Privacy Policy

1. Information we collect

Account information. When you create an account, we collect your name, email address, business name, business address, and login credentials for your AriBooks account. We do not collect or store your QuickBooks Online password — you connect to QuickBooks Online by signing in on Intuit's own page (see Section 4).

Payment information. No credit card is required to start your free trial. If you continue after the trial, subscription payments are processed by our third-party payment provider, Stripe. Stripe collects and handles your payment card details directly under its own terms and privacy policy; we do not collect or store your full card numbers. Current trial length and pricing are described in our Terms of Service, which also explain how pricing may change over time.

Business and financial information. To provide the Service, we read information from the accounting software you connect (currently QuickBooks Online), including invoice information, accounts receivable information, customer contact information (such as name, email address, and billing address), payment status, and related business records. We request these data points through the QuickBooks Online API to run the Service — this is the same information you already provide to QuickBooks Online today, and we do not ask you for anything additional. Where a given data point is not present in your QuickBooks Online account, we simply do not receive or collect it.

Communications information. Because AriBooks sends invoices, resends invoices when your clients request them, statements, banking details (where you choose to provide them), and follow-ups to your opted-in clients, and processes the replies those clients send back, we process information contained in those communications, including email content, client responses, communication history, and follow-up status. Emails we send to your clients on your behalf include a small tracking image that records whether the email was opened; this open status is shown to you in your AriBooks dashboard alongside that message and is not shared with anyone else.

Your clients' information. In providing the Service, we process personal information belonging to the clients you opt in — such as their name, email address, billing address, invoice details, the content of their replies, and any payment details you choose to upload to the billing portal. This is drawn from what is already in your QuickBooks Online account; where a data point is missing there, we do not receive it. We process this information on your behalf and on your instructions, as your service provider, solely to provide the Service; you remain responsible to your clients for it (see Section 8).

Technical information. We automatically collect certain technical information, including IP address, browser type, device information, usage activity, and log information. We keep you signed in using browser session storage and an authentication token, not cookies, and we use Google Analytics to understand website usage.

Analytics information. We use analytics tools to understand how people interact with our website and Service, including how visitors arrive, pages visited, and general usage patterns.

2. How we use information

We use information to: provide, operate, and improve the Service; connect you with supported integrations; maintain your accounts receivable report; generate summaries of client replies (see Section 3); send invoices, invoice resends, statements, banking details (where you provide them), and follow-up emails on your behalf under rules you set; process your subscription; provide customer support; maintain security; monitor performance; and communicate service updates.

3. Artificial intelligence

AriBooks uses artificial intelligence in one specific, limited way: to read incoming client replies, summarize them, and estimate a circle-back date — the date to resume follow-ups, based on what the client said. That is the only place AI is used.

The AI does not write or send any outbound messages to your clients. Every follow-up email uses a static template you set up and control.

We use OpenAI's API (currently the GPT-3.5-turbo model) to provide this feature. Under OpenAI's API data usage policy, data sent through the API is not used to train or improve OpenAI's models, and we do not separately use your data, or your clients' data, to train any AI models.

AI-generated summaries and circle-back dates are aids, not guarantees, and may not always be complete or accurate. The original reply is always retained, and you are responsible for reviewing summaries and dates before relying on them. The AI does not make any decisions with legal or similarly significant effects about any individual.

4. Information provided through integrations

You connect QuickBooks Online through Intuit's verified OAuth 2.0 sign-in, as part of the Intuit App Partner Program. You sign in on Intuit's own page, so we never see or store your QuickBooks Online password. Our access is read-only — we read invoice and customer information, and we never write to, change, or delete anything in your QuickBooks Online account.

Through this connection, we also receive information about your own business from your QuickBooks Online company profile — such as your company name, address, and other business account details — in addition to the invoice, accounts receivable, and client information described in Section 1.

Your use of QuickBooks Online remains governed by your agreement with Intuit, and we handle Intuit data in accordance with Intuit's developer requirements.

5. The billing portal

Clients you opt in can access a secure billing portal to view and download their invoices and see a statement of account. From the platform, you may also send invoices, resend an invoice when a client requests it, send statements of account, and (where you choose to provide them) send banking details, in addition to follow-ups. Where a client pays online, the portal displays a secure link so they can pay the way they normally would; there is no new payment setup, and we are not part of the payment flow. You may also optionally choose to upload payment or bank details (for example, so clients can pay you by offline bank transfer / EFT); whether to do this is entirely your choice. If you choose to upload such details, you are responsible for that decision and for the details you provide, including making them available to your opted-in clients through the portal. We store and display them so your opted-in clients can view them, but we do not process, hold, or transfer any funds and are not a payment processor — payments are made directly between you and your client.

