Privacy Policy

1001502179 Ontario Inc., operating as AriBooks ("AriBooks," "we," "us," or "our"), respects your privacy and is committed to protecting the information entrusted to us by our customers and their clients.

This Privacy Policy explains how we collect, use, disclose, and protect information when you use our software platform and related services (the "Service"). AriBooks is based in Toronto, Ontario, Canada, and is intended for business use.

1. Information we collect

Access requests. When you request access to AriBooks through our website, we collect your name, email address, business name, estimated client count, location, and accounting software, along with your acceptance of this Privacy Policy and our Terms of Service. We keep a record of that acceptance, including the date and time, which version of these documents you agreed to, and your IP address and browser information, so we have a reliable record of consent.

Account information. When you create an account, we collect your name, email address, business name, and login credentials for your AriBooks account. You may also provide your business address directly, at any time, in Settings; it is used on documents like your Statement of Account. We do not collect or store your accounting software password. You connect your accounting software (currently QuickBooks® Online) by signing in on the official provider page (see Section 4).

Payment information. No credit card is required to start your free trial. If you continue on a paid plan, subscription payments are processed by our third-party payment provider, Stripe. Stripe collects and handles your payment card details directly under its own terms and privacy policy; we do not collect or store your full card numbers. Current trial length and pricing are described in our Terms of Service, which also explain how pricing may change over time.

Business and financial information. To provide the Service, we read information from the business tools you connect, which include accounting software (currently QuickBooks Online), CRM tools, and project-management tools, including invoice information, accounts receivable information, customer contact information (such as name, email address, and billing address), payment status, and related business records. Where the connected tool is accounting software, AriBooks reads from it for these purposes and only writes short summary notes back. We request these data points through the connected tool's API to run the Service; this is the same information you already provide to that tool today, and we do not ask you for anything additional. Where a given data point is not present in your account, we simply do not receive or collect it.

Notes we write back. As part of the Service, we write short summary notes back to the connected client record: for example, a brief summary of a client's reply, a message that was sent, or a status update. Where the connected tool is accounting software, these are written into the customer/client record; where you connect a CRM or project-management tool, the same notes may be surfaced there for coordination. These notes are generated from activity already described in this Policy so your records stay current. Once a note is written back, it becomes a record in the connected tool and can be viewed, edited, overwritten, or deleted by you, your team, other applications you connect, or the provider, in ways outside our control; we are not responsible for what happens to a note after write-back or for how the connected tool logs or retains it. You can review these notes, and we log when a write-back succeeds or fails (see "Communications information" below).

Communications information. Because AriBooks sends statements of account, banking details (where you choose to provide them), and, for clients you opt in, automated statements of account and related communications, and processes the replies your clients send back, we process information contained in those communications, including email content, client responses, communication history, and send status. AriBooks does not send or resend invoices. Emails we send to your clients on your behalf include a small tracking image that records whether the email was opened; this open status is shown to you in your AriBooks dashboard alongside that message and is not shared with anyone else. We also receive delivery status from our email-delivery provider (including whether a message was delivered, bounced, or failed, and the reason given), and we log whether each note write-back to your connected tools succeeded or failed, so both you and we can see and resolve delivery and sync problems.

Your clients' information. In providing the Service, we process personal information belonging to your clients synced from your connected tools, such as their name, email address, billing address, invoice details, and, for the clients you opt in, the content of their replies and any payment details you choose to upload to the Billing Portal. For clients you do not opt in, they are left as they were before you used AriBooks: no Billing Portal, no messages sent through AriBooks, and no replies read or summarized. This is drawn from what is already in your connected account; where a data point is missing there, we do not receive it. We process this information on your behalf and on your instructions, as your service provider, solely to provide the Service; you remain responsible to your clients for it (see Section 8).

Technical information. We automatically collect certain technical information, including IP address, browser type, device information, usage activity, and log information. We use browser storage to remember your display preferences.

Analytics information. We use Umami, a cookieless, privacy-focused analytics tool, to understand how visitors interact with our marketing website, including how visitors arrive, pages visited, and general usage patterns.

2. How we use information

We use information to: provide, operate, and improve the Service; connect you with supported integrations; maintain your accounts receivable report; generate summaries of client replies (see Section 3); write summary notes back to your connected tools; send statements of account, banking details (where you provide them), and, for clients you opt in, automated statements of account and related communications on your behalf under rules you set; monitor email delivery and note-sync status so problems can be surfaced and resolved; process your subscription; provide customer support; maintain security; monitor performance; and communicate service updates.

3. Artificial intelligence

AriBooks uses artificial intelligence in one specific, limited way: to read incoming client replies, summarize them, and estimate a resume date, the date to resume scheduled communications, based on what the client said. That is the only place AI is used.

The AI does not write or send any outbound messages to your clients. Every scheduled message uses a static template you set up and control. Where a summary note is written back to your connected tools, it is derived from this summarization and remains under your review.

We use OpenAI's API (currently the GPT-3.5-turbo model) to provide this feature. Under OpenAI's API data usage policy, data sent through the API is not used to train or improve OpenAI's models, and we do not separately use your data, or your clients' data, to train any AI models.

AI-generated summaries and resume dates are aids, not guarantees, and may not always be complete or accurate. The original reply is always retained, and you are responsible for reviewing summaries and dates before relying on them. The AI does not make any decisions with legal or similarly significant effects about any individual.

4. Information provided through integrations

You connect your business tools through the provider's verified sign-in: for QuickBooks Online, the Intuit® OAuth 2.0 sign-in, as a member of the Intuit Developer platform. You sign in on the official provider page, so we never see or store your accounting software password. Connected tools include accounting software (currently QuickBooks Online), CRM tools, and project-management tools.

