Privacy Policy

Who we are

This policy covers the bookkeeping, payroll and tax services operated by Powerplay Systems Inc., trading as Brian Bookkeeping, Brian Business and My Local Bookkeeper. It explains what personal information we collect, why we have it, who else handles it and where it is kept. We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA).

We work with bookkeepers in more than one province. Your bookkeeper is local to you; the records are kept in one system, described below.

Where your information is stored

Your books, the documents you send us and your account details are stored on Supabase infrastructure in the UNITED STATES (AWS region us-east-1). Backups are held in the same place.

That means your information is subject to United States law while it is there, including lawful access requests by US authorities, and you should know that before you send us anything. It does not change our obligations to you under Canadian law, or the protections in our agreement with you.

We are looking at whether to move the system to a Canadian region. If we do, we will say so here and date the change.

Automated tools and AI

We use software, including AI, to do the repetitive part of bookkeeping faster. It proposes; a person decides. Nothing an AI suggests is booked to your accounts without a bookkeeper reviewing it first.

THERE IS ONE AI PROVIDER, not several: Anthropic, the company behind Claude. Three things are worth knowing about what reaches it.

FIRST, most statements are read on our own infrastructure. A PDF with a text layer — which is what a bank or a credit-card issuer produces — is read locally by our own software, and no third party sees the file.

SECOND, the text we extract from a statement is what goes to Anthropic, not the statement itself.

THIRD, a photograph, a scan or a receipt has no text to extract, so for those the image itself goes to Anthropic to be read.

Anthropic may not use your information for its own purposes, including training models on it. No other AI service receives anything.

Who else handles your information

We use other companies to run the service — to host it, to take payments, to send email. They act on our instructions, they may not use your information for their own purposes, and the list below says what each one actually receives rather than describing them in general terms.

Most of them are in the United States, for the reason given above. If we add or change a provider, this list changes with it.

• Supabase

  Hosts the database, file storage and sign-in for the bookkeeping system.

  What it receives:

  Everything we hold for you: transactions, statements, receipts and other documents you send us, payroll figures, your CRA business and program account numbers, and your contact details.

  Where:

  United States (AWS us-east-1)

• Vercel

  Serves the websites and the client portal.

  What it receives:

  Whatever you type into a page or upload through it, in transit, plus standard request logs. Vercel does not hold your books.

  Where:

  Global edge network; the application runs in the United States

• Anthropic (Claude)

  The only AI service we use. It reads statement text to draft transaction categories, and reads receipts, tax documents and other files you send to suggest what they are and what they say. A person reviews the result before anything is booked to your accounts.

  What it receives:

  The TEXT extracted from a statement, and the IMAGE itself for a photograph, a scan or a receipt. Not your contact details and not your CRA account numbers.

  Where:

  United States

• Stripe

  Takes subscription and invoice payments, including pre-authorized debit.

  What it receives:

  Your name, email address, business name and payment details. Bank account details for pre-authorized debit go to Stripe directly; we never see or store them.

  Where:

  United States

• Resend

  Sends the email we send you — invoices, statements, reminders and replies.

  What it receives:

  Your email address and the contents of that message, which for an invoice or a statement includes the amounts in it.

  Where:

  United States

Social Insurance Numbers

We do not store your Social Insurance Number as data. There is no field for it anywhere in our system — deliberately, because information we never hold cannot be leaked, cannot be compelled from us and cannot be mishandled in a backup. Where a preparer needs to confirm they are looking at the right person, we keep the last three digits only, which cannot be used to file anything.

DOCUMENTS ARE DIFFERENT, and you should know this. A Notice of Assessment, a filed return or a signed T183 contains a full SIN, and if you send us one we hold that document. It is stored with your other documents, under the same access controls, and kept for the retention period below.

Your banking

We work from the statements you send us. We do not ask for, store or use your online banking usernames or passwords, and we have no direct access to your accounts. There is nowhere in our system that such a credential could be kept.

How long we keep it

Enquiry messages are kept only as long as needed to follow up.

Client records are kept for the length of the engagement and then for at least six years, because the CRA generally requires business records to be kept that long — we do not delete them before that. Once that period has passed we are no longer required to keep them, and you can ask us to delete anything we are not legally required to keep. See Your rights, below.

What we do not do

We do not sell, rent or trade your information. We do not use your financial records for advertising. We hold no certifications — no SOC 2, no ISO — and we would rather tell you that than imply otherwise.

Your rights

You can ask us at any time what personal information we hold about you, ask us to correct it, ask for a copy, or ask us to delete anything we are not legally required to keep. Ask your bookkeeper, or use the contact form, and we will respond promptly.

If you are not satisfied with how we have handled a privacy question, you can complain to the Office of the Privacy Commissioner of Canada.

Changes to this policy

If we make material changes we will update this page and the “Last updated” date above.

Contact

Questions about privacy or our data practices? Ask your bookkeeper, or reach us through the contact form.