Privacy Policy

1. Introduction

GigBooks (“we,” “us,” or “our”) operates the web application located at gigbooks.ca (the “Service”). The Service provides privacy-first, AI-assisted expense categorization for Canadian freelancers and gig workers.

This Privacy Policy explains what information we collect, how we process and protect it, and your rights regarding your personal information. By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this Privacy Policy, you must not use the Service.

GigBooks is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. We are committed to protecting your privacy in accordance with Canadian law.

2. Definitions

• “Service” means the GigBooks web application at gigbooks.ca, including all features, tools, and related services.
• “Personal Information” means information about an identifiable individual, as defined under PIPEDA, including but not limited to name, email address, and financial transaction data.
• “Financial Data” means bank or credit card transaction data, including merchant names, transaction amounts, dates, and descriptions, whether uploaded as CSV files or PDF bank statements.
• “Account Data” means information associated with a registered user account, including email address, name, business name, province, and account settings.
• “Anonymized Data” means data that has been stripped of personally identifiable information such that it cannot reasonably be used to identify an individual. In our context, this refers to normalized merchant names and transaction amounts with all account numbers, personal names, addresses, and other identifiers removed.
• “Client-Side Processing” means operations performed entirely within your web browser on your device, where data is not transmitted to our servers.

3. Information We Collect

3.1 Account Data (Registered Users Only)

If you create an account, we collect:

• Email address (required for authentication)
• Name and profile picture (obtained from Google OAuth, if you choose to sign in with Google)
• Business name, province, fiscal year end, tax rate, and business type (optional, user-provided)
• Accountant email address (optional, user-provided, used only for report delivery at your request)

You are not required to create an account to use the core features of the Service.

3.2 Financial Data

• CSV files: Parsed entirely in your browser using client-side processing. Raw CSV data is never transmitted to or stored on our servers.
• PDF bank statements: Uploaded temporarily to our server for processing. Personal information (account numbers, card numbers, addresses, personal names) is redacted before any AI processing occurs. Temporary files are deleted immediately after processing is complete.
• Transaction data: If you choose to save your categorized transactions, they are encrypted at rest using AES-256-GCM encryption with per-user encryption keys before being stored in our database.
• Upload metadata: We store the original filename, detected bank format, total row count, and date range of each upload. We do not store the raw transaction data from the uploaded file.
• Merchant categorization mappings: When you correct a categorization, we store the mapping between the merchant name pattern and your chosen category so that future uploads reflect your preferences.

3.3 Automatically Collected Information

• IP addresses: Recorded in security audit logs when sensitive actions are performed (e.g., account deletion, sign-in events). Used for rate limiting and security monitoring.
• API usage metrics: We log the API endpoint called, number of transactions processed, AI token usage, response duration, and HTTP status for operational monitoring. These logs are associated with your user ID if you are authenticated.

We do not use Google Analytics, Facebook Pixel, advertising SDKs, retargeting pixels, or any third-party tracking or analytics tools. We do not use third-party cookies.

3.4 Browser Local Storage

The Service stores certain data in your browser's local storage (key: gigbooks-store), including merchant categorization mappings, display name preferences, and business settings. This data exists only on your device and is never transmitted to our servers.

4. How We Process Your Financial Data

This section describes in detail how your financial data flows through the Service. We have designed our architecture to minimize server-side exposure to your raw financial data.

4.1 CSV Processing (100% Client-Side)

• When you upload a CSV file, it is read and parsed entirely within your web browser.
• The Service auto-detects your bank's CSV format from the file headers.
• Raw transaction data — including account numbers, balances, and full transaction descriptions — never leaves your device.
• Only anonymized merchant names and transaction amounts are sent to our server for AI-assisted categorization. Long numeric sequences (8 or more digits) are scrubbed from merchant names before transmission.

4.2 PDF Processing (Server-Side with PII Redaction)

• PDF bank statements are uploaded to a temporary directory on our server.
• Before any AI processing, personal information is systematically redacted from the extracted text, including: card numbers, account numbers, phone numbers, postal codes, addresses, and personal names.
• Only the redacted, sanitized text (merchant names and amounts) is sent to the AI.
• After AI processing, a secondary defense-in-depth scrubbing pass removes any personally identifiable information that may have survived the initial redaction.
• Temporary PDF files are deleted immediately after processing is complete.
• PDF processing requires your explicit consent before upload.

