Privacy Policy

LogisAI Corporation (407 Iroquois Shore Rd, Unit 8, Suite V40, Oakville, Ontario L6H 1M3, Canada) operates the service. Write to [email protected] about anything in this policy.

We play two roles. For the information that makes up your account — who you are, how you sign in, what you did in the application, what you pay — we decide how and why it is processed, so we are the controller (in Canadian terms, the organisation accountable for it). For the contents of your books and documents — receipts, bills, bank statements and the records built from them, which name your suppliers, customers and employees — the firm or business that uploaded them decides why they are processed, and we process them on its instructions as a service provider. If your information appears in a customer's documents and you want to exercise a right over it, the customer is the right first contact; we help them respond.

• Account information. Your name where you give it, email address, a one-way hash of your password (never the password), two-step verification secrets stored encrypted, your role, the firm or business you belong to, its jurisdiction, and for a firm the city and region shown in the firm directory.
• Books and documents. The files you upload or email in and everything the service extracts and derives from them — vendors, amounts, dates, line items, account coding, reconciliations, statements — which routinely include other people's names, addresses, account numbers and sometimes government identifiers printed on the documents.
• Usage and security logs. IP address, browser and device details, timestamps, the pages and actions you take, and a request identifier for every call to our servers. The application's activity trail records who did what to the books and is part of the accounting record.
• Support and contact messages. What you write to us through the application, this website's contact and waitlist forms, or email, with the request identifier of anything that failed.
• Billing information. Your plan, usage quantities (pages processed, books closed, storage) and payment status. Card details are entered on our billing provider's page and never reach our servers.

We do not collect precise location, biometric data, or data from data brokers.

• to provide the service you signed up for: keep the books, reconcile the bank, produce reports, and let the people you authorise work on them;
• to run the AI agent on your documents, as described in section 5;
• to secure the service: authenticate you, detect abuse, investigate incidents and keep an audit trail the law requires of accounting records;
• to bill you and meter usage;
• to send you transactional email — invitations, password resets, notifications you have chosen, security notices — and to answer support requests;
• to contact you about early access if you joined the waitlist, and about nothing else;
• to meet legal obligations and to establish or defend legal claims.

We do not sell personal information, we do not use it for advertising, and we do not use your documents or books to train artificial-intelligence models.

Canada. Under PIPEDA and substantially similar provincial laws we rely on your consent: the express consent you give at signup, and the implied consent that comes with asking us to keep your books, which necessarily involves processing the information in them. You can withdraw consent by closing your account, subject to the record-keeping obligations in section 8. Where Quebec's private-sector privacy law applies, the person responsible for the protection of personal information is reachable at [email protected].

United States. We process account information to perform our contract with you and for the legitimate interests of running and securing a financial service. State privacy laws such as California's generally exempt information collected in a business-to-business context and information already governed by financial privacy law; where a state law does apply to you, the rights in section 11 are how you exercise it, and we do not "sell" or "share" personal information as those laws define the terms.

The agent runs on models operated by Anthropic and Google (Gemini), reached through our own masking gateway. Text we send — prompts built from document text, extracted fields and the books — first has Social Security numbers, Employer Identification numbers and bank account numbers replaced by tokens; the real values stay in an encrypted vault on our servers and the model's answer is translated back here. Images we send — PDF pages and photos of receipts, so the model can read them — are not redacted, so whatever is printed on the page reaches the provider. Names and addresses in text are not yet masked either. Both providers are used through their commercial APIs under terms that forbid training on our inputs and outputs, and we do not train models on your data ourselves.

What the model proposes is checked by deterministic rules and, where it is material, sent to a person. Nothing is filed with a tax authority and no money moves without a human authorisation on record.

• People you authorise. Your team members, within the roles you give them, and the accounting firm you engage, within the engagement — or, for a firm, the staff you add and the clients whose books you work on.
• Sub-processors. The companies that host the service, deliver email, run the models, meter billing and settle payments, listed with what each receives at theaccountsai.com/legal/subprocessors. In brief:

• Authorities and courts, when the law requires it or a valid legal process compels it; we tell you unless we are prohibited from doing so.
• A successor, if LogisAI Corporation is acquired or merges, under this policy or one at least as protective, with notice to you.

