01 Introduction
Taggr is an AI-assisted bookkeeping and transaction-categorization platform for accounting professionals. This Privacy Policy explains how Keuji Inc., which operates the Taggr platform (“Taggr”, “we”, “us”), handles personal information when accounting firms and their authorized users (each, a “Firm”) use the Taggr platform (the “Service”), and when a Firm’s clients (“Clients”) interact with the Client Portal.
We are committed to protecting personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy laws — including Alberta’s and British Columbia’s Personal Information Protection Acts (PIPA) and Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25) — and Canada’s Anti-Spam Legislation (CASL) for electronic communications.
02 Our Role: Who Controls the Information
Two roles, in plain terms. When we handle information about a Firm’s own account and users (billing, sign-in, support), Taggr is the organization in control of that information. When we handle a Firm’s Client Data — the bank statements, receipts, transactions and tax details a Firm uploads about its Clients — the Firm is the organization in control, and Taggr acts as its service provider, processing that information only on the Firm’s instructions to deliver the Service.
This means that where a Client wishes to exercise privacy rights over Client Data (such as access or correction), those requests are generally directed to, and handled by, the Firm as the organization with the primary relationship. We support Firms in responding to such requests. See Sections 12 and 13.
03 Personal Information We Collect
3.1 Firm and user information
- Account and profile data: full name, business email, phone number, role, firm/organization name, business identifier (Business Number), entity type and address.
- Authentication data: credentials, two-factor settings, and security logs.
- Billing data: plan, transaction history and payment method details (payment card numbers are handled by our payment processor, not stored by Taggr).
- Communications: support requests, correspondence and feedback.
3.2 Client Data processed on the Firm’s behalf
To provide bookkeeping and categorization, the Service processes information that a Firm (or, through the Client Portal, its Clients) provides, which may contain personal information about the Client and about individuals named in documents, including:
- bank and credit-card statements, account identifiers (institution, account type, last digits) and balances;
- transactions (dates, amounts, vendor names, descriptions, direction and nature), receipts, invoices and cheque images;
- tax details (GST/HST/PST/QST amounts, rates, province, input tax credits) and CRA/GIFI categorizations;
- Client Portal responses (for example, plain-language answers about whether a deposit is revenue, a refund, or the owner’s own money) and evidence uploads.
Note on sensitivity: financial information is sensitive and is treated as such. Firms are asked not to upload categories of highly sensitive personal information (such as health information or government identifiers) that are not needed for bookkeeping or tax purposes.
3.3 Technical and usage information
- Device, browser, IP address, log and diagnostic data, and how the Service is used (features, actions, review activity), collected automatically to operate, secure and improve the Service.
04 How We Collect Personal Information
We collect information: (a) directly from Firms and Authorized Users at registration and during use; (b) from documents and data Firms and their Clients upload; (c) through the Client Portal; (d) from connected third-party integrations you authorize (for example, QuickBooks Online, or bank-data aggregation); and (e) automatically through cookies and similar technologies (see Section 15).
05 Why We Use Personal Information
We use personal information for the following purposes, and only as reasonably necessary for them:
| Purpose | What this involves |
|---|---|
| Provide the Service | Ingest and read documents; categorize transactions; reconcile accounts; generate summaries, tax figures and exports; operate the Client Portal. |
| Automated processing | Run OCR and machine-learning models to extract data and suggest categories and tax treatments, with human review by the Firm (see Section 6). |
| Accounts & billing | Create and manage accounts, authenticate users, process subscriptions and payments. |
| Security & integrity | Detect, prevent and respond to fraud, abuse, security incidents and errors; keep audit logs. |
| Support & communication | Respond to requests and send service, security and administrative messages. |
| Improve the Service | Analyze usage and, using aggregated or de-identified data, develop and improve features and model accuracy (see Section 8). |
| Legal & compliance | Meet legal, regulatory, tax and professional obligations and enforce our terms. |
Consent. Under PIPEDA and provincial law, we rely on consent (express or implied, depending on sensitivity) and, where permitted, on other lawful bases such as performing a contract and legitimate business purposes. For Client Data, the Firm is responsible for obtaining any consent required from its Clients, and Taggr processes that data on the Firm’s instructions.
06 Automated Decision-Making and AI
The Service uses OCR and machine-learning models to read documents and to propose categorizations, tax treatments and reconciliations. These are suggestions for a professional to review; the Service is built around a human-in-the-loop workflow in which the Firm reviews, edits, flags and approves results. Taggr does not use these processes to make decisions that produce legal or similarly significant effects about an individual without human involvement by the Firm.
Consistent with Quebec’s Law 25, where personal information of a Quebec resident is used to render a decision based exclusively on automated processing, the affected individual has the right to be informed of it and of the personal information used, and to have the decision reviewed. Firms serving Quebec Clients should account for this in their own notices; Taggr will provide reasonable assistance.
We do not sell personal information, and we do not use identifiable Client Data to train models for the benefit of other customers except on the Firm’s instruction or with consent.
