Privacy Policy

This Privacy Policy explains how Boring Labs Inc. ("Boring Labs", "we", "us", or "our") handles personal information in connection with Hakkuu, our small-business bookkeeping software, including our websites, web application, and mobile apps (together, the "Service"). Boring Labs is a Canadian federal corporation with its registered office at 601 Rivermede Road, Concord, Ontario.

We follow Canada's federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and applicable provincial privacy law. If anything here is unclear, please write to us at privacy@hakkuu.com.

1. Our two roles

We handle personal information in two different roles, and it helps to keep them separate:

• As the organization responsible for your account. For the personal information about you — the account holder and your team members — we decide how it is used and we are responsible for it under PIPEDA.
• As a service provider for your business records. For the information you put into the Service about your own customers, suppliers, and contacts (your "Business Contacts"), you are the organization responsible. We process that information on your behalf and on your instructions to provide the Service. See section 4.

2. Information we collect

We collect the following categories of information:

• Account information — your name, email address, phone number, timezone, password (stored only as a secure hash), and, if you sign in with Google or Apple, the basic profile information those services return. If you turn on two-factor authentication, we store what we need to verify it.
• Business and financial records — the data you create in the Service, such as invoices, quotes, customers and other Business Contacts, expenses, inventory, payment records, your province, and tax identifiers such as your GST/HST number. Where you record a payment account, we store only masked details (such as the last four digits), not full bank account numbers.
• Receipt images and documents — the receipts and files you upload, which we process to extract expense details (see section 5).
• Bank transaction data — if you connect a bank account through Flinks or Plaid, we import read-only transaction data so you can reconcile it. You provide your banking credentials directly to the aggregator, not to us.
• Billing information — your subscription status and plan. Card payments are handled by Stripe; we do not store full card numbers.
• Communications — messages you send us, and email you send through the Service to your Business Contacts (such as invoices, quotes, and reminders).
• Device and technical information — such as IP address, browser or device type, and, if you enable push notifications on mobile, your device push token.
• Legal acceptance records — see section 9.
• Audit and security logs — records of important actions and sign-in events, which help keep accounts secure and support the recovery and audit features of the Service.

3. How we use information

• to provide, maintain, secure, and support the Service;
• to calculate taxes, generate invoices, quotes, and documents, and produce the reports and features you use;
• to process receipts and provide AI-assisted features (section 5);
• to process your subscription and payments;
• to send you service messages, such as email verification, security alerts, trial reminders, and billing notices;
• to send email on your behalf to your Business Contacts when you ask the Service to do so;
• to detect, prevent, and investigate fraud, abuse, and security incidents;
• to comply with our legal obligations and enforce our terms.

We rely on your consent and on the reasonable purposes described here to collect and use personal information. You can withdraw consent as described in section 10, subject to legal or contractual limits. We do not sell your personal information, and we do not use third-party advertising or analytics trackers to profile you.

4. Personal information about your Business Contacts

When you enter information about your Business Contacts — for example a customer's name, email, phone, or address on an invoice — you are the organization responsible for that information, and we act as your service provider. We use it only to provide the Service to you and on your instructions; we do not use it for our own separate purposes.

You are responsible for having the right to provide that information to us and for meeting your own privacy obligations to your Business Contacts, including giving them any notices and obtaining any consents required by law. If one of your Business Contacts asks us about their information, we will generally refer them to you, since you control it. This division of responsibilities is also described in our Terms of Service.

5. AI-assisted features

Some features use third-party artificial-intelligence providers. When you scan a receipt, the image is sent to our AI providers to read and extract details; our primary provider is Google (Gemini) and our fallback is Anthropic. AI is also used for expense categorization and for the in-app AI assistant, which may process your business records to answer your requests. These providers process the data to return a result to us; the specifics and their locations are on our Subprocessors page. AI output can be wrong — please review it before you rely on it.

