Peazy — Privacy Policy

Effective date: 2026-11-01

This Privacy Policy explains what personal information Peazy collects, why, who processes it, how long it's kept, and the rights you have over it. It forms part of, and should be read alongside, our Terms and Conditions. Terms defined there ("Service", "Your Content", "we"/"us") carry the same meaning here.

1. Who we are

Polaris Data Insights Ltd. (Ontario Corporation Number 1001167143), an Ontario corporation with its registered office at Suite 516, 1 Belsize Drive, Toronto, Ontario M4S 0B9, Canada ("Peazy", "we", "us", "our"), is the organization responsible for the personal information described in this policy, for the purposes of the Personal Information Protection and Electronic Documents Act (PIPEDA) and any applicable provincial equivalent. Our privacy contact is privacy@peazy.cloud.

This policy covers the Peazy mobile applications (iOS and Android), the Peazy web application at app.peazy.cloud, the site at peazy.cloud, and every related service, export, and message we provide.

2. What we collect

We collect only what the Service needs to organize your financial documents and estimate what to set aside — nothing collected here is used for a purpose you wouldn't recognize from using the product.

• Account information. Email, full name, province/territory, incorporation status, and your profession. We do not collect a phone number. Profession is asked once during setup and is required, because the Service uses it to decide what to call things (§3). You can change it at any time.
• Optional demographics. If you answer the optional in-app prompt, we also collect your gender and birth year. Neither is read by any calculation; they exist purely for an aggregate view of who uses Peazy, and answering is always optional and dismissible.
• Financial data from accounts you connect. Read-only transaction, balance, and account-name data, and the last four digits of a connected card or account number, for accounts you choose to connect. We never see or store your online banking credentials — our account-connection provider (§6) handles that exchange, and the resulting access token is stored encrypted in a secrets vault and never exposed to the app. We cannot initiate payments or move money.
• Receipts you submit. Photographs or forwarded emails of expense receipts. We do not accept or process production reports, remittance statements, contracts, or other documents that would routinely carry patient- or client-identifying information — see §5.
• Production entries and payout rates — only where the Service offers them (currently dentists). Figures you type (not a document, not free text) — the work you recorded, and the payout-split percentage the clinic pays out (set when you add it, editable afterward) — used only to compare against deposits already visible from your connected accounts. This category is collected only for a profession the Service offers it to. For every other profession the Service does not offer these fields and holds neither figure. If it becomes available to another profession, that is a change to what we collect about you and §14 (Changes to this policy) applies.
• Communications and feedback. If you email us for support, forward a receipt, or contact our privacy or security addresses, or send feedback from inside the app, we keep that correspondence to respond to you and to meet our own record-keeping obligations (§9). Feedback sent from the app includes what you wrote, your account email, and basic technical details (platform, app version, the screen you were on, and your device or browser type); nothing from your records is attached.
• How you found us. If you reached Peazy through one of our ads and accepted tracking on our marketing site (peazy.cloud), we receive the campaign details and click identifiers from that visit, so we can tell which advertising brings people to the Service. If you declined tracking, or arrived any other way, we receive nothing of the kind. See §6 and §11.
• Device and usage information. Ordinary technical data any app or web service collects to operate — device type, app version, crash diagnostics, and basic usage events — used to keep the Service working and to email you when your account is signed in to from a device or browser it hasn't seen before, not to build an advertising profile.
• Your accountant, if you connect one. If you choose to connect an accounting firm in Peazy, we record which firm, the access level you chose, when you agreed and which version of the consent screen you saw, any later change or removal, and a log of each time that firm's staff viewed or downloaded your information. If you never connect a firm, none of this exists.
• Partner codes you use. If you redeem a code from an accounting firm or other partner, we record which firm, code and offer, the free months or discount applied, the dates, and its status. Redeeming a code is separate from connecting a firm: it does not by itself share anything about you with the firm (§6).

