We collect what the bookkeeping needs and nothing for advertising. Your bank password never reaches us. Your books are yours: export them any time, delete them any time. We do not sell data, and nobody here reads your ledger unless you ask us to look at something.
Who we are
Brasstally is operated by GENIE AI, Inc., a company incorporated in Ontario, Canada. For the purposes of Canadian privacy law we are the organisation accountable for the personal information described here. Our privacy contact is legal@genieai.ca.
What we collect
| What | Where it comes from | Why |
|---|---|---|
| Your email address | You, at sign-up | To identify your account and send sign-in links. It is the only contact detail we require. |
| Your ledger entries amounts, dates, descriptions, categories, parties, tax | You, or a bank feed you connect, or a receipt you upload | They are the product. Without them there are no books. |
| Receipts and invoices | You, by upload or photograph | To read the entry from, and to hold as the evidence behind a deduction. |
| Bank transactions and balances | Plaid, if you connect an account | To reconcile your books against what the bank actually shows. |
| Bank access tokens | Plaid | To request that data again on your behalf. Not your banking credentials. |
| Basic technical logs | Automatically, when you use the app | To keep the service running and to investigate faults. |
We do not collect your name, address, phone number, date of birth, social insurance number or business number, because the bookkeeping does not need them. If a future feature needs one, this policy will say so before that feature exists.
Why we are allowed to
Under Canada's Personal Information Protection and Electronic Documents Act and comparable provincial law, we rely on your consent, given when you create an account and again each time you connect a bank or upload a document.
Consent for a bank connection is separate and specific: it is given inside your bank's own flow, and you can withdraw it by disconnecting the account, which stops further access immediately.
Who else touches it
We use a small number of service providers. Each one gets only what its job needs.
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Database, authentication and file storage | Everything, as the store of record. |
| Plaid | Bank connections | Your banking sign-in, on your bank's own screen, and the transactions it returns. We never receive the credentials. |
| Anthropic | Reading receipts and answering questions in the app | The document or question you send, and the ledger context needed to answer it. |
| Vercel | Hosting | Request metadata and technical logs. |
| Resend | Sending email | Your email address and the message. |
We do not sell personal information, and we do not share it for advertising. There is no advertising in Brasstally and no advertiser can pay to appear in it.
We would disclose information if compelled by a valid legal order. If that ever happens and we are permitted to tell you, we will.
Where it lives
Data is stored in Canada where our providers offer it, and otherwise in the United States. Some processing therefore happens outside Canada, which means it can in principle be reached by the courts and authorities of that country. That is true of essentially every cloud service, and you are entitled to know it rather than discover it.
Access inside our own systems is restricted at the database level. Rows are scoped by user, so the database itself refuses to return another account's data rather than relying on the application to filter correctly.
How long we keep it
- While your account is open: everything, because tax records need years of history and deleting last year's books would defeat the purpose.
- When you reset a ledger: that ledger's entries and its files are deleted.
- When you delete your account: your rows and your uploaded files are removed. Backups roll off on their own cycle, within 30 days.
- Technical logs: weeks, not years.
Your rights
You can, at any time and without asking us:
- See everything. Every section of the app shows the underlying entries.
- Take it with you. Every section exports to CSV, including a full tax pack.
- Correct it. Every entry is editable.
- Delete it. Reset a ledger, or delete the account.
- Withdraw bank consent. Disconnect the account and access stops.
If you would rather we did any of that for you, or you want a copy in another format, write to legal@genieai.ca. We will respond within 30 days, which is the period Canadian law allows.
Automated processing
When you upload a receipt, its contents are sent to Anthropic's API and read by a model, which returns the vendor, amount, date, tax and a suggested category. When you ask Tally a question, the question and the ledger context needed to answer it are sent the same way.
Nothing is decided about you by that process. It fills in a form you then confirm, and every field remains editable. There is no profiling, scoring or automated decision-making that affects your rights.
Children
Brasstally is for running a business and is not directed at anyone under 18. We do not knowingly collect information from children.
Changes
If we change this policy in a way that affects you, we will say so in the app rather than quietly editing the page and changing the date. The date at the top always reflects the current version.
Complaints
Start with us: legal@genieai.ca. If we do not resolve it, you can complain to the Office of the Privacy Commissioner of Canada, or to your provincial commissioner in Alberta, British Columbia or Quebec.