Privacy policy

Firmdesk is practice software for accounting, bookkeeping and tax firms. This policy explains what information we collect, how we use it, where it's kept and the choices you have.

1. Who we are

Firmdesk is a product of Neperian Inc., a corporation in Ontario, Canada, at 1001-403 Bank St, Ottawa, ON K2P 1Y6. In this policy “we” means Neperian Inc., the company that runs Firmdesk.

The person responsible for privacy at Neperian Inc. can be reached at [email protected].

2. Two kinds of information, two roles

What a firm keeps in Firmdesk about its clients belongs to the firm. The firm decides what goes in and what it's used for, and we process it on the firm's behalf, as its service provider. If you are a firm's client, the firm is who to ask about your information; we help the firm answer.

What we collect to run the service, such as the accounts of the people who sign in, how the service is used and the firms' plans, is ours to look after, and this policy says how we do.

3. What we collect

• Account details: your name, email address, password (stored in a form nobody can read) and two-factor sign-in settings.
• What firms and their clients put in: client records and contacts, documents, requests and answers, messages, the emails sent to a firm's Inbox address, time, invoices and engagement letters.
• Signature records: when a firm's client signs in the portal, the signer's name, email address and signature, each step of the signing with its time, internet address and browser, and how the firm checked who they are. They're kept with the signed copy, on its certificate.
• Payment records: when a firm's client pays online, the payment's amount, date and status. For our own plans, the plan, its billing contact and its payments. Card and bank details are entered on Stripe's pages and never reach us.
• Usage and device information: activity such as sign-ins, documents opened and settings changed, with the internet address and kind of browser, error reports, and which parts of Firmdesk a firm uses. We look at this ourselves: no analytics company sees how the app is used.
• What you send us: emails to our support, privacy or security address, our forms (pilot applications, feedback), calls you book with us, and files a firm sends us for its move to Firmdesk.
• Our website and emails: visits to firmdesk.ca, counted without cookies; how you found us when you sign up (the page and campaign you came from, and, from one of our ads, the ad network's reference for the click); and your email address, when you ask us to email you something or subscribe to our newsletter.
• Cookies: only the ones the service needs, such as keeping you signed in, protecting forms and remembering a referral link. There are no advertising or analytics cookies.

We don't buy information about you, and we don't build profiles.

4. How we use it

• To provide the service, keep it secure, and fix what breaks.
• To help when someone asks for support.
• To send the emails the service is meant to send, such as invites, reminders and sign-in codes; and a few emails to help a firm get started and keep up with what's new, each with a link that stops them.
• To bill firms for their plans, and to run our offers and referrals.
• To understand how Firmdesk is used and which of our campaigns bring firms to it, so we can improve both.
• To meet our legal obligations.

We don't sell or rent personal information. We don't use a firm's data, or its clients', for advertising or to train AI models. When you ask us to email you something from our website, we send it, and nothing more unless you tick the box for our newsletter; you can unsubscribe at any time.

5. Who can see it

• The firm's team, according to the access the firm gives each person, and a client's contacts, who see only what the firm shares with that client.
• Neperian Inc. staff, only to keep the service running or when a firm asks for help, and as little as the task needs.
• The companies that help run the service, such as hosting, email delivery and payments, each bound by contract to protect what it handles and use it only for us. Who helps run it names them.
• Payment processing a firm turns on. When a firm takes payments online, Stripe processes them for the firm, under the firm's own agreement with Stripe.
• AI assistants a firm connects. A firm can let its team connect an AI assistant, such as Claude or ChatGPT. It's off until an owner or admin turns it on. The assistant works with what that person can see, and what it reads goes to the company behind it, under the firm's own agreement with that company. Firmdesk never gives an assistant the banking details it keeps, and hides social insurance numbers wherever they're written, in a client's document or email too. What clients wrote (the emails in the firm's Inbox, their documents and their answers to requests) reaches it only if the person ticks Inbox and documents when they connect it, and a bank account number in one of their documents, such as a void cheque, reaches it as written. Sending to a client, recording a payment or a credit, deleting, and changing the firm's settings or team wait for the person's approval, unless an owner of the firm lets that kind of action happen at once.
• Ad networks, only about a sign-up that came from one of our ads: we may tell that network what followed its click, such as a sign-up or a first payment and its amount, with its reference for the click and, for some networks, the kind of browser or a one-way hash of your email address, so we can measure our ads. Nothing a firm keeps in Firmdesk is shared. If your browser sends the Global Privacy Control signal, we don't tell the network anything. We don't advertise on any ad network today, so no network is told anything.
• The firm that referred yours, if one did: your firm's name, and whether it chose a plan.
• Authorities, only when the law requires it. Unless the law forbids it, we tell the firm first.
• A buyer or successor, if Neperian Inc. or Firmdesk is sold or merged, under this policy's protections.

6. Where it is kept

Firmdesk is hosted in Canada: the app, its database and the documents are on servers in Québec.

Some of the companies that help run the service are outside Canada, mainly in the United States and the European Union, for things such as delivering emails, keeping backups, processing payments, reporting errors, and our own forms and booking. Information held outside Canada is subject to the laws of the country it is in, and its courts and authorities may reach it under those laws. Who helps run it says what each company handles and where.

7. How long it is kept

A firm's data is kept as long as the firm has its account in Firmdesk, or until the firm deletes it. When a firm's account ends, its data is deleted as our terms describe, and it disappears from backups within 30 days after that.

Other information is kept only as long as it's needed for the reason it was collected, then deleted or made anonymous. Some records are kept longer when the law requires it, such as our own invoices, which Canada's tax laws ask us to keep for six years.

Firms have their own duties to keep records. Firmdesk keeps what a firm keeps in it; when to delete is the firm's decision.

8. How it is protected

We protect information with safeguards suited to how sensitive it is, including encryption, two-step sign-in and access limited to those who need it. The Security page says more.

If information is lost or seen by someone who shouldn't have, we tell the firms concerned promptly, with what they need to tell their clients, and we report it to the privacy authorities where the law requires.

9. Your rights

You can ask to see the personal information held about you, to have it corrected, and to have it deleted where the law allows. In Québec you can also ask for a copy in a common format, and withdraw consent you gave.

• If you are a firm's client, ask the firm. It holds your file and decides what to keep, and Firmdesk gives it the tools to answer you.
• If you are on a firm's team, change your own details in Settings, Your account, or ask an owner of your firm.
• For anything else, write to [email protected]. We answer within 30 days.

If you aren't satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Québec, to the Commission d'accès à l'information.

10. Children

Firmdesk is for firms and the adults who deal with them. A firm may keep information about a client's dependants, as tax returns require. Children don't have accounts.

11. Changes to this policy

When this policy changes in a way that matters, we tell firms by email before the change takes effect. The date at the bottom of this page says when it last changed.