We do not collect information from anyone we know to be under 18 (see the Terms' eligibility section), and we do not knowingly collect more than the Service needs to function — a production entry, for example, was deliberately built with no free-text field, because that is where a patient's or client's name would otherwise get typed (§5).

3. Why we collect it, and your consent

We collect and use your personal information only for the purposes described in this policy: running the Service you signed up for, computing your tax and deduction estimates, matching receipts to transactions, presenting the Service in the vocabulary your profession actually uses, understanding how the Service is used so we can improve it, measuring whether our advertising works, providing support, billing your subscription, and meeting our own legal and security obligations.

Profession is a presentation input, never a calculation input. It decides wording — whether the places that pay you are called clinics, practices, or brokerages, and what you record is called production, billings, or gross commission — and which features are offered to you. It does not change any tax, CPP/QPP, or deduction figure, and it is not passed to the deterministic engine that produces those figures (§4). What does drive those figures is your province or territory of residence, your incorporation status, and how you're paid, all of which you set yourself.

Meaningful consent. Creating an account and connecting a financial account are both affirmative actions you take with the relevant disclosure in front of you (this policy, and the account-connection provider's own disclosures at the point you connect an account, §6). Before you see your first tax estimate, the Service also shows a dedicated, full-screen acknowledgement — not a pre-ticked checkbox — that you must actively accept to continue; we log that acceptance (which version of the Terms and of this policy, on which platform, and when) so both you and we have a durable record of it. You can withdraw consent to non-essential processing at any time (for example, our marketing/product-update emails have their own unsubscribe, per the Terms' CASL section) by contacting privacy@peazy.cloud; withdrawing consent to processing the Service needs to function is equivalent to closing your account (§10).

Sharing with your accountant is a separate choice. No accounting firm sees anything about you until you connect it yourself, on a screen that lists what it will and won't be able to see and asks you to choose its access level. A firm can ask for more access, but nothing changes unless you agree. You can change the access level or remove the firm's access at any time from Settings → Your accountant, and removal takes effect immediately.

We will never use Your Content to train, fine-tune, develop, or evaluate any machine-learning or AI model, and we do not permit any service provider to do so either (see §6 and the Terms' §9.2).

4. How we use AI

Peazy uses AI to categorize transactions and extract receipt fields. The tax, CPP/QPP, and deduction figures themselves are never computed by an AI model — they come from a deterministic calculation engine with no AI dependency at all. Every AI output that touches a category or an extracted field is validated, clamped, or rejected by ordinary code before it's trusted; nothing an AI model produces is written to your records raw. AI-proposed values are visually marked as such until you confirm them.

5. What we deliberately do not process

The Service is not a clinical or client records system. You must not enter, upload, or forward patient or client names, contact details, health numbers, chart, file or matter numbers, clinical notes, or any other information identifying the people you serve, whatever your profession is called (Terms §8 sets this out in full). Peazy records what you earned and what you spent; it never needs to know who you earned it from beyond the clinic, practice, or brokerage that paid you.

Peazy does not accept or process production, billing or collections reports, remittance or pay statements, or other operational documents from a business that pays you — that pipeline was removed outright rather than hardened, on the view that nothing-to-redact beats redacting well. Your Peazy forwarding address classifies inbound mail before any extraction runs, and discards anything recognized as a practice document without parsing it. If patient information reaches us despite this, tell us at privacy@peazy.cloud and we will delete it; we will not use it for any purpose and will not disclose it except as required by law.

6. Who we share it with

We share personal information only with service providers who need it to help us run the Service, under contractual confidentiality and security obligations, and — for cross-border transfers — you should assume your information may be processed outside Canada, including in the United States, where it is subject to that country's laws (including lawful access by its authorities).

We describe each provider by what it does, and list first the ones that receive your financial records or documents — the information you would most want to be able to weigh. The specific company behind a function can change without anything about what happens to your information changing, so the names are not part of this policy; a complete, current list of our providers, by name, is available on request at privacy@peazy.cloud.