4.3 AI Categorization

• Anonymized merchant names and transaction amounts are sent to the Anthropic Claude API for AI-assisted categorization into CRA T2125 expense categories.
• The AI does not receive: transaction dates, account numbers, bank names, personal names, balances, or any other personally identifiable information.
• AI responses are used solely to suggest expense categories and confidence levels.
• Per Anthropic's API data usage policy, data sent through the API is not used to train AI models.

4.4 Transaction Storage

• If you choose to save categorized transactions, they are encrypted at rest using AES-256-GCM symmetric encryption.
• Each user's encryption key is derived using HKDF-SHA256 from a server-side secret combined with the user's unique identifier. This means one user's data cannot be decrypted using another user's key.
• Encrypted data is stored as an opaque binary blob in our database.

4.5 Export Generation (100% Client-Side)

• CSV, Excel, and PDF exports are generated entirely within your web browser.
• Export files are streamed directly to your device for download.
• Export data is never uploaded to or routed through our servers.

5. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, operate, and maintain the expense categorization Service
• To remember your merchant categorization corrections for future uploads, improving your experience over time
• To process payments and manage subscriptions through our payment processor, Stripe
• To send transactional emails, including welcome messages and tax season reminders, through our email provider, Resend
• To maintain Service security through rate limiting, audit logging, and fraud prevention
• To improve categorization accuracy for all users by aggregating fully anonymized merchant categorization patterns (e.g., recording that many users categorize a particular merchant as a specific expense type, without linking this to any individual user)
• To respond to your inquiries and provide customer support

We do not:

• Sell, rent, lease, or otherwise share your personal information with third parties for their marketing purposes
• Use your data for advertising, ad targeting, or behavioral profiling
• Use your financial data to build credit profiles, risk assessments, or financial profiles
• Share your financial data with data brokers, credit agencies, or financial institutions

6. Third-Party Service Providers

We use the following third-party service providers to operate the Service. Each provider receives only the minimum data necessary for their function:

Each third-party provider operates under their own privacy policy and terms of service. We encourage you to review their policies. We are not responsible for the privacy practices of these third-party providers.

We do not integrate with Google Analytics, Facebook Pixel, Meta tracking, advertising networks, data brokers, or any third-party analytics or tracking services.

7. Data Storage and Security

We implement the following security measures to protect your data:

• Encryption at rest: Transaction data is encrypted using AES-256-GCM with per-user encryption keys derived via HKDF-SHA256.
• Encryption in transit: All communications between your browser and our servers are encrypted using HTTPS/TLS. We enforce HTTP Strict Transport Security (HSTS) with a one-year maximum age.
• Security headers: We implement Content Security Policy (CSP), X-Frame-Options (DENY), X-Content-Type-Options (nosniff), and restrictive Permissions-Policy headers to prevent common web-based attacks.
• Authentication security: Authentication is delegated to Supabase using Google OAuth or email magic links. We do not store passwords. Session tokens are stored in HTTP-only, secure cookies that cannot be accessed by JavaScript.
• Rate limiting: API endpoints are rate-limited to prevent abuse (10 requests per minute for anonymous users, 30 for authenticated users).
• Audit logging: Sensitive actions (account creation, deletion, sign-in events, administrative actions) are logged for security monitoring.
• Database hosting: Our database is hosted on Supabase infrastructure, backed by PostgreSQL with managed security updates.

While we employ industry-standard security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data. See Section 14 (Limitation of Liability) for details.

