Privacy policy

1. Who is responsible

Vector Accounting Technologies inc. is responsible for the personal information it holds. Under Quebec’s Law 25, our designated privacy officer is Martin Maheux, CPA, MBA, who can be reached at the address at the end of this policy. He is accountable for our compliance and answers access and correction requests personally.

2. Two different roles

We hold personal information in two capacities, and they carry different obligations. For your firm’s own users — names, work emails, roles, credentials — we determine the purposes, so we are responsible for it. For the client data your firm enters into TrackBeam, your firm decides what to collect and why; we process it on your behalf and act on your instructions. If one of your clients asks you about data in TrackBeam, the request belongs with your firm, and we will support you in answering it.

3. What we collect

• Account information: name, work email address, role and permissions, language preference, and authentication credentials stored in hashed form.
• Firm and engagement data: clients, engagements, tasks, services, budgets, rates, timesheet entries, approvals and invoices that your firm enters or generates.
• Technical and log information generated when the application is used, retained for security and troubleshooting.
• Information you send us directly, such as a demo request or a support message.

4. Why we use it

To provide TrackBeam and its features; to authenticate users and protect accounts; to calculate priority scores and projected costs; to produce invoices; to synchronize with the integrations your firm enables; to provide support; to meet legal and tax obligations; and to keep the service secure. We do not sell personal information, and we do not use your firm’s data to advertise to you.

5. Who we share it with

We use a small number of service providers, listed in full and kept current in our Trust Center. In summary: Microsoft Azure hosts the application and database in the Canada East region, in Quebec; Stripe processes your TrackBeam subscription payment; OpenAI processes pseudonymized data for the optional reporting assistant, and only where a firm has chosen to use it. We also disclose information where the law requires it. We do not disclose personal information for any other purpose without your consent.

Read the Trust Center

6. Information processed outside Quebec

Two of our providers process data outside Quebec. This is set out here explicitly. Stripe processes subscription payment information. OpenAI processes pseudonymized data — amounts, hours, rates, dates, task names, service names and roles, tied to internal codes rather than client identities — solely to operate the optional reporting assistant, which a firm switches on by choice. That data is not used to train OpenAI models. We do not have a confirmed zero-retention arrangement with OpenAI, and under standard API terms data may be retained for up to 30 days for abuse monitoring.

Because task names are free-text fields, a client name typed into a task name would be transmitted with the rest. We recommend that firms use client codes in task names. A privacy impact assessment covering this transfer has been completed.

7. How long we keep it

While your firm’s account is active, we keep the data needed to run the service. After cancellation, data is retained for two years, after which it is deleted. Before or during that period your firm can export recorded timesheets, with services and tasks, by user, as an Excel file. Some records may be kept longer where a legal or tax obligation requires it.

8. How we protect it

Traffic is protected with HTTPS/TLS. The database uses Azure SQL Transparent Data Encryption (AES-256). Automated backups provide a 30-day point-in-time restore window, and a test restore has been performed. Two-step verification is supported at sign-in, permissions are enforced server-side at the module level, and authentication is operated in-house rather than through a third-party identity provider. The Azure infrastructure all of this runs on holds SOC 2 and ISO 27001 certifications.

9. Your rights

Subject to the law, you may ask to access the personal information we hold about you, to have it corrected, to withdraw a consent you previously gave, to obtain your computerized personal information in a structured commonly used technological format, and to be informed about a decision based exclusively on automated processing. Write to our privacy officer and you will receive a response within the time limits set by law. If you are not satisfied with our response, you may file a complaint with the Commission d’accès à l’information du Québec.

10. Automated processing

TrackBeam calculates a priority score for tasks from stated rules applied to deadline proximity, client tier, projected cost against budget, and project risk. The scoring is rule-based; no language model is involved. It produces an ordering of work — it does not make employment decisions, and it does not act without a person. A person remains responsible for every decision taken from it.

11. Incidents

If a confidentiality incident presents a risk of serious injury, we will notify the Commission d’accès à l’information and the people concerned as required by law, and we maintain a register of incidents. We have not yet published a committed notification timeline; that policy work is under way and this section will state the commitment once it exists.

12. Cookies

TrackBeam uses a small number of strictly necessary cookies. They are described in our cookie policy. Cookie policy.

13. Changes

If we change this policy in a way that affects how we handle personal information, we will update the date below and inform account holders. Material changes to our list of service providers are reflected in the Trust Center as they happen.

14. How to reach us

Martin Maheux, CPA, MBA — Privacy Officer, Vector Accounting Technologies inc.
help@vectac.com

Vector Accounting Technologies inc.