Providers that receive your financial data or documents

Other providers

Advertising measurement. If you reached Peazy through one of our ads and accepted tracking on our marketing site, then when you create an account we send the advertising platform that showed the ad a single event — such as that an account was created or a subscription started — together with the identifiers that platform itself assigned to your browser and, for some platforms, your IP address and browser type, so it can match the event to the ad. We do not send your name, email, phone number, Peazy account identifier, or anything from your records. Those platforms handle what they receive under their own terms and privacy policies. If you declined tracking, nothing is sent. See §11.

Accounting firms you connect. An accounting firm you connect is not one of our service providers: we make information available to it because you told us to, and only what the access level you chose allows.

• Year-end package only: your name and email address, your year-end package, and whether it is ready.
• Read-only access: the same, plus read-only views of your income, expenses, receipts and tax estimate.

Partner codes. Using a firm's code or link does not by itself share anything with that firm. The firm sees only how many times a code has been used, never who used it; if you also choose to connect the firm, the access level you pick then governs what it sees. The free months or discount a code gives you are applied through our subscription billing provider.

A firm never receives your bank sign-in details or bank connection keys, and cannot add, change or delete anything in your account. Anything a firm downloads is then held by that firm under its own professional and privacy obligations; removing its access stops any further access but cannot recall files it already has.

If you are a member of an accounting firm's team on Peazy, we hold your name, email address, role, sign-in and two-step verification details, and a record of the client information you viewed or downloaded. We use them to run your firm's account and to show each client who accessed their information.

We do not sell personal information, and we do not share it for the recipient's own marketing purposes, apart from the advertising measurement described above. We may disclose aggregated, anonymized statistics (for example, "the median associate connects two financial accounts") produced from data aggregated across many users, in a form from which no individual can reasonably be identified — we will not attempt to re-identify it.

We may also disclose personal information where required by law, to protect the rights or safety of any person, or in connection with a merger, acquisition, or sale of assets (on notice to you, as described in the Terms).

7. Security safeguards

We maintain safeguards appropriate to the sensitivity of the information we hold, including:

• Owner-only access at the database level, no exceptions — every table scopes access to the authenticated owner, with an additional check on every cross-table reference so a user cannot point their own record at someone else's.
• One checked, logged door for accountants. A connected firm never reads your records directly. Every view or download passes a single check — that you are connected to that firm, at what access level, and that the staff member is still on the firm's team and signed in with two-step verification — and is recorded before anything is returned. You can see that record in the app.
• Encryption. Bank connection access tokens are stored in an encrypted secrets vault, never in a plain database column, and are never exposed to the app. Data is encrypted in transit and at rest.
• Minimal, logged staff access. A small number of authorized personnel can access accounts to provide support, investigate a problem, or administer billing. Every such access — including simply looking up an account, not only actions that change something — is logged, with who, when, and which account.
• No credential handling. We never see or store your online banking credentials; our account-connection provider handles that exchange entirely.

No safeguard is perfect, and we cannot guarantee absolute security. See §9 for what happens if something goes wrong.

8. How long we keep information

• While your account is open, we keep your data to provide the Service.
• Raw forwarded documents (the original email payload behind a submitted receipt) are kept only as long as needed to extract the receipt, then purged automatically on a short, fixed window — not retained indefinitely.
• On account closure, we delete or anonymize Your Content within 30 days (in practice, our in-app "Delete account" flow does this immediately, and also cancels a subscription you bought on the web — an App Store or Google Play subscription has to be cancelled with Apple or Google), except for (i) routine backups, which age out on their own cycle, and (ii) records we are legally required to keep, such as billing records and the breach register described in §9.
• Accountant records. If you remove a firm's access, we keep the record of the connection and of the firm's views and downloads, so that both you and we can see who saw what and when. If you close your account, the connection ends, the firm is told that you closed your account, and its record of past views and downloads is kept without your account identifier. The same applies to the record of a partner code you used: it is kept without your account identifier, so the firm's count of how many times a code was used stays accurate.
• Support correspondence and compliance records (including the breach register) are kept for as long as applicable law requires — PIPEDA requires our breach record specifically to be kept at least 24 months and producible to the Office of the Privacy Commissioner on request.