6. How we share information

We do not sell your information or your clients' information.

Service providers. We share information only with the third-party providers needed to run the Service, which currently include: Amazon Web Services (hosting and database, in Canada — see Section 9), Stripe (payment processing), Intuit (the QuickBooks Online integration), our email-delivery provider, OpenAI (which powers the reply-summarization feature described in Section 3), and Google Analytics (website analytics). These providers only receive the information necessary to perform their services and are bound to protect it.

Business transfers. If AriBooks is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. We will require that it remain protected in accordance with this Privacy Policy.

Legal requirements. We may disclose information where required by law or where necessary to protect our rights, our security, or our users.

Changes to providers. We may update our service providers from time to time; material changes will be reflected in this Policy.

Third-party sites. Our website and Service may link to third-party sites (such as Intuit or Stripe); those sites are governed by their own privacy policies, not this one.

7. Data security

We use reasonable technical and organizational measures designed to protect your information, including: encryption in transit (TLS 1.2 or higher) and at rest (AES-256, the default for our AWS database and storage services); access controls and least-privilege limits on who can access data, including multi-factor authentication on internal and administrative systems; audit logging of data access; a read-only connection to QuickBooks Online (we never receive your password); one-time email verification (OTP) for billing portal access; hosting with a major cloud provider (AWS) in Canada; routine backups, including backup encryption and periodic recovery testing; ongoing vulnerability management and dependency patching; and separation of our production and non-production environments. Our personnel are subject to security training and confidentiality obligations, and we maintain an incident-response process with defined timelines. We restrict access to personal information to those who need it to operate the Service.

No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security. If a breach affecting your information occurs, we will notify you and any regulators as required by applicable law. To report a security concern, contact us at support@aribooks.com.

8. Your responsibilities

You are responsible for ensuring you have the right to provide us with information relating to your clients, and to contact the clients you opt in, consistent with applicable law including Canada's Anti-Spam Legislation (CASL) and privacy laws. If you choose to upload payment or bank details to the billing portal, you are responsible for that decision.

9. Where your data is stored

Your data is hosted on Amazon Web Services in the Canada (Central) region, located in Montreal, Canada. Some service providers — such as our payment processor, analytics provider, and AI provider — may process limited information outside Canada, primarily in the United States; where they do, that information remains protected by contract.

10. Data retention and deletion

We retain information only for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Disconnecting QuickBooks Online (available any time from Settings) stops the connection and pauses further data collection, but does not by itself delete your existing data. To request deletion of your account data — and your clients' data — submit a written request to support@aribooks.com. Once we receive your request, we will process it and permanently delete the remaining data from our active systems within 30 days, except anything we are required to keep by law or reasonably need to retain to establish or defend legal claims or to prevent fraud or abuse; residual copies in routine backups are purged on our normal backup cycle. We handle Intuit data in accordance with Intuit's requirements.

11. Your rights

Subject to applicable law, you may:

• request access to the personal information we hold about you;
• request correction of inaccurate information;
• request deletion of your information;
• withdraw consent (which may limit our ability to provide the Service); and
• make a complaint to a privacy regulator.

If you are a client of one of our customers, please direct requests about your information to that business; we support our customers in responding. To make a request about your own account, contact us at support@aribooks.com. We may need to verify your identity before responding, and we will respond within the timeframes required by applicable law. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

12. Canadian privacy law

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable Canadian privacy laws. Our Privacy Officer is accountable for our compliance with this Policy and can be reached at support@aribooks.com.

13. Children

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

14. Our emails to you

We may send you service and transactional emails necessary to operate your account (such as login, trial, and billing notices). If we send marketing emails, they will comply with Canada's Anti-Spam Legislation (CASL) and include a way to unsubscribe. You cannot opt out of essential service emails while you have an active account.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date, and for material changes we will provide reasonable notice.

16. Contact us

If you have questions about this Privacy Policy, contact us at support@aribooks.com — 1001502179 Ontario Inc. (o/a AriBooks), Toronto, Ontario, Canada.