Where the connected tool is accounting software, our access only ever reads invoice, accounts receivable, and client information from it, and writes short summary notes back to the connected customer/client record (described in Section 1). We do not otherwise change or delete your existing records, and we do not read your own business profile; your business name is set when your account is created, and any business address you'd like shown on your documents is provided directly by you in Settings (see Section 1).

Your use of any connected tool remains governed by your agreement with that provider, and we handle any data accessed through it in accordance with the provider's developer requirements (for QuickBooks Online, the Intuit developer requirements).

5. The Billing Portal

Clients you opt in can access a secure Billing Portal to view and download their invoices, and request an emailed statement of account. Clients you do not opt in have no Billing Portal and are left as they were before you used AriBooks. From the platform, you may also send statements of account and (where you choose to provide them) send banking details, in addition to automated statements of account and related communications for clients you've opted in; AriBooks does not send or resend invoices. Where a client pays online, the Billing Portal displays a secure link so they can pay the way they normally would; there is no new payment setup, and we are not part of the payment flow. You may also optionally choose to upload payment or bank details (for example, so clients can pay you by offline bank transfer / EFT); whether to do this is entirely your choice. If you choose to upload such details, you are responsible for that decision and for the details you provide, including making them available to your clients through the Billing Portal. We store and display them so your clients can view them, but we do not process, hold, or transfer any funds and are not a payment processor. Payments are made directly between you and your client.

6. How we share information

We do not sell your information or your clients' information.

Service providers. We share information only with the third-party providers needed to run the Service, which currently include: Amazon Web Services (hosting and database, in Canada; see Section 9), Stripe (payment processing), Intuit (the QuickBooks Online integration), our email-delivery provider, OpenAI (which powers the reply-summarization feature described in Section 3), and Umami (website analytics). These providers only receive the information necessary to perform their services and are bound to protect it.

Business transfers. If AriBooks is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. We will require that it remain protected in accordance with this Privacy Policy.

Legal requirements. We may disclose information where required by law or where necessary to protect our rights, our security, or our users.

Changes to providers. We may update our service providers and supported integrations from time to time; material changes will be reflected in this Policy.

Third-party sites. Our website and Service may link to third-party sites (such as Intuit or Stripe); those sites are governed by their own privacy policies, not this one.

7. Data security

We use reasonable technical and organizational measures designed to protect your information, including: encryption in transit (TLS 1.2 or higher) and at rest (AES-256, the default for our AWS database and storage services); access controls and least-privilege limits on who can access data, including multi-factor authentication on internal and administrative systems; audit logging of account, infrastructure, and data-change activity; a scoped connection to your accounting software limited to reading your records and writing summary notes (we never receive your password); one-time email verification (OTP) for Billing Portal access; hosting with a major cloud provider (AWS) in Canada; routine backups, including backup encryption and periodic recovery testing; ongoing vulnerability management and dependency patching; and separation of our production and non-production environments. Our personnel are subject to security training and confidentiality obligations, and we maintain an incident-response process with defined timelines. We restrict access to personal information to those who need it to operate the Service.

No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security. If a breach affecting your information occurs, we will notify you and any regulators as required by applicable law. To report a security concern, contact us at support@aribooks.com.

8. Your responsibilities

You are responsible for ensuring you have the right to provide us with information relating to your clients, and to contact your clients, consistent with applicable law including Canada's Anti-Spam Legislation (CASL) and privacy laws. If you choose to upload payment or bank details to the Billing Portal, you are responsible for that decision.

9. Where your data is stored

Your data is hosted on Amazon Web Services in the Canada (Central) region, located in Montreal, Canada. Some service providers, such as our payment processor, analytics provider, and AI provider, may process limited information outside Canada, primarily in the United States; where they do, that information remains protected by contract.

10. Data retention and deletion

We retain information only for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Disconnecting a connected tool (available any time from Settings) stops that connection and pauses further data collection from it, but does not by itself delete your existing data. To request deletion of your account data, and your clients' data, an account owner or admin can request it directly from Settings, or you may submit a written request to support@aribooks.com. Requesting deletion immediately restricts further use of your account while the request is processed, and can be cancelled from that same screen before deletion is carried out. Once we receive your request, we will process it and permanently delete the remaining data from our active systems within 30 days, except anything we are required to keep by law or reasonably need to retain to establish or defend legal claims or to prevent fraud or abuse; residual copies in routine backups are purged on our normal backup cycle. We handle any data accessed through your connected tools in accordance with that provider's requirements (for QuickBooks Online, Intuit requirements).

11. Your rights

Subject to applicable law, you may:

• request access to the personal information we hold about you;
• request correction of inaccurate information;
• request deletion of your information;
• withdraw consent (which may limit our ability to provide the Service); and
• make a complaint to a privacy regulator.

If you are a client of one of our customers, please direct requests about your information to that business; we support our customers in responding. To make a request about your own account, contact us at support@aribooks.com. We may need to verify your identity before responding, and we will respond within the timeframes required by applicable law. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

12. Canadian privacy law

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable Canadian privacy laws. Our Privacy Officer is accountable for our compliance with this Policy and can be reached at support@aribooks.com.

13. Children

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

14. Our emails to you

We may send you service and transactional emails necessary to operate your account (such as login, trial, and billing notices). If we send marketing emails, they will comply with Canada's Anti-Spam Legislation (CASL) and include a way to unsubscribe. You cannot opt out of essential service emails while you have an active account.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date, and for material changes we will provide reasonable notice.

16. Contact us

If you have questions about this Privacy Policy, contact us at support@aribooks.com, 1001502179 Ontario Inc. (o/a AriBooks), Toronto, Ontario, Canada.