9. If something goes wrong

If we become aware of unauthorized access to, or unauthorized use or disclosure of, Your Content, we will notify you without undue delay at your registered email address, tell you what we know, and tell you what we're doing about it. We keep an internal record of every such incident — reportable to the Office of the Privacy Commissioner of Canada or not — for at least 24 months, as PIPEDA requires.

If you are subject to your own statutory or contractual breach-notification duty, that duty is yours; we will give you the information reasonably available to us so you can meet it, but we do not notify patients, custodians, practices, regulators, or professional colleges on your behalf (see the Terms' §8.6).

10. Your rights

Subject to limited exceptions in applicable law, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information — most of your profile is editable directly in the app, including your profession and your province or territory; for anything that isn't, contact privacy@peazy.cloud.
• Withdraw consent to non-essential processing — including removing an accounting firm's access at any time from Settings → Your accountant (§6) — or close your account entirely (§3, §8).
• Export your data at any time your account is open. Export it before you close your account — closing it deletes your data immediately and permanently (§8), and we cannot reproduce or restore it afterwards.
• Complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) if you believe we've handled your personal information improperly, ideally after raising it with us first at privacy@peazy.cloud so we have the chance to fix it.

11. Cookies and similar technology

The web application uses the technical storage (local/session storage, authentication cookies) needed to keep you signed in and remember your preferences.

We also use a product analytics provider (§6) to understand how the Service is used — which screens and features people actually use — so we can improve it. This records app activity tied to your pseudonymous account identifier, never your name or email directly. We do not record your screen or session, and we do not capture the content of what you type or the specific financial figures the Service shows you; only a defined, limited set of usage events (for example, that an onboarding step was completed) is sent. This analytics data is never used for advertising or shared with anyone for their own marketing purposes. The Service itself loads no advertising trackers or pixels.

Advertising on our marketing site. Our marketing site (peazy.cloud) asks for your tracking choice. Only if you accept does it set cookies recording which campaign or ad click brought you to us, and the identifiers the advertising platforms assign to your browser. When you first sign in to Peazy, the Service reads those cookies and passes them to the advertising measurement described in §6. If you decline, no such cookies exist and nothing is sent. You can change your choice at any time on peazy.cloud or by clearing that site's cookies. The Service sets no advertising cookies of its own, which is why it has no tracking banner.

12. Children

The Service is not directed at, and we do not knowingly collect personal information from, anyone under 18. If you believe a child has provided us personal information, contact privacy@peazy.cloud and we will delete it.

13. Quebec residents

The Service is not currently offered to residents of Quebec. This is a deliberate, temporary scope decision (not a technical limitation) made because Loi 25 and Bill 96's requirement that a contract of adhesion and the software interface itself be offered in French cannot yet be met — see the Terms' §22.9. Quebec-specific rights (including under Loi 25, such as a designated and published privacy officer, and Commission d'accès à l'information notification) will be built out and disclosed here before the Service opens to Quebec residents; they are not asserted in this version of the policy because they don't yet apply to anyone using the Service.

14. Changes to this policy

We may update this policy. For a material change, we'll give at least 30 days' notice by email or in-app before it takes effect, the same way the Terms describe for changes to that agreement.

15. Contact us

Polaris Data Insights Ltd. (operating as Peazy)

Suite 516, 1 Belsize Drive, Toronto, Ontario M4S 0B9, Canada

Privacy: privacy@peazy.cloud Security: security@peazy.cloud Support: hello@peazy.cloud