Privacy Policy

1. What we collect

Account details: your name, email, password (stored only as a secure hash) and two-step settings. The business data you and your team put into V+, which may include your customers’ and suppliers’ details. Billing details, handled by Stripe (we never see full card numbers). Support: your tickets, conversations with Victoria and emails to us.

On our website: the pages you visit, where you came from (the referring site or an ad), your country and type of device, counted with a random visitor id kept in a first-party cookie for up to 13 months. If we run Google Ads, Google’s tag may also set its own cookies to measure the ads. If you chat with Victoria and leave your name and email, we keep them with the conversation.

2. Why we use it

To provide, secure and support V+; to bill for it; to improve it; and to answer you. If you leave your email with Victoria or book a demo, we email you about V+: replies to your questions, a demo and trial. You can ask us to stop at any time, and every marketing email lets you unsubscribe.

3. Where it is kept and who helps us

Our database is in Canada (Supabase, Montréal region). Our application runs on Vercel, mainly in Montréal. Some providers we use may process information in the United States: Anthropic (the AI that reads documents and powers Victoria; it does not train on your data), Resend (email), Stripe (payments) and Google (ads, if used). They act on our instructions under contracts that protect your information.

We do not sell personal information.

4. QuickBooks Online connections (Intuit)

If you connect a QuickBooks Online company to bring its books into V+, you sign in at Intuit and choose the company; we never see your Intuit password. With your permission, V+ reads that company’s account list, customers, vendors, trial balances, journal activity and open invoices and bills. Access is read-only: V+ never changes anything in QuickBooks.

We use this information only to set up and check your company’s books in V+. It is stored in Canada with the rest of your books, is not sold or shared, and is never used to train artificial intelligence models. Intuit’s access key is kept encrypted and is deleted when you disconnect, which you can do at any time in V+ or in QuickBooks. Data already brought into your books stays there as part of your records until you delete it or your account ends.

5. Shopify stores

If you connect a Shopify store, you approve V+ in Shopify; we never see your Shopify password. V+ reads the store’s orders, refunds, payment terms, products, stock and locations. It does not change anything in your store. To book an order, V+ uses the buyer’s name and the province of the shipping address (for the sales tax), and, for an order on payment terms, the buyer’s email to keep their invoice under their own customer record.

We use this information only to keep your company’s books and stock. It is stored in Canada, is not sold or shared, and is never used for marketing or to train artificial intelligence models. When a store’s customer asks Shopify to erase their data, V+ removes their name from the store’s orders; invoices stay as your accounting records, as the law requires. Removing the V+ app from the store deletes its access key.

6. Bank connections (Plaid)

If you connect a bank or card account, V+ uses Plaid Inc. to do it. You sign in to your bank in Plaid’s window; we never see or keep your bank password. Plaid sends us the accounts, balances and transactions you choose to share, which we use only to keep your company’s books. Plaid’s own handling of your information is described in the Plaid End User Privacy Policy (plaid.com/legal), which you agree to when you connect.

You can disconnect a bank at any time in V+; we then remove the connection at Plaid and delete its access key. Transactions already recorded in your books stay there as part of your records.

7. How long we keep it

Your business data, while your account is open; after it ends we keep it for 12 months so you can export it or come back, then delete it; you can ask us to delete it at any time unless the law requires us to keep it. Accounting records may need to be kept by you for six years under Canadian tax law: export them before you leave. Website visit records, 13 months. Website conversations and contact details, up to 2 years unless you become a customer.

8. Your choices

You can ask to see, correct or delete your personal information, or withdraw consent to emails, by writing to our Privacy Officer at privacy@vorderai.com. We answer within 30 days. If you are not satisfied, you can contact the Office of the Privacy Commissioner of Canada.

9. Security

Information is encrypted in transit and at rest, access inside a company is limited by roles, every change to the books is recorded in an audit trail, and two-step verification is available for every account.

Bank connection keys are stored separately, encrypted, and are read only by our server. If a breach involving your personal information creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, and keep a record of every breach as PIPEDA requires.

10. Changes and contact

We will post any change here and, if it matters, tell you by email. Privacy questions: the Privacy Officer, privacy@vorderai.com, 1001648769 Ontario Inc. (operating as V+ Accounting), Toronto, Ontario.