The service runs and stores data in Oracle Cloud Infrastructure's Ashburn, Virginia region in the United States, with Cloudflare's global network carrying traffic to it. The model providers process in the United States.

If you are in Canada, your information is therefore stored and processed outside Canada, where it is subject to the laws of the United States, including lawful access by courts and authorities there. We protect it with the contractual and technical measures described here regardless of where it sits, but we cannot exempt it from foreign law. Canadian-resident hosting is on our roadmap and not available today.

• Books and documents: as long as your account is open and for the statutory minimum after the period a record belongs to — seven years for books under United States jurisdiction, six for Canada — or longer if your business sets a longer retention period or places a legal hold. A business owner can request deletion from the portal; the service shows what can be removed and what must be kept and why, and a 14-day cooling period runs before anything is deleted. Deletion removes file contents; the ledger entries and the activity trail remain as part of the accounting record.
• Account information: while your account exists, and for up to 30 days after it closes so you can export, then as needed to meet the obligations above.
• Security and usage logs: 13 months, longer where an investigation requires it. The in-application activity trail is kept with the books.
• Support and contact messages: for the life of your account; waitlist and contact-form submissions for 24 months or until you ask us to remove them.
• Backups: encrypted copies expire on a rolling schedule after the live data is deleted.

We use only what is strictly necessary to sign you in and keep you signed in. The customer portal sets one first-party cookie, accountsai_refresh, which holds your session's refresh credential; it is HttpOnly, Secure, SameSite=Strict and scoped to the sign-in endpoints, and it is cleared when you sign out. The applications also keep your short-lived session token and preferences such as language and layout in your browser's local storage.

There are no analytics, advertising or third-party tracking cookies on this website or in the applications. This marketing site sets no cookies at all; its contact and waitlist forms post straight to our own servers.

Our pages load their typefaces from third-party font services. They receive none of your account or financial data, but fetching a font file reveals your IP address and browser details to them, as any web request does:

• Google Fonts — on this website, the accountant console and the customer portal.
• Fontshare (Indian Type Foundry) — on the accountant console and the customer portal.

Wherever you are, you can ask us to tell you what personal information we hold about you, correct it, delete it, give you a copy in a portable form, and stop using it for a purpose you object to; and you can withdraw consent you have given. Much of this you can do yourself: your profile and two-step settings are in the application, documents and reports can be exported from the portal, and a business owner can request deletion from the records settings.

For anything else, write to [email protected]. We will verify that the request comes from you — usually by replying to the email on your account — and answer within 30 days, or tell you why we need longer. Deletion is subject to the record-keeping obligations in section 8; where we must keep something we tell you what and why. We never charge for a request unless the law allows it and the request is plainly excessive, and we never retaliate against anyone for making one.

If you are unhappy with our answer you may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner, or to your state attorney general in the United States. We would rather hear from you first.

Data is encrypted in transit with TLS 1.3 and at rest; credentials and the identifier vault carry an additional layer of field-level encryption; every database query runs behind row-level security scoped to your organisation; the ledger and decision log are append-only; access is role-based and denied by default; every upload is scanned for malware; and encrypted backups are taken nightly to a separate location. The details, and a plain list of what is not built yet, are on our security page. If a security incident affects your personal information we notify you without undue delay, and the privacy regulator where the law requires it.

The service is for businesses and accounting practices and is not directed at anyone under 18. We do not knowingly collect personal information from children; if you believe a child has given us some, write to [email protected] and we will delete it.

When we change this policy we post the new version here with its effective date, and for a material change we email the owner of each account at least 30 days beforehand. Earlier versions are available on request.

LogisAI Corporation
407 Iroquois Shore Rd, Unit 8, Suite V40, Oakville, Ontario L6H 1M3, Canada
Privacy: [email protected]

Or use the contact form.