Privacy Policy

For Jade Finance and the Jade Finance web app, operated by CIBINC.
Effective September 6, 2026.

The short version

Jade Finance stores the expenses, receipts and invoices you put into it so it can show them back to you. We do not sell your data, we do not share it with advertisers, and we do not track you across other apps or websites. You can delete your account, and everything in it, from inside the app at any time.

What we collect

Information you give us

Account details — your username, email address and password. Passwords are stored only as a bcrypt hash; we never hold the plain text and cannot recover it for you.
Expense records — the type, description, amount and date of each expense you enter, and the organization it belongs to.
Receipt images — photographs you take or choose from your photo library.
Invoices — invoice numbers and dates, line items, tax rates and totals, plus the client name, phone number and address you enter on each one.
Organization profile — your business name, phone, address, email, website, logo, tax number, payment terms and banking notes, where you choose to provide them for use on invoices.
Payroll records — if you use the payroll features of the web app, the employee details you enter: name, employee number, contact details, date of birth, start date, pay rate, tax information and bank information.

Information collected automatically

Authentication tokens — a signed token identifying your session, held on your device in the iOS Keychain or Android Keystore.
Server logs — ordinary web-server records including IP address, request path and timestamp, used to operate the service, diagnose faults and detect abuse.

What we do not collect

We do not use advertising identifiers, analytics SDKs or cross-app tracking, and we do not ask for App Tracking Transparency permission.
We do not collect your location.
We do not collect your contacts, calendar, microphone or health data.
Face ID, Touch ID and Android biometrics never reach us. Your device performs the check and tells the app only whether it succeeded. We never receive, and cannot access, your biometric data.

How we use it

Your information is used only to run the service:

To create and secure your account, and to sign you in.
To store, display, search, total and export your expenses and invoices.
To read the text on a receipt photograph so the app can suggest the amount for you.
To generate invoice and report PDFs.
To send transactional email: address verification and password resets.
To enforce free-plan limits and, if you upgrade, to unlock premium features.

We do not use your financial data to build advertising profiles, and we do not sell or rent it.

Service providers

Running the service means a small number of companies process data on our behalf. Each is bound to use it only for the purpose described here.

Provider	What it handles	Why
Amazon Web Services (S3, SES)	Receipt images; your email address	File storage, and sending verification and password-reset email
Google Cloud Vision	Receipt images, at the moment you attach one	Optical character recognition, so the app can read the total off a receipt
MongoDB Atlas	Account, expense, invoice and payroll records	Database hosting
Heroku (Salesforce)	All requests to the service	Application hosting

Receipt images sent to Google Cloud Vision are processed to extract text and are not used by Google to train its models under its standard terms for this API.

Who is responsible for your data

Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) requires us to name the person accountable for personal information. For CIBINC that is:

Sohrab behtoyi, Privacy Officer
lpo@cibinc.ca

You can contact them about access, correction, deletion, portability, or a complaint about how we handle your information.

Where your data is held

Our providers operate in the United States and other countries, so your information is stored and processed outside Quebec. Wherever it is held, it remains subject to this policy and to the contractual protections we require of each provider. Before relying on a provider outside Quebec we assess whether the information will receive adequate protection, as Law 25 requires.

How long we keep it

While your account exists — expenses, receipts, invoices and profile details are kept until you delete them or delete your account.
When you delete your account — your account record, your expenses, your invoices and your receipt images are permanently deleted. If you were the last member of your organization, that organization's expense types and payroll records are deleted too. This is immediate and cannot be undone.
Server logs — retained for a short period for security and troubleshooting, then discarded.
Backups — deleted records may persist in database backups for a limited period before those backups age out.

Your choices and rights

Access and correction — your data is visible and editable in the app.
Deletion — open the app, go to More → Delete account, and confirm with your password. On the web app, or if you cannot sign in, email us at lpo@cibinc.ca.
Export — expenses can be exported to CSV, and invoices and reports to PDF, at any time.
Withdrawing consent — you can stop using the service and delete your account at any time.

Because we operate from Quebec, Law 25 applies to your information, and Canada's PIPEDA applies to it as well when it crosses a provincial or national border. Together these give you the right to know what we hold, to correct it, to have it deleted, and — since September 2024 — to receive it in a structured, commonly used technological format, which the CSV and PDF exports provide.

If you are not satisfied with how we handle a request, you may complain to the Commission d'accès à l'information du Québec, or to the Office of the Privacy Commissioner of Canada. If you are in the EU or UK, the GDPR may give you further rights. Please write to us first and we will try to resolve it.

Security

Traffic is encrypted with HTTPS. Passwords are hashed with bcrypt. Session tokens are held in the operating system's secure storage on your device, and you can require Face ID, Touch ID or a fingerprint before the app will open. No system is perfectly secure, but we work to protect your information and to limit who can reach it.

If something goes wrong

If a confidentiality incident occurs that presents a risk of serious injury, we will notify you and the Commission d'accès à l'information as Law 25 requires, and record the incident in our register.

Children

Jade Finance is a business tool and is not directed at children. We do not knowingly collect information from anyone under 13. If you believe a child has created an account, contact us and we will remove it.

Changes to this policy

If we change this policy we will update the effective date above, and for material changes we will notify you in the app or by email before the change takes effect.

Contact

Questions about this policy, or about your data:
lpo@cibinc.ca
CIBINC, Quebec, Canada