07 Service Providers and Sub-Processors
We share personal information with a limited set of trusted service providers who process it on our behalf, under contracts that require confidentiality, security safeguards, and use limited to providing services to us. Categories include:
| Category of provider | Purpose |
|---|---|
| Cloud hosting & infrastructure | Secure hosting, storage, backup and delivery of the Service. |
| AI / OCR processing | Document text extraction and machine-learning inference for categorization. |
| Accounting & bank-data integrations | Connections you authorize, such as QuickBooks Online (OAuth) and bank-data aggregation (e.g., Plaid). |
| Payment processing | Subscription billing and payment handling. |
| Communications & support | Transactional email, notifications and customer support tooling. |
| Analytics & monitoring | Product analytics, error monitoring and security tooling. |
A current list of sub-processors is available on request by contacting product@keuji.com. We may also disclose personal information: to comply with law or valid legal process; to protect our rights, users or the public; and in connection with a corporate transaction (merger, acquisition or asset sale), subject to appropriate protections.
08 Aggregated and De-Identified Data
We may create and use aggregated or de-identified information — information that cannot reasonably identify an individual, a Firm or a Client — to analyze usage, benchmark performance, and develop and improve the Service and its models. We handle de-identified information in accordance with applicable law, and do not attempt to re-identify it.
09 Where Your Information Is Stored and Processed
Taggr primarily stores Client Data on servers located in Canada. Some of our service providers (for example, certain AI/OCR, integration or infrastructure providers) may store or process personal information in the United States or other countries. When personal information is transferred to a service provider for processing, it remains subject to this Policy and to contractual safeguards, and it may be accessible to courts, law enforcement and authorities in the jurisdiction where it is processed. Where required (including under Quebec’s Law 25), we assess such transfers to confirm the information will receive adequate protection.
10 Data Retention
We retain personal information only as long as necessary for the purposes described in this Policy, to provide the Service to the Firm, and to meet legal, tax, accounting and audit requirements, after which we delete or de-identify it. Retention periods depend on the type of information and the Firm’s instructions.
Because Taggr supports bookkeeping and tax work, Firms are reminded that the Canada Revenue Agency generally requires books and records to be kept for six (6) years from the end of the last tax year to which they relate. Firms are responsible for retaining their own copies of records to meet these obligations; the Service is not the Firm’s statutory system of record unless separately arranged. On account termination, we provide an export window and then delete or de-identify Client Data as described in our terms, subject to routine backup cycles and legal holds.
11 How We Protect Personal Information
We maintain administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:
- encryption of data in transit and at rest;
- role-based access controls, least-privilege access and authentication (including two-factor authentication);
- audit logging of key actions (who did what, and when);
- network security, monitoring, and regular patching and review; and
- contractual and confidentiality obligations on personnel and service providers.
No method of transmission or storage is completely secure. While we work to protect personal information, we cannot guarantee absolute security.
12 Your Privacy Rights
Subject to applicable law and to verification of identity, individuals have rights in respect of their personal information, which may include:
- Access to the personal information we hold about them, and information about how it is used and disclosed;
- Correction of inaccurate or incomplete personal information;
- Withdrawal of consent (subject to legal or contractual restrictions);
- Portability and de-indexing and information about automated processing, where provided under Quebec’s Law 25; and
- Complaint to us and to the relevant regulator (see Section 18).
For Firm-account information, contact us directly. For Client Data, requests are generally routed through the Firm as the organization in control; if we receive such a request directly, we will refer it to the relevant Firm and assist as appropriate. We respond within the timelines required by law.
13 Information About a Firm’s Clients
If you are a Client of a Firm that uses Taggr, the Firm is responsible for its own privacy practices, for providing you notice, and for obtaining any consent required to use Taggr to process your information. Please direct questions about how your information is used first to your Firm. Taggr processes your information on the Firm’s behalf and under its instructions.
14 Breach Notification
We maintain procedures to detect and respond to security incidents. If a breach of security safeguards involving personal information occurs that creates a real risk of significant harm to individuals, we will notify the affected Firm(s) without undue delay so that they can meet their obligations, and we will notify regulators and individuals where we are required to do so under PIPEDA, Quebec’s Law 25 or other applicable law, and keep records of breaches as required.
15 Cookies and Similar Technologies
The Service uses cookies and similar technologies that are necessary to sign you in, keep the Service secure, remember preferences, and understand usage. You can control non-essential cookies through your browser or any in-product controls we provide.
16 Children’s Information
The Service is a business tool for accounting professionals and is not directed to children. We do not knowingly collect personal information directly from children.
17 Changes to this Policy
We may update this Policy from time to time. If we make a material change, we will provide notice (for example, by email or in-product notice) and update the “Last updated” date above. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.
18 Contact Us and How to Complain
Privacy questions, requests and complaints can be directed to our Privacy Officer:
Privacy Officer, Keuji Inc. (Taggr)
Calgary, Alberta, Canada
product@keuji.com
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or your provincial regulator (for example, the Office of the Information and Privacy Commissioner of Alberta or of British Columbia, or the Commission d’accès à l’information du Québec).
Les parties peuvent demander une version française de la présente politique. / A French-language version of this Policy is available on request.