8. Data Retention

• Active accounts: Account data, encrypted transaction data, upload metadata, and merchant mappings are retained for the duration of your account.
• Account deletion: Upon account deletion, all associated data is permanently destroyed in an atomic database operation. See Section 10 for details.
• Security audit logs: Audit log entries are retained after account deletion for security, fraud prevention, and legal compliance purposes.
• API usage logs: Operational metrics are retained for service monitoring. After account deletion, these logs become orphaned records that cannot be linked back to an identifiable individual.
• Third-party retention: Stripe retains customer and payment records in accordance with their own data retention policies and legal obligations. Supabase may retain orphaned authentication records. These are outside our direct control.
• Browser local storage: Data stored in your browser's local storage persists until you manually clear it or use the account deletion flow. We have no server-side access to this data.
• PDF temporary files: PDF files uploaded for processing are stored temporarily on our server and are deleted immediately after processing is complete. They are not retained.

9. Your Rights Under Canadian Privacy Law

Under PIPEDA and applicable provincial privacy legislation (including Quebec's Law 25, British Columbia's PIPA, and Alberta's PIPA), you have the following rights:

• Right to know: You may request information about what personal information we hold about you and how it is used.
• Right to access: You may request access to your personal information in our possession.
• Right to correction: You may request correction of inaccurate or incomplete personal information.
• Right to withdraw consent: You may withdraw your consent for us to collect, use, or disclose your personal information, subject to legal or contractual restrictions. Withdrawal of consent may affect your ability to use the Service.
• Right to deletion: You may request the deletion of your account and associated data. See Section 10 for the deletion process.
• Right to complain: You may file a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

To exercise any of these rights, please contact us at privacy@gigbooks.ca. We will respond to your request within 30 days as required by PIPEDA.

Canada's Anti-Spam Legislation (CASL)

We comply with Canada's Anti-Spam Legislation. We send only transactional emails that are directly related to your use of the Service (e.g., welcome emails, account notifications, and tax season reminders). We do not send unsolicited commercial or marketing emails. You may opt out of non-essential transactional communications at any time by contacting us.

10. Account Deletion

You may delete your account at any time from your account settings. When you initiate account deletion, the following occurs in a single atomic operation:

1. Your Stripe subscription is cancelled immediately (if applicable).
2. All database records associated with your account are permanently deleted, including: upload metadata, encrypted transaction data, merchant categorization mappings, display name preferences, account settings, fiscal year records, and subscription records.
3. Your browser's local storage for the Service is cleared.
4. Your session is terminated and you are signed out.

Data That May Persist After Deletion

• Supabase authentication record: An orphaned authentication record (email and OAuth metadata) may remain in Supabase's systems. This is managed by Supabase in accordance with their data retention policies.
• Stripe customer record: Stripe retains customer and transaction records in accordance with their legal and regulatory obligations.
• Security audit logs: Audit log entries recording sensitive actions (e.g., the deletion event itself) are retained for security and compliance purposes.
• Anonymized aggregated data: Fully anonymized, aggregated merchant categorization patterns that your corrections may have contributed to are not deleted, as they cannot be linked to any individual user.

For anonymous users (those without an account), all data resides in your browser's local storage. To delete this data, clear your browser's local storage for gigbooks.ca through your browser settings.

11. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take steps to delete such information promptly. If you believe that a child under 18 has provided us with personal information, please contact us at privacy@gigbooks.ca.

12. Cookies and Local Storage

Cookies

The Service uses only essential cookies required for authentication. These cookies are set by Supabase to manage your login session. They are HTTP-only and secure, meaning they cannot be accessed by JavaScript and are only transmitted over encrypted HTTPS connections.

We do not use advertising cookies, tracking cookies, or any third-party cookies. We do not participate in cross-site tracking.

Local Storage

The Service stores certain preferences and settings in your browser's local storage under the key gigbooks-store. This includes merchant categorization mappings, display name preferences, and business settings. This data exists only on your device and is never transmitted to our servers. You can clear this data at any time through your browser settings.

13. International Data Transfers

GigBooks is a Canadian service. However, some of our third-party service providers may process data outside of Canada:

• Anthropic (United States): Receives only anonymized merchant names and transaction amounts. No personally identifiable information is transferred.
• Stripe (United States): Processes payment information under their own privacy policy and compliance certifications, including PCI-DSS Level 1.
• Vercel (United States): Hosts the application. Standard web request data may be processed in US or EU data centres.
• Supabase: Infrastructure is hosted on Amazon Web Services. The region may vary based on Supabase's infrastructure configuration.