6. When we share information

We do not sell personal information. We share it only in these situations:

• With Subprocessors who process data on our behalf to run the Service — for example hosting and database (Railway), object storage for receipts, exports, and backups (Cloudflare R2), payments (Stripe), bank-feed aggregation (Flinks, Plaid), AI inference (Google, Anthropic), and PDF generation (a self-hosted service). The current list, what each one handles, and where it operates are on our Subprocessors page. We notify customers at least 30 days before adding a new Subprocessor.
• Where you direct us — for example when you email a document to a Business Contact, or connect an optional cloud backup you control (Google Drive, Dropbox, or Amazon S3).
• For legal reasons — to comply with a valid legal request, enforce our terms, or protect the rights, safety, and property of our users, the public, or us.
• In a business transfer — as part of a merger, acquisition, financing, or sale of assets, subject to this Policy.

7. Where your information is processed

Some of our Subprocessors are located in the United States (including our hosting provider Railway, Stripe, Plaid, and our AI providers Google and Anthropic). This means your information, including personal information, may be stored or processed outside Canada. While it is in another country, it is subject to that country's laws, and courts, law enforcement, and regulatory authorities there may be able to access it under those laws. We take steps intended to keep your information protected to a comparable standard wherever it is processed, including through our agreements with these providers.

8. Cookies and similar technologies

On the web, we use strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. We do not use advertising cookies or third-party marketing trackers. You can block cookies in your browser, but the Service may not work properly without the necessary ones.

9. Legal acceptance logging

When you accept our Terms of Service and this Privacy Policy — at signup and whenever we ask you to re-accept an updated version — we record proof of that acceptance. Each acceptance record includes your IP address, your user agent (browser or app identifier), your customer type, your province, the version numbers of the documents you accepted, and a SHA-256 hash of the exact document content, along with the date and time. We keep these records so we have a verifiable record of what you agreed to and when, and we may retain them for as long as needed to establish or defend our legal rights.

10. Your privacy rights

Under PIPEDA and applicable law, you may:

• Access the personal information we hold about you and ask how it has been used and disclosed;
• Correct information that is inaccurate or incomplete;
• Delete your account and personal information, subject to information we must keep by law;
• Withdraw consent to certain uses, and export your data using the tools in the Service. Withdrawing consent may mean we can no longer provide some or all of the Service.

To make a request, write to privacy@hakkuu.com. We will verify your identity and respond within the time required by law (generally 30 days). If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (see section 15).

11. How long we keep information

We keep your personal information for as long as your account is active and as needed to provide the Service. When you delete records, they are moved to a recoverable trash and are permanently removed after 30 days by an automated cleanup process. Backups are encrypted and retained on a rolling basis; the platform default is 30 days, and per-business backup retention can be configured in Settings.

After your account is closed, we will delete or de-identify your personal information within [FOUNDER: post-closure deletion timeline — recommend purge within 90 days of account closure], except for information we are required or permitted to keep by law (for example billing and tax records, and the legal acceptance records in section 9). Note that your own bookkeeping and tax records may need to be retained by you for at least six years under Canada Revenue Agency guidance — this is your responsibility, and you should export what you need before deletion.

12. How we protect information

We use administrative, technical, and physical safeguards to protect personal information. Traffic to and from the Service is served over TLS 1.2 or higher, and data at rest is encrypted with AES-256. Access within the Service is role-based, and state-changing actions are written to immutable audit logs. Our security practices are described in more detail on our Security page. No method of storage or transmission is perfectly secure, but we work to protect your information and to keep improving.

13. Breach notification

If a breach of security safeguards involving your personal information creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, and keep the records required by law. For your part in responsible disclosure, our Security page explains how to report a vulnerability.

14. Children and Quebec

The Service is intended for businesses and adults; it is not directed to children, and we do not knowingly collect their personal information. We also do not currently offer the Service to residents of Quebec while we complete French-language documentation and our readiness for Quebec's privacy law (Law 25). If you are in Quebec, please do not use the Service until we make it available to you.

15. Contact and complaints

Our privacy contact is:

Privacy Officer, Boring Labs Inc.
601 Rivermede Road, Concord, Ontario, Canada
privacy@hakkuu.com

If we cannot resolve your concern, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

16. Changes to this Policy

We may update this Policy from time to time. When we do, we assign the updated document a new version number and effective date, and we record the exact version and content hash that each user accepts. For material changes, we will ask you to review and re-accept before you continue using the Service. Your continued use after an update takes effect means you accept the updated Policy.