Privacy Policy

Who we are

CV Bookkeeping is a bookkeeping firm based in Edmonton, Alberta, serving clients across Canada. In this policy, “we” and “us” mean CV Bookkeeping, and “you” means anyone who visits cvbookkeeping.ca, books a meeting with us, or works with us as a client.

We follow Canada’s federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and Alberta’s Personal Information Protection Act (PIPA), whichever applies to your information. As a Certified Professional Bookkeeper, Corrie also follows the CPB Canada Code of Ethics and Professional Conduct, which includes keeping client information confidential.

This policy covers our website, our booking and onboarding forms, our client portal, and the bookkeeping and payroll work we do for clients.

What we collect

When you visit our website

• Technical information your browser sends, like your IP address, browser type, the pages you visit and when. Our website host and security software use it to keep the site running and safe.
• We don’t use website analytics or advertising tracking today. If we add them later, to see which pages help people or which ads bring them to us, we’ll update this policy first. We don’t sell your information.
• Our website loads its fonts from Google Fonts, so Google receives your IP address in order to send the font files to your browser.

When you book a consult or fill in a form

• Your name, email address, phone number and business name.
• Answers you give on our Discovery Form, such as your industry, the software you use, how many accounts you have, whether you run payroll or charge sales tax, and how you heard about us.

When you call us

• Calls to and from our business phone lines are recorded, and a message at the start of each call lets you know. If you leave a voicemail, it’s recorded and transcribed, and the transcript is emailed to us.

When you become a client

• Your contact and billing details, and your signed agreement.
• Your business’s financial records: bank and credit card statements, receipts, invoices, and access to your accounting and payroll software.
• For payroll clients, your employees’ information, such as names, addresses, dates of birth, Social Insurance Numbers, pay rates, and banking details for direct deposit.
• Information about other people that appears in your records, such as your own clients or customers named on invoices.

What we don’t ask for

We never ask for your online banking password. Please don’t send us health information about you or your clients, or documents we haven’t asked for.

How we use it

• To answer your questions and book meetings with you.
• To follow up on calls and voicemails, and keep accurate notes of what was said.
• To prepare your proposal and agreement.
• To do the work you hire us for: bookkeeping, payroll, sales tax remittances and year-end preparation for your accountant.
• To bill you and keep our own business records.
• To keep our website and systems secure.
• To meet legal requirements, such as tax and payroll record-keeping rules.

We only use your information for these purposes, or for something new if you agree to it first. We never sell your information.

Who we share it with

To do our work, we use trusted service providers. They handle your information only to provide their service to us.

• Moxie: booking meetings, our Discovery Form, agreements, and invoices. Our work email is also connected to Moxie, so emails between us and you are copied into your record there. United States (Amazon Web Services, Oregon).
• Stripe: processing card payments for invoices. We never see or store your full card number. United States.
• Double: our secure client portal for documents, receipts, questions, and reports. Emails between us are also linked into your record there, and Double tells us when an email we send has been opened. United States.
• QuickBooks Online (Intuit): where your books are kept. United States, with a backup of Canadian customers’ data kept in Canada.
• Xero: where your books are kept if you use Xero. Stored in the United States (Amazon Web Services), with backups of Canadian accounting data in Canada. Xero’s teams in Australia and New Zealand may also access it.
• Microsoft 365: email, file storage, and Microsoft Teams video meetings. We also use it to share files with your accountant when they aren’t in your client portal. Canada.
• Ooma: our business phone system. It records our calls and voicemails, and transcribes voicemails. Ooma is an American company with a Canadian office, and may store or process this information in the United States.
• Payroll software (Wagepoint, Payworks, Jane Payroll, or ADP, depending on your setup): running payroll and filing slips. Wagepoint and Payworks are Canadian companies and ADP is American. Wagepoint and Payworks state that payroll data is stored in Canada, and Wagepoint confirmed to us that this includes backups. ADP allows payroll information to be processed or reached from the United States or other countries.
• Payment processors you already use (like Square, Moneris, PayPal, QuickBooks Payments, or Jane Payments): we read their payout reports to match your deposits to your bank. Each one keeps your information under its own privacy policy.
• Hubdoc (Xero): collecting receipts and bills for DIY Assisted clients. Stored in the United States, like Xero.
• Plooto: collecting your monthly fee by pre-authorized debit, and paying bills for clients who use bill pay. Your pre-authorized debit agreement and the bank details on it are held there. Plooto is a Canadian company, and its service providers may be in Canada, the United States, the Netherlands or other countries.
• Ping: meeting notes. It records and transcribes our meetings with you and writes a summary, which we save to your client record in Double. Ping doesn’t use meeting content to train AI models. United States.
• Claude (Anthropic): the AI assistant we use behind the scenes for drafting and document preparation (see How we use AI). Anthropic processes it for us under a business account: it isn’t used to train their AI models, and it isn’t sold or passed on to anyone else. United States.
• Our website host and security software, to run and protect cvbookkeeping.ca. United States.

