Privacy Policy

For Jade Finance and the Jade Finance web app, operated by Consultation Behtoyi Inc.
Effective October 3, 2026.

The short version

Jade Finance stores the expenses, receipts and invoices you put into it so it can show them back to you. We do not sell your data, we do not share it with advertisers, and we do not track you across other apps or websites. If you sign in with Apple or Google, all we receive is your email address and a name — never your password with them. You can delete your account, and everything in it, from inside the app at any time.

What we collect

Information you give us

Account details — your username, email address and password. Passwords are stored only as a bcrypt hash; we never hold the plain text and cannot recover it for you. An account created with Apple or Google has no password at all.
Sign in with Apple or Google — if you choose one of these instead of a password, that company tells us your email address, a permanent identifier for you within Jade Finance, and the name you agree to share. We store those three things and, for Apple, a token that exists solely so we can cancel the connection when you delete your account. We never receive your Apple or Google password. If you use Apple's Hide My Email, we only ever see the relay address Apple gives us, never your real one. Signing in this way also tells us your address is genuine, so there is no verification email to wait for.
Expense records — the type, description, amount and date of each expense you enter, and the organization it belongs to.
Receipt images — photographs you take or choose from your photo library.
Invoices — invoice numbers and dates, line items, tax rates and totals, plus the client name, phone number and address you enter on each one.
Organization profile — your business name, phone, address, email, website, logo, tax number, payment terms and banking notes, where you choose to provide them for use on invoices.
Payroll records — if you use the payroll features of the web app, the employee details you enter: name, employee number, contact details, date of birth, start date, pay rate, tax information and bank information.

Information collected automatically

Authentication tokens — a signed token identifying your session, held on your device in the iOS Keychain or Android Keystore.
Server logs — ordinary web-server records including IP address, request path and timestamp, used to operate the service, diagnose faults and detect abuse.

What we do not collect

We do not use advertising identifiers, analytics SDKs or cross-app tracking, and we do not ask for App Tracking Transparency permission.
We do not collect your location.
We do not collect your contacts, calendar, microphone or health data.
Face ID, Touch ID and Android biometrics never reach us. Your device performs the check and tells the app only whether it succeeded. We never receive, and cannot access, your biometric data.

How we use it

Your information is used only to run the service:

To create and secure your account, and to sign you in.
To store, display, search, total and export your expenses and invoices.
To read the text on a receipt photograph so the app can suggest the amount for you.
To generate invoice and report PDFs.
To send transactional email: address verification and password resets.
To enforce free-plan limits and, if you upgrade, to unlock premium features.

We do not use your financial data to build advertising profiles, and we do not sell or rent it.

Service providers

Running the service means a small number of companies process data on our behalf. Each is bound to use it only for the purpose described here.

Provider	What it handles	Why
Amazon Web Services (S3, SES)	Receipt images; your email address	File storage, and sending verification and password-reset email
Google Cloud Vision	Receipt images, at the moment you attach one	Optical character recognition, so the app can read the total off a receipt
Apple (Sign in with Apple)	Your email address and an identifier, only if you choose this sign-in	Proving who you are without a password, and cancelling that connection when you delete your account
Google (Sign in with Google)	Your email address, name and an identifier, only if you choose this sign-in	Proving who you are without a password
MongoDB Atlas	Account, expense, invoice and payroll records	Database hosting
Heroku (Salesforce)	All requests to the service	Application hosting

Receipt images sent to Google Cloud Vision are processed to extract text and are not used by Google to train its models under its standard terms for this API.

Who is responsible for your data

Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) requires us to name the person accountable for personal information. For Consultation Behtoyi Inc that is:

Sohrab Behtoyi, Privacy Officer
lpo@cibinc.ca

You can contact them about access, correction, deletion, portability, or a complaint about how we handle your information.

Where your data is held

Our providers operate in the United States and other countries, so your information is stored and processed outside Quebec. Wherever it is held, it remains subject to this policy and to the contractual protections we require of each provider. Before relying on a provider outside Quebec we assess whether the information will receive adequate protection, as Law 25 requires.

How long we keep it

While your account exists — expenses, receipts, invoices and profile details are kept until you delete them or delete your account.
When you delete your account — your account record, your expenses, your invoices and your receipt images are permanently deleted. If you were the last member of your organization, that organization's expense types and payroll records are deleted too. This is immediate and cannot be undone.
Server logs — retained for a short period for security and troubleshooting, then discarded.
Backups — deleted records may persist in database backups for a limited period before those backups age out.

Your choices and rights

Access and correction — your data is visible and editable in the app.
Deletion — open the app, go to More → Delete account, and confirm with your password, or by signing in again with Apple or Google if that is how you joined. Deleting removes your records and receipt images, and where you signed in with Apple we also tell Apple to cancel the connection, so Jade Finance disappears from the list in your Apple ID settings. On the web app, or if you cannot sign in, email us at lpo@cibinc.ca.
Export — expenses can be exported to CSV, and invoices and reports to PDF, at any time.
Withdrawing consent — you can stop using the service and delete your account at any time.

Because we operate from Quebec, Law 25 applies to your information, and Canada's PIPEDA applies to it as well when it crosses a provincial or national border. Together these give you the right to know what we hold, to correct it, to have it deleted, and — since September 2024 — to receive it in a structured, commonly used technological format, which the CSV and PDF exports provide.

If you are not satisfied with how we handle a request, you may complain to the Commission d'accès à l'information du Québec, or to the Office of the Privacy Commissioner of Canada. If you are in the EU or UK, the GDPR may give you further rights. Please write to us first and we will try to resolve it.

Security

Traffic is encrypted with HTTPS. Passwords are hashed with bcrypt. Session tokens are held in the operating system's secure storage on your device, and you can require Face ID, Touch ID or a fingerprint before the app will open. No system is perfectly secure, but we work to protect your information and to limit who can reach it.

If something goes wrong

If a confidentiality incident occurs that presents a risk of serious injury, we will notify you and the Commission d'accès à l'information as Law 25 requires, and record the incident in our register.

Children

Jade Finance is a business tool and is not directed at children. We do not knowingly collect information from anyone under 13. If you believe a child has created an account, contact us and we will remove it.

Changes to this policy

If we change this policy we will update the effective date above, and for material changes we will notify you in the app or by email before the change takes effect.

Contact

Questions about this policy, or about your data:
lpo@cibinc.ca
Consultation Behtoyi Inc, Quebec, Canada