Privacy Policy

ExpenIQ is a record-organization, documentation and accountant-handoff tool for self-employed people and small businesses in Canada. The service is operated by Adithhya Sivakumar, a sole proprietor in Ontario, Canada.

The person accountable for our privacy practices is the ExpenIQ Privacy Officer. For privacy questions, access requests, corrections, complaints and deletion requests, write to privacy@expeniq.com. That mailbox is monitored.

We do not yet publish a mailing address for privacy correspondence. Arranging one is part of the outstanding work described at the top of this page. Until it is published, please use the email address above.

ExpenIQ organizes records. It does not provide legal, tax, accounting or audit advice, and it does not decide what you can claim. Final tax treatment depends on your facts, applicable law, CRA guidance and your own qualified professional.

This notice applies to:

• your use of expeniq.com, including the public pages;
• private-beta accounts opened for approved users;
• early-access requests sent to us by email;
• privacy and support messages you send us;
• the financial and business records approved users enter;
• receipts and other documents approved users upload;
• authentication and account information; and
• application, security and diagnostic information about how the service runs.

ExpenIQ is currently in a private beta. Accounts are opened individually and there is no public self-service sign-up.

We collect only what the service needs in order to work.

Asking for early access is not an application we can promise to fill. We use what you send to assess your request and may contact you about possible beta participation. Sending a request does not guarantee access, does not set a date, does not create a priority, and does not reserve a place. We use what you send only for the purposes in the table above.

Information about other people.Your records will often contain other people's information: a client name on an invoice, a supplier name on a receipt, names printed on documents you upload. We do not ask for it separately and we do not use it for anything except storing and displaying your records to you. You decide what goes into your records.

Cookies and device storage.ExpenIQ uses no advertising cookies, no analytics cookies and no third-party tracking. We use sign-in cookies that keep you authenticated, one preference cookie that remembers which of your businesses you are viewing, and your browser's local storage for your light or dark theme choice and whether you dismissed the install prompt. The theme and install-prompt settings stay on your device and are never sent to us.

When you sign in, your password is sent from your browser to ExpenIQ's own sign-in endpoint, which passes it to our authentication provider to be checked. It passes through our server infrastructure in the course of that request.

When you set a new password after a reset, it goes from your browser directly to our authentication provider. It does not pass through ExpenIQ's servers.

In both cases we do not intentionally log your password, and ExpenIQ does not store it in readable form — the stored credential is held by our authentication provider.

These are two different things, and we describe them separately on purpose. Storing information in Canada and processing it in Canada are not the same claim, and this notice does not make the second one.

• Stored in Canada. Your business and financial records, your receipt and document files, and your authentication records are stored in our database, file storage and authentication service, all hosted in the Canada Central region.
• Processed on hosting infrastructure whose location we are confirming. ExpenIQ uses Vercel to host and deliver the application. Static public pages and assets may be served through Vercel's content-delivery network. When you use authenticated features or API routes that need your information — for example viewing a receipt or generating an export — the relevant record values or file bytes are processed by Vercel-hosted application infrastructure while that request is handled. Your sign-in password also passes through ExpenIQ's hosted sign-in route before it is sent to our authentication provider. We do not use Vercel as the system of record for this information. Request or runtime logs may retain limited technical information according to the project configuration and provider terms. This processing may occur outside Canada.
• Request logs. Request logs may include technical information such as IP address, browser user agent, request path and timestamp. These may be held outside Canada.
• Fault reports. When the application fails, a technical fault report goes to our error-monitoring provider. We configure error monitoring to minimize default personal-information collection and do not use session replay or performance tracing. Fault reports can still contain diagnostic context, which may include personal information. These reports may be processed outside Canada.
• Account emails.Confirmation and password-reset messages are sent through our authentication provider's built-in email service. The message contains your email address and a one-time link. That delivery infrastructure may be located outside Canada.
• Messages you send us are received in our business email system, whose data location we are still confirming.

What processing outside Canada means for you. Information handled in another country is subject to the laws of that country. That includes the possibility that courts, law enforcement or national security authorities there could compel access to it, and no contract we sign can override those laws. We tell you this so the trade-off is visible rather than buried.

The active providers and provider-managed services currently verified for this notice are listed below. We will update this list if that changes. Where we have not yet confirmed a provider's processing location from that provider directly, we say so instead of guessing.

Why some cells say "being confirmed".How long these providers keep request logs, fault reports and mailbox contents is governed by each provider's configuration and the applicable provider terms. We have not yet confirmed those periods or, for some providers, the processing location. We will publish them once confirmed rather than print an estimate here.

No AI or OCR provider receives your records. ExpenIQ has no optical character recognition, AI categorization or document-analysis feature operating on customer records today, and no third party receives your receipts, documents or financial records for those purposes or for model training. We are not promising that ExpenIQ will never add such a feature. We are promising that if we do, we will update this notice and tell you before it is switched on.

We do not sell, rent or trade your information, and we share your records with the providers above only so they can run the service. We may disclose information where permitted or required by applicable law, including in response to valid legal process or an emergency involving an individual's life, health or security.

• Your records and files — while your account is open, and until they are removed as described in section 8.
• Your account and profile — until your account is closed.
• Change history— ExpenIQ keeps a change history of your financial records so a record's history can be shown and changes cannot be quietly rewritten. Those entries include copies of the record values before and after each change. See section 8.
• Fair-use counters — kept alongside your account and removed with it.
• Backups — our database is backed up daily and each backup is kept for a short rolling window before it expires. Backups do not include the stored receipt files. See section 8.
• Request logs, fault reports and email— kept by the providers in section 6, for periods governed by each provider's configuration and the applicable provider terms.
• Messages you send us — kept in our email system for as long as we need them to answer you and to keep a record of the request.

We will not promise deletion we cannot perform. This is the honest position.

What you can remove yourself, today:

• Receipts and documents. You can delete a receipt. The service attempts to remove both the receipt record and the stored file. Because those are currently two separate steps, file cleanup can fail after the record is removed. This path needs further work before we can offer it as a guarantee.
• Draft expenses. You can delete an expense while it is still a draft and nothing else depends on it.
• Proof links. You can detach a document from a capital asset without deleting the document.

What is archived rather than removed: income entries, expenses that are no longer drafts, vehicle logs, workspace and home-office records, and capital assets are archived. Archiving hides a record from your working views and marks it as no longer active. It does not erase it.

What has no self-service removal today: GST/HST snapshots, the businesses you have set up, and your profile and account. To remove any of these, or to close your account entirely, write to privacy@expeniq.com. Account closure is currently a manual process that we are still documenting and testing, so we do not promise a completion time for it yet.

Limits that apply to any deletion:

• Backups. Deleted information can remain inside existing backups until those backups expire. Backups exist so we can recover from a disaster, and we may restore one if we have to. A restore can reintroduce records deleted after the backup was taken. We do not promise that deleted information can never reappear.
• Change history. The change history in section 7 contains copies of your record values. It is deliberately not editable or deletable from inside the application, because a change history you can rewrite is not a change history. When an account is closed we remove the direct link between those entries and the account, but the entries and the values inside them remain. We are not claiming they become anonymous.
• Uploaded files. Once a file is successfully deleted from our file storage we cannot recover it. Our file storage keeps no version history and our database backups do not include stored files. Keep your own copies of anything you need.
• Provider logs and fault reports.Entries already written into our hosting provider's request logs or our error-monitoring provider's fault reports sit on those providers' systems. Removing an individual entry may be limited by what the provider allows, by its retention settings, and by applicable legal obligations.

If you want to know what would remain after a deletion request, ask us at privacy@expeniq.com and we will describe the position for your account.

We use safeguards appropriate to how sensitive financial records are. In outcome terms:

• ExpenIQ is designed so your account reaches only your own records, and that separation is enforced by the database itself, not only by the application.
• Receipt and document files are kept in private storage. They are not given a public web address, and they are served to you through ExpenIQ rather than by handing your browser a direct link to the storage system.
• We verify that you are signed in on protected requests.
• We limit how many uploads, exports and sign-in attempts can be made in a short window, to blunt abuse.
• Traffic between your browser and ExpenIQ is encrypted.
• We keep a change history of financial records, which is not editable or deletable from inside the application.

No service can promise perfect security, and we do not. What we can say is that we treat a security or privacy problem as more urgent than a new feature, and that we will tell you when we are required to.

ExpenIQ does not currently charge users or process payments. There is nothing here about subscriptions, renewals, refunds or payment processors because there is nothing to describe. If that changes, we will publish the terms and update this notice before any charge.

If a security breach involving your personal information creates a real risk of significant harm to you, we will report it to the Office of the Privacy Commissioner of Canada and notify you as soon as feasible after we determine that it has happened. Our notice will describe what happened, what information was involved, what we have done and what you can do. Where another organization could reduce the harm, we will notify them too. We keep a record of every breach of our security safeguards, whether or not it is reportable, and we provide those records to the Commissioner on request.

• Access — ask what personal information we hold about you, how we have used it and to whom we have disclosed it, and get a copy.
• Correction — challenge the accuracy or completeness of that information and ask us to correct it.
• Deletion — ask us to remove records and close your account, subject to section 8 and to anything we are required by law to keep.
• Questions about consent — ask what you are agreeing to, or withdraw your agreement. Depending on what consent is withdrawn, we may be unable to provide some or all of the service. We will explain the consequences before acting.
• Complaint — see section 13.

How to ask. Write to privacy@expeniq.com. We will respond with due diligence and in any case within 30 days. In the limited circumstances the law allows — for example where meeting that deadline would unreasonably interfere with our operations, or where we need to consult further — we may extend by up to a further 30 days; if we do, we will tell you inside the first 30 days, explain why, and give you the new date. We may need to verify your identity before releasing information. There is no charge for a routine request; if a request would be unusually costly we will tell you before doing the work so you can narrow or withdraw it.

If you are unhappy with how we have handled your information, tell us first — write to privacy@expeniq.com. We will acknowledge your complaint, look into it, and tell you what we found and what we did.

You can also complain to the Office of the Privacy Commissioner of Canada. The OPC asks you to try to resolve the issue with the organization first, and may not be able to accept a complaint if you have not done so.

• We do not sell, rent or trade your data.
• We do not share your records with advertisers, data brokers or analytics companies — we use none.
• We do not use your records to train AI models.
• We do not provide legal, tax, accounting or audit advice.
• We do not guarantee CRA acceptance of any claim, deduction or filing.
• We do not charge you or hold payment information.

We will update this notice as ExpenIQ changes, and we expect it to change again when counsel review is complete. The version and last-updated date are at the top of this page. If we make a material change — particularly to what we collect, who receives it, or how long we keep it — we will post the change here before it takes effect and take reasonable steps to notify you directly.