We also share information when you ask us to, for example with your accountant, and when the law requires it, for example with the Canada Revenue Agency for payroll and sales tax filings.

Storage outside Canada

Some of our service providers store or process information outside Canada, only to provide the services listed above. Most of this happens in the United States, where our website is also hosted. Depending on the provider, information may also be processed in the United Kingdom, the European Union, India, Australia, New Zealand, Singapore, South Africa, and other countries where our providers or their own service providers (called sub-processors) work. Microsoft 365 stores our email and files in Canada. Jane stores each clinic’s information in the region the clinic chose when it signed up, which for Canadian clinics is Canada, though Jane names text message reminders and telehealth as features that can be handled elsewhere. In every case, support teams and sub-processors may still reach information from other countries.

While your information is outside Canada, courts, law enforcement or national security authorities there may be able to access it under that country’s laws. To learn more about our service providers outside Canada, contact our Privacy Officer (see Questions and complaints).

How we use AI

We use AI to help with behind-the-scenes prep, like sorting documents and drafting notes. A person on our team reviews AI-prepared work before it reaches your books or your inbox, and stays responsible for it. Our biggest single use is a direct connection between the assistant and QuickBooks Online, which lets us look things up and record work far faster than clicking through screen by screen. While we do that, the assistant can see the bookkeeping records it is working with.

The AI features in your client portal, and Claude (made by Anthropic), which we use for drafting and document preparation, process information in the United States. We use business accounts and settings, so your information isn’t used to train AI models and isn’t sold or passed on. One exception worth naming: the receipt reader in your client portal uses a cloud text-recognition service, and that provider may use the text it reads to improve its own service.

We record and transcribe our meetings with you so the notes are accurate and nothing gets missed, and the summary goes into your client record. Our note-taking assistant joins the meeting as its own participant, with its own name and picture, so you can see when it’s there. If you’d rather we didn’t use it in your meetings, tell us and we’ll talk it through. And if you’d prefer we didn’t use AI on your file at all, tell us and we’ll talk through what that looks like.

Cookies

Cookies are small files a website saves in your browser. Our website uses only the cookies it needs to work and stay secure. We don’t use analytics or advertising cookies today. When you open our booking calendar or a form, you go to Moxie, and Moxie may set its own cookies there so booking works properly.

You can block or delete cookies in your browser settings, though some features, like the booking calendar, may not work.

Where the law requires it, we’ll ask for your consent before setting analytics or advertising cookies.

How we protect it

• Documents are shared through our secure client portal, not by email.
• We use two-factor sign-in on every accounting app that offers it, and on our email, website, and domain accounts. New client portals are set up with two-factor authentication (2FA) during onboarding.
• Our passwords are kept in a secure password manager.
• We don’t do client work from public places.
• Only people who need your information for your work can access it, and they’re bound by confidentiality.
• Our website uses an encrypted (HTTPS) connection.

No system is perfectly secure. If a breach creates a real risk of significant harm, we’ll tell you and report it to the privacy commissioner as the law requires. Please don’t email sensitive information: use your client portal instead.

How long we keep it

• If you don’t become a client: we keep your consult and form information for 4 months. After that, your record is archived in Moxie and we no longer use it.
• Client records: for as long as you’re a client, then as long as tax and payroll record-keeping rules require, which for us is 7 years. (The Canada Revenue Agency asks you to keep records for 6 years from the end of the last tax year they relate to.) After that, we securely delete them or return them to you.

Your rights

• Ask what personal information we hold about you, how we’ve used it and who we’ve shared it with.
• Ask us to correct information that’s wrong.
• Withdraw your consent, subject to legal or contract limits. We’ll explain what that means for our work together.
• Ask for a list of the service providers we use.

Send your request to our Privacy Officer, and we’ll respond within 30 days. We may ask you to confirm your identity first.

Emails from us

If you book a consult or ask us a question, we’ll email you about it. Canada’s anti-spam law (CASL) allows that for six months after your inquiry. We only add you to a newsletter or marketing list if you’ve said yes, and every marketing email has an unsubscribe link. Our mailing list is kept in Double, our client portal. Double also tells us whether an email we sent you has been opened. We use that to know whether something needs following up, not to build a profile of you.

Changes to this policy

We’ll update this policy when our practices change, and change the date at the top of this page.

Questions and complaints

Contact our Privacy Officer at info@cvbookkeeping.ca, or call (877) 463-0139 and leave a voicemail. Mailing address (mail only, not an office): PO Box 57236 Eastgate, Sherwood Park, Alberta T8A 5L7.

If we can’t resolve your concern, you can contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.