counts and status needed to bill correctly. We retain billing records as required for tax and accounting purposes.

8. How We Protect Your Information

We use a range of technical and organizational safeguards, including:

• Encryption of all data in transit using HTTPS (TLS), with HSTS enforced
• Encryption of uploaded receipt and invoice files at rest using AES-128 authenticated encryption (Fernet)
• Passwords stored only as bcrypt hashes with per-password salts
• SHA-256 integrity hashes to verify that stored files are unaltered
• Short-lived access tokens with refresh-token rotation and replay protection, and token invalidation on password change or logout
• Rate limiting on authentication and sensitive endpoints, upload size limits, and protections against account enumeration
• Strict security headers and a restrictive content-security policy
• Access to production systems restricted to authorized personnel

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your password and devices secure and for notifying us promptly of any suspected unauthorized access.

9. International Data Transfers

Your account data, financial records, and encrypted receipt and invoice files are stored and processed on servers located in Canada. However, when you use the scanning feature, the file content you submit is transmitted to OpenAI in the United States for processing (see Section 6). This transfer is necessary to provide the scanning functionality.

When personal information is processed outside Canada, it may be subject to lawful access requests by the courts, law enforcement, and government authorities of that jurisdiction, under that jurisdiction's laws. Before relying on a foreign service provider for personal information, we assess the transfer and require contractual protections intended to provide a comparable level of protection. If you access the Service from outside Canada, your information will be transferred to and processed in Canada (and the United States for scanning), which may have data-protection laws different from your own jurisdiction.

10. Data Retention and Deletion

We retain your data for as long as your account is active and as needed to provide the Service. Because the CRA generally requires you to keep tax records for at least six years, we keep your records available to you for the life of your account so you can view and export them.

Deletion You Initiate

When you delete an individual record (such as an expense or receipt), it is permanently deleted, and the associated file is removed from storage. We do not keep a hidden or recoverable copy of deleted records.

When you close your account, deletion is immediate and permanent: your expenses, receipts and their files, invoices, vehicles, home-office and CCA records, income sources, tax years, and account profile are erased and cannot be recovered. Export your data before deleting your account. If you are an accountant, you must offboard your managed clients before closing your account.

Automatic Deletion of Inactive, Unpaid Accounts

If you hold an individual account and you lose paid access (your free trial ends without subscribing, or a paid subscription is cancelled or lapses) and you are not covered by an accountant, and your account then remains inactive, we will eventually delete the account and all of its data after a 30-day grace period. We do this only for accounts with a verified email address, and we always warn you by email first:

• The grace period begins when the account is first observed to be inactive, and we send an initial notice, a reminder, and a final notice during that period.
• Each warning links to the in-app export so you can download everything beforehand.
• We never delete silently: deletion happens only after the final notice has been sent, and we send a confirmation email once it is done.
• It is reversible until it happens: subscribing again, or being taken on by an accountant, cancels the pending deletion and resets the clock.

This automatic process does notapply to accountant accounts, to client books sponsored by an accountant, or to accounts still within the payment provider's past-due retry window.

Records We Retain

A limited set of records is retained after deletion where the law or a legitimate purpose requires it, for example billing and tax records, and audit-trail entries showing that a record existed and was deleted (with any reference to a deleted user removed).

11. Your Privacy Rights

Subject to applicable law, you have the right to:

• Access: request a copy of, and an explanation of how we use, the personal information we hold about you
• Export and portability: download your data at any time through the built-in export feature, in a structured, commonly used format (CSV and PDF)
• Correction: update or correct inaccurate information
• Deletion: delete your records or close your account, which permanently erases your data as described in Section 10
• Withdraw consent: stop using a feature (such as scanning) or close your account at any time. Some withdrawals may mean we can no longer provide part or all of the Service
• Challenge our compliance: raise a concern or complaint with our Privacy Officer

To exercise any of these rights, contact [email protected]. We will respond within 30 days. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, and residents of Quebec may contact the Commission d'accès à l'information du Québec.

12. Cookies and Tracking

We use essential cookies only, to maintain your authentication session and remember preferences such as dark or light mode. We do not use third-party advertising or cross-site tracking cookies, and the marketing website does not embed analytics or pixel trackers. As described in Section 6, our advertising conversion measurement happens server-side, with no browser pixel or cookie.

13. Marketing Communications

We send transactional and account-related messages as part of operating the Service. We will send commercial or promotional email only where we have your consent as required by Canada's Anti-Spam Legislation (CASL). Any such message will identify us and include a working unsubscribe link, and we will honour unsubscribe requests promptly. You can opt out of promotional email at any time without affecting transactional messages needed to run your account.

14. Children's Privacy

Claimable is a business tool intended for adults filing Canadian tax returns. The Service is not directed at children under 18, and we do not knowingly collect information from minors. If we learn that we have collected personal information from a child under 18, we will delete it promptly.

15. Breach Notification

We maintain safeguards designed to prevent unauthorized access to personal information. If a breach of security safeguards occurs that creates a real risk of significant harm to affected individuals, we will report it to the Office of the Privacy Commissioner of Canada, notify affected individuals as soon as feasible, and keep records of the breach as required by law. Where Quebec Law 25 applies, we will also notify the Commission d'accès à l'information and affected persons.

16. Region-Specific Notes

Quebec residents.Personal information is treated as confidential by default and is shared only as you direct (for example, when you invite an accountant). You have rights of access, correction, portability, and to be informed about automated processing (Section 5) and cross-border transfers (Section 9), and you may complain to the Commission d'accès à l'information.

Accountant and client books.Where an accountant uses Claimable to manage a client's book, the account holder is responsible for the lawful basis to process that client's information, and Claimable acts as a service provider for that processing. See Section 6 and our Terms.

17. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by a prominent notice within the Service at least 14 days before the changes take effect. The "Last updated" date above indicates the most recent revision. Your continued use of the Service after a change takes effect means you accept the updated policy, except where the law requires your express consent.

18. Contact

If you have questions about this Privacy Policy or how Claimable handles your information, please contact our Privacy Officer:

Email: [email protected]