Privacy policy

Who we are and what this covers

Gopher Boss Inc., an Ontario corporation runs the Gopher Boss app. This policy explains what personal information the app collects, why, who processes it, where it's stored, how long it's kept and how to reach us. It's written with Canada's federal privacy law (PIPEDA) and, for Quebec, Quebec's private-sector privacy law (Law 25) in mind.

Your business decides what it records about its own customers and why. We store and process that information only to run the app for your business.

What we collect

About the people who sign in (the owner and the team):

• name, email address, role and language, and an optional phone number;
• the password, stored only in scrambled (hashed) form, and the two-step sign-in key, stored encrypted;
• sign-in sessions, and the network (IP) address of sign-up and sign-in attempts, used only to stop abuse;
• which version of these pages the person accepted, and when.

About your business's customers, as your business enters them: names, email addresses, phone numbers, street addresses, language, notes, invoices, payments and statements; for fire inspection, their buildings, equipment and visits; for loans, the lender's name and email.

Copies of the emails and texts sent through the app, with their delivery status. Personal links in the stored copies are hidden.

If your business turns on e-Transfer matching, the Interac e-Transfer notification emails you forward to our mailbox and the e-Transfer email addresses you confirm. We keep, from each notice, the sender's name, their message, the amount, the Interac reference and the day; the email itself is read and not stored by the app.

Bank statement and import files are read to bring in their lines and aren't stored; the lines brought in are.

Cookies: only the ones needed to keep you signed in, finish two-step sign-in and remember your language. No advertising or tracking cookies.

Why we collect it

We use this information only to:

• run the app for your business: sign-in, invoices and records, and the emails and texts you ask it to send;
• keep accounts secure and stop abuse;
• find and fix errors;
• meet our legal obligations.

We don't sell personal information, don't use it for advertising, and don't send our own marketing to your customers.

Who processes it for us

These service providers process information so the app can run:

• Hosting (Hostinger): the app, its database and its backups, on servers in the United States.
• Email delivery, through our email provider (currently Hostinger's email service): the emails the app sends, and who they go to. The app can use Hostinger's mail server or Resend (in the United States). When e-Transfer matching is on, the same Hostinger mailbox receives the Interac notifications businesses forward to it.
• Error tracking (GitHub, in the United States): when something goes wrong, an error report is filed for our developers. Email addresses, phone numbers, long numbers, quoted values and record ids are removed from it first.
• Text messages (Twilio), only if texting is turned on: the phone number and the text.
• Address lookup (Google), only if it's turned on: the address being typed, to suggest matches.
• Typeface (Google Fonts): the app's font is loaded from Google, which receives your browser's network address.

Where it's stored

Gopher Boss's servers are in the United States. Your information, and your customers' information, is stored and processed there, and some of the service providers above also process it outside Canada.

While it's in the United States, it may be accessible to the courts, law enforcement and national security authorities of the United States under US law. If that changes, this policy will say so first.

Quebec: a privacy impact assessment of storing this information outside Quebec (section 17 of Quebec's Act respecting the protection of personal information in the private sector) is in progress.

How long we keep it

Each kind of information has one rule, applied automatically every night:

• Accounting records (invoices, payments, expenses, vendors, bills, loans, imported bank lines and the journal): kept for at least 7 years by design (the CRA requires 6); no rule deletes them automatically while the account exists. They're deleted only when the owner closes the account.
• Customers your business deletes: removed for good after 30 days, with their messages, unless an invoice names them.
• Customers of a business whose logins have all been turned off for 12 months: deleted, with their messages, unless an invoice names them.
• Emails and texts tied to a customer: 24 months. Emails and texts to people who aren't users and aren't tied to a record: 12 months.
• Error logs: 6 months. The administrators' audit log: 24 months. Sessions: until they expire. Records of sign-in attempts and sign-up counters: 1 day.
• Invitation, confirmation and reset links: 30 days after they expire. People who never chose a password (invited, or signed up and never confirmed): deleted 30 days after their last link expired. Beta invitations: 12 months.
• Interac e-Transfer notices: 18 months after they were recorded or dismissed, 24 months if never handled (the payment a notice made is an accounting record). Forwarded emails in our mailbox: 30 days once handled, 90 days if they couldn't be used. Gmail forwarding codes: 7 days.
• Fire inspection records, recurring invoice schedules, reminder records and the business's activity log: kept while the business exists, and deleted with their customer or when the account is closed.
• Backups: the newest 7 nightly copies, plus the newest 5 made before an update and 5 made by hand; older ones are deleted.

Closing the account: the owner is first offered every record to download and warned that nothing can be recovered; then everything the business has in the app is deleted at once. Copies in backups disappear as those backups are replaced.

How we protect it

Our safeguards include:

• two-step sign-in with an authenticator app, with single-use recovery codes;
• encryption in transit (HTTPS) between your browser and the app;
• passwords stored only as hashes, and keys and two-step secrets stored encrypted;
• each business sees only its own records, and each team member only what their role needs;
• automatic nightly backups, and a record of administrator actions.

No system is perfectly secure. If a breach creates a real risk of significant harm, we'll tell the people affected and the Privacy Commissioner of Canada, as the law requires.

Your books and the CRA

The CRA requires business records to be kept in Canada unless it authorizes another place in writing. Records kept outside Canada and reached electronically from Canada aren't considered kept in Canada. The CRA may accept a complete copy kept in Canada, and it recommends keeping backups in Canada. During the beta our servers are in the United States, so download your books from Money → Download for your accountant each month and save a complete copy on your own computer or storage in Canada. We can't promise the CRA will accept it in your case: ask your accountant. The app reminds owners each month.

Keeping your books is your business's responsibility: the CRA asks for 6 years from the end of the tax year they relate to.

CRA, IC05-1 Electronic Record Keeping

Messages your business sends (CASL)

Invoices, statements, payment reminders and other emails and texts sent through the app go to your customers on your business's behalf. Under Canada's anti-spam law (CASL), your business is responsible for having consent where a message needs it.

Payment reminders are off until the owner turns them on, can be turned off for any customer or invoice, and each reminder has a link the customer can use to stop them.

Seeing and correcting your information

People who sign in can change their password, two-step sign-in and language in the app, and owners can download the business's records at any time. To see, correct or get a copy of other personal information we hold about you, or to withdraw your consent, write to residentservice@jamesstreetchateau.com. We'll answer within 30 days.

If you're a customer of a business that uses Gopher Boss, contact that business first: it decides what it records about you. We'll help it answer.

You can also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.

Contact

Questions, requests or complaints about these pages or your information: write to our privacy contact at residentservice@jamesstreetchateau.com. Gopher Boss Inc..

We'll update this policy when the way the app handles information changes, and ask you to accept the new version in the app.