We minimize the sensitivity of any data transferred outside Canada through anonymization and encryption. Where personally identifiable information must be transferred, we rely on each provider's contractual commitments and compliance certifications to ensure adequate protection.

By using the Service, you acknowledge that anonymized transaction data and account data may be processed outside of Canada as described above.

14. Limitation of Liability and Disclaimers

14.1 Tax Advice Disclaimer

GigBooks is not a tax professional, accountant, bookkeeper, or financial advisor. The Service is a tool for organizing and categorizing financial transactions for your reference. It does not constitute tax advice, financial advice, or professional accounting services. AI-generated categorizations are automated suggestions based on merchant name patterns and are provided for organizational convenience only. CRA T2125 line number mappings are provided for reference purposes and may not reflect the most current CRA guidance.

You are solely responsible for verifying the accuracy and completeness of all categorizations, deductions, and tax-related information before filing with the Canada Revenue Agency or any other tax authority. You should consult a qualified tax professional before making any tax filing decisions based on output from the Service.

14.2 AI Accuracy Disclaimer

The AI-powered categorization feature uses machine learning models provided by Anthropic. While we strive for accuracy, AI categorizations may contain errors, misclassifications, or omissions. Confidence levels displayed by the Service (high, medium, low) are statistical estimates and are not guarantees of accuracy.

GigBooks makes no warranty, representation, or guarantee regarding the accuracy, completeness, reliability, or suitability of AI-generated categorizations for any purpose, including tax filing. You must independently review and confirm all AI-generated categorizations before relying on them.

14.3 Service Disclaimer

THE SERVICE IS PROVIDED ON AN “AS-IS” AND “AS-AVAILABLE” BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, SECURE, OR FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS.

14.4 Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE CANADIAN LAW, GIGBOOKS AND ITS OWNERS, OPERATORS, OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, AND AFFILIATES SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES ARISING OUT OF OR RELATED TO YOUR USE OF OR INABILITY TO USE THE SERVICE, REGARDLESS OF THE THEORY OF LIABILITY (CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR OTHERWISE), EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

This includes, without limitation, damages for: lost profits or revenue; tax penalties, interest, or reassessments; incorrect tax filings or missed deductions; loss of data or business interruption; unauthorized access to or alteration of your data; or any other pecuniary loss.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATED TO THE SERVICE SHALL NOT EXCEED THE TOTAL AMOUNT YOU HAVE PAID TO US IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR FIFTY CANADIAN DOLLARS (CAD $50.00), WHICHEVER IS GREATER.

14.5 Indemnification

You agree to indemnify, defend, and hold harmless GigBooks and its owners, operators, officers, directors, employees, agents, and affiliates from and against any and all claims, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising out of or related to: (a) your use of the Service; (b) your reliance on AI-generated categorizations for tax filing or any other purpose; (c) your violation of this Privacy Policy or any applicable law; or (d) your violation of any rights of a third party.

14.6 Third-Party Services

We are not responsible for the privacy practices, security measures, data handling, or availability of any third-party service providers used in connection with the Service, including but not limited to Anthropic, Supabase, Stripe, Resend, Vercel, and Google. Your use of these third-party services is subject to their respective terms and privacy policies.

14.7 Data Security Disclaimer

While we implement industry-standard security measures including AES-256-GCM encryption, HTTPS, and restrictive security headers, no system of electronic data transmission or storage is completely secure. We cannot and do not guarantee that your data will not be accessed, disclosed, altered, or destroyed by breach of any of our physical, technical, or organizational safeguards. You transmit data to and through the Service at your own risk.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page
• Notify registered users by email of material changes (sent via our email provider, Resend)
• Where required by law, obtain your consent before applying changes that materially affect how we process your personal information

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you must stop using the Service and may delete your account as described in Section 10.

Previous versions of this Privacy Policy are available upon request by contacting privacy@gigbooks.ca.

16. Contact Information

If you have any questions, concerns, or complaints about this Privacy Policy or our privacy practices, please contact us at:

GigBooks Privacy Inquiries
Email: privacy@gigbooks.ca
Website: gigbooks.ca

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada:

Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
Website: priv.gc.ca