Privacy Policy

TrueProfit, operated by Spencer Byl (“TrueProfit”, “we”, “us”, or “our”), is a business based in Ontario, Canada. We are the organization responsible for the personal information we handle through the business tool at trueprofit.ca and the consumer tool “TrueProfit Personal” at personal.trueprofit.ca (together, the “Service”). This policy explains what personal information we collect, why, how we use and disclose it, where it is processed, how long we keep it, how we protect it, and the rights you have under PIPEDA and applicable Ontario law.

We are accountable for personal information under our control, including information handled on our behalf by service providers. If you have questions, requests, or complaints about privacy, contact our Privacy Officer, Spencer Byl, at support@trueprofit.ca.

• Account information: your name, email address, and authentication details, handled through our provider Clerk. We do not store your password.
• Financial and business data you enter: the revenue, expenses, transactions, categories, receipts and uploaded documents, tax settings, and other content you choose to enter. This can be sensitive, so we treat it with corresponding care.
• Payment information: if you subscribe, your payment is processed by Stripe. Stripe collects and stores your card or payment details; we receive limited information such as subscription status, plan, the last digits and card brand, and billing country. We do not store full card numbers.
• Integration data: if you connect the optional Shopify integration, we receive the order, sales, or fee data you authorize so we can bring it into your account.
• AI assistant inputs: if you use the in-app assistant, the questions you send and a summary of the relevant metrics are processed to generate a response (see section 6).
• Usage and technical data: basic logs, device and browser information, IP address, and analytics needed to operate, secure, and troubleshoot the Service.
• Cookies: see our Cookie Policy.

We identify the purposes for collecting information at or before the time of collection. We use personal information to:

• provide, maintain, secure, and improve the Service;
• calculate your figures and generate the reports and exports you request;
• process payments, manage subscriptions, and prevent fraud or abuse;
• authenticate you and protect account security;
• provide customer support and send you service and transactional messages;
• comply with legal obligations and enforce our terms; and
• with your consent, send optional product updates or marketing (see section 8).

We do not sell your personal information, and we do not use your financial data for advertising. We will not use your information for a new purpose that is incompatible with the above without identifying it and obtaining consent where required.

Under PIPEDA we rely on your consent to collect, use, and disclose personal information. By creating an account and entering data, you consent to the uses described here that are necessary to deliver the Service you request. For sensitive financial information we rely on your express consent through your active use of the relevant features. You may withdraw consent at any time (see section 10), subject to legal or contractual restrictions and reasonable notice; withdrawing consent may mean we can no longer provide some or all of the Service.

The optional in-app assistant is powered by Cloudflare Workers AI. When you use it, your prompt and a summary of relevant account metrics are sent to that service to generate a response. We do not use your conversations to train public or third-party foundation models, and we direct our AI provider to process the data only to return your result. Do not enter information in the assistant that you do not want processed this way.

We share personal information only with service providers that help us run the Service, and only as needed for the purposes above, under contractual confidentiality and security obligations. Key providers include:

• Clerk: authentication and account management.
• Stripe: payment and subscription processing.
• Cloudflare: hosting, content delivery, security, and the Workers AI assistant.
• Database and infrastructure: a managed Postgres database that stores your account and financial data.
• Shopify: only if you connect the optional integration.

Cross-border processing. Some of these providers (including Clerk, Stripe, and Cloudflare) are based in or process data in the United States or other countries. This means your personal information may be stored or processed outside Canada and may be accessible to courts, law enforcement, and government authorities in those countries under their laws. We use providers that offer appropriate safeguards, but by using the Service you acknowledge this cross-border processing. You may contact us for more information about our providers and the safeguards in place.

We may also disclose information if required by law, to comply with legal process, to protect our rights or the safety of others, or in connection with a business transaction such as a merger or sale, subject to appropriate protections.

We send transactional and service messages (such as receipts, security alerts, and scheduled reports you have set up) as part of providing the Service. We send promotional or marketing emails only with your consent, consistent with Canada's Anti-Spam Legislation (CASL). Every commercial electronic message identifies us and includes a working unsubscribe mechanism. You can withdraw marketing consent at any time without affecting the service messages needed to run your account.

We keep personal information only as long as necessary to fulfil the purposes above, to provide the Service while your account is active, and to meet legal, tax, accounting, and audit obligations. You can delete businesses, transactions, and uploaded files at any time. When you close your account or request deletion, we delete or anonymize your personal information within a reasonable period, except where retention is required by law or for legitimate business records such as transaction and billing history. Residual copies in secure backups are overwritten in the ordinary backup cycle.

Subject to limited exceptions in PIPEDA, you have the right to:

• ask whether we hold personal information about you and request access to it;
• request correction of inaccurate or incomplete information;
• withdraw consent to further use or disclosure, subject to legal or contractual limits;
• request deletion or export of your information; and
• ask how your information has been used and to whom it has been disclosed.

To exercise these rights, email support@trueprofit.ca. We will verify your identity and respond within the time required by law (generally 30 days under PIPEDA). We do not charge for reasonable access requests; if a request would involve a cost, we will tell you first.

We protect personal information with safeguards appropriate to its sensitivity, including encrypted connections (TLS), access controls that isolate each account's data, authentication managed by a specialized provider, private signed links for uploaded receipts, and limited staff access on a need-to-know basis. No method of transmission or storage is perfectly secure, but we work to protect your information and review our safeguards periodically.

If we become aware of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and report to the Office of the Privacy Commissioner of Canada as required by PIPEDA, and keep records of breaches as the law requires. We will tell you what happened, what information was involved, and the steps you can take.

The Service is intended for users who are at least the age of majority in their province or territory (18 in Ontario). It is not directed to children, and we do not knowingly collect personal information from anyone under the age of majority. If you believe a minor has provided us information, contact us and we will take reasonable steps to delete it.

We use essential cookies and limited analytics. For details and how to control them, see our Cookie Policy.

We may update this Privacy Policy from time to time. We will revise the “last updated” date above and, for material changes, provide additional notice where appropriate. Continued use of the Service after changes take effect means you accept the updated policy.

For any privacy question or request, contact us first at support@trueprofit.ca. If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca or by phone at 1-800-282-1376. You may also review our Terms of Service.