Privacy Policy
This policy explains how A913 Services Inc. (“we”, “us”), the company behind Todah, handles personal information. We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.
Two different roles. Todah holds two kinds of personal information, and our responsibilities differ for each:
Your account information — the details you give us to use Todah. We decide how this is used, and this policy governs it.
Your business records — the client names, invoices, receipts and bank entries you enter into your workspace. That information belongs to you. We store and process it on your instructions only, and we do not use it for our own purposes. If you are one of our customers’ clients and want your information corrected or removed, contact that business directly — we will assist them, but the records are theirs to control.
1. Who to contact
Questions about privacy, or a request to see or correct your information, go to our Privacy Officer:
- Attention: Privacy Officer, Legal
- Email: legal@todah.ca
- A913 Services Inc., Calgary, Alberta, Canada
2. What we collect, and why
| Information | Why we have it |
|---|---|
| Your name and email address | To create your account, sign you in, and send service messages such as password resets and email confirmations. |
| Your password | Stored only as a salted cryptographic hash. We cannot read or recover your password; we can only reset it. |
| Your company name, address, phone, logo and branding | To set up your workspace and put your branding on the documents you send. |
| Business records you enter — clients, vendors, invoices, quotes, bills, payments, bank transactions, and any files you upload | To provide the service. These may contain personal information about your clients and suppliers, which you control. |
| Activity log — which user took which action, and when | Security and accountability within your own workspace. No other customer can see it. Todah support staff can see it only while helping you (see section 9). |
| IP address | Held briefly in memory to rate-limit sign-in and signup attempts, which protects accounts from password-guessing. Also recorded when one of your clients accepts or declines a quote online, as evidence of who agreed. |
| Bank connection details (only if you connect a bank) | To bring in your transactions. The access credential from our bank-data provider is stored encrypted; it can only read transactions and can never move money. Disconnecting revokes it. |
| Two cookies | To keep you signed in securely. See section 7. |
We do not buy personal information, we do not sell or rent it, and we do not use your business records to build advertising profiles.
3. Consent
We collect and use your account information with your consent, given when you create a workspace and continue to use Todah. You may withdraw consent at any time by closing your account (section 8), subject to any records we must keep by law. Some information is necessary to provide the service at all — without an email address, for example, we cannot give you an account or let you reset a password.
We send service messages (password resets, email confirmations, notices about changes to the service or these policies) because they are necessary to provide Todah. We will only send you marketing or promotional email if you have given us separate, express consent, and every such message will include an unsubscribe link, as required by Canada’s Anti-Spam Legislation (CASL).
4. Where your information is stored
Todah’s database and uploaded files are stored in Canada (Montreal). The application servers that process your requests are in the United States, and several of the providers in section 5 are also based there, so your information is processed in the United States and may be accessible to courts and law enforcement under the laws of that country.
Information is encrypted in transit using HTTPS, and each business’s records are separated by row-level security in the database as well as by the application, so a request can only ever see its own workspace.
5. Service providers we share information with
We use a small number of providers to run Todah, and each receives only what it needs to do its job. By category, they are:
- Cloud hosting and database providers — to run the application (United States) and store your records (Canada).
- An email delivery provider — to send the messages you ask Todah to send, and service messages such as password resets.
- A payment processor — for your Todah subscription, and for card payments your clients make on your invoices.
- A bank-data provider — only if you connect a bank, to bring in your transactions.
- A push-notification service — only if you turn on notifications in the mobile app.
- An automated document-reading provider — only when you scan a document. See below.
Each is bound by contract to protect the information, to use it only to provide the service to us, and not to use it for their own purposes. We remain accountable to you for information in their hands. We will name any specific provider on request to a customer who