Privacy policy

This policy explains how IAPZ Technology Inc. ("IAPZ", "we", "us") collects, uses, shares and protects personal information when you use our website, iapz.com, and the IAPZ apps at app.iapz.com, including IAPZ Cashflow, and the choices and rights you have.

In short:

• We collect only what we need to answer you and to run the IAPZ apps.
• We don't sell your personal information, and we don't use it for advertising.
• Your financial records in IAPZ Cashflow are private to you. We don't publish, sell or share them, and we don't use them to train AI models.
• Our website uses no cookies and no tracking or statistics tools.

---

1. Information we collect

On our website (iapz.com)

• When you use the contact form: your name, email address and message. We use them to reply to you.
• Technical information: like any website, our hosting and network providers receive your IP address and browser details when you visit, to deliver pages and protect against attacks.

In the IAPZ apps (app.iapz.com)

• Account details: your name, email address, time zone and preferred format for dates and amounts. Your password is stored only in a scrambled ("hashed") form that can't be turned back into the password.
• If you log in with Google: your name, email address and profile picture from Google.
• Two-step verification: if you turn it on, the key for your authenticator app and your backup codes, both stored encrypted.
• IAPZ Cashflow records: the accounts, balances, transactions and repeating transactions you enter or import, your exchange-rate choices, and saved import settings. When you import a file, we read its rows into your records and keep the file's name with the import; we don't keep the file itself.
• Security information: when and from which IP address and browser you log in, and records of repeated attempts, used to keep your account safe and to limit attempts to guess passwords or codes.

2. How we use your information

We use personal information to:

• reply to your messages and discuss projects you ask us about;
• create and run your account, and let you log in securely;
• provide the IAPZ apps, for example working out your cashflow forecast from the records you enter;
• send emails you need, such as links to choose or reset your password;
• keep IAPZ secure, and prevent spam, fraud and abuse;
• provide support, and fix problems you report;
• meet legal obligations.

We rely on your consent for these uses (express consent where required), and where the law allows, on our legitimate business needs or legal obligations. We'll ask before using your information for anything new.

3. Your IAPZ Cashflow records

• Your Cashflow records are private to your account. Nothing from them is shown to anyone else.
• Our team doesn't browse your records. We look at them only when needed to help you with a request you've made, to fix a problem, or to meet a legal obligation.
• We don't sell your records, share them with other businesses, or use them to train AI models.
• Exchange rates come from the Bank of Canada's public rates. Fetching them sends no information about you.

4. Who we share information with

We don't sell personal information and don't share it for others' advertising.

We share information only:

• With service providers who help us run IAPZ, under terms that require them to protect it and use it only for us:

Provider	What they do
DigitalOcean	Hosting the website and the apps, and the database
Cloudflare	Our domain's DNS, and security for some of our addresses
Resend	Sending emails, including contact form messages to us
Google	"Continue with Google", if you choose it, and our own email

We'll add providers here before we start using them.

• For legal reasons: to comply with the law, respond to valid legal requests, protect people's safety, or enforce our terms.
• In a business transfer: if IAPZ is sold or reorganized, information may be transferred to the new owner, who must continue to protect it.

5. Where your information is stored

IAPZ is based in British Columbia, Canada. The apps' information, including your Cashflow records, is stored with DigitalOcean in Toronto, Canada. Some service providers (such as for email) process information in Canada, the United States or other countries. When information is stored or processed outside your province, state or country, it may be subject to the laws of that place, including access by authorities there. We choose providers with strong protections.

6. How long we keep information

Information	Kept for
Contact form messages	As long as needed to reply and to keep a record of our conversation
Account details and Cashflow records	While your account is open
Logins (sessions)	Until you log out or they expire
Records of repeated attempts	Only as long as needed to count them
Backups of the apps' database	Up to 7 days, then overwritten

When you ask us to close your account, we delete your personal information and Cashflow records within 30 days, except what we must keep for legal reasons, and backups, which expire on their normal schedule.

7. Cookies

• Our website (iapz.com) uses no cookies.
• The IAPZ apps use only essential cookies: to keep you logged in, to complete two-step verification, and, if you choose "trust this device", to skip the code on that device for 30 days. We don't use advertising or tracking cookies.

8. How we protect your information

We use industry-standard safeguards, including encrypted connections (HTTPS) everywhere, a database reachable only by our app, hashed passwords, encrypted two-step keys, optional two-step verification (required for our admins), limits on attempts to guess passwords and codes, and access limited to people who need it. No system is perfectly secure. If a privacy breach creates a real risk of significant harm, we'll notify you and the authorities as the law requires.

9. Your choices and rights

Depending on where you live, you have the right to:

• access the personal information we hold about you, and get a copy, including your Cashflow records;
• correct inaccurate information (your name, time zone and format can be changed in Settings);
• delete your account and information;
• withdraw consent at any time;
• in some places, data portability, and to not be discriminated against for using your rights.

Canada: you have rights under federal and provincial privacy laws (including PIPEDA, BC's PIPA and Quebec's Law 25). You can also complain to the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.

United States: residents of some states (for example California) have additional rights under state privacy laws. We don't sell or "share" personal information for cross-context advertising.

To use your rights or ask a question, contact us (Section 12). We'll respond within the time required by law (usually within 30 days) and may need to confirm your identity first.

10. Emails

• Account and security emails (such as password links) are part of the service.
• We don't send marketing emails. If we offer them in future, it will be only with your consent, with an unsubscribe link in every one.

11. Children

IAPZ is for people 18 and older (or the age of majority where they live). We don't knowingly collect information from anyone younger. If you believe a young person has given us their information, contact us and we'll delete it.

12. Contact us

Person in charge of the protection of personal information: President
IAPZ Technology Inc.
British Columbia, Canada
Contact: our contact form (mention "privacy" in your message)

13. Changes to this policy

We may update this policy. We'll post the new version here with its date and, for important changes, tell account holders by email or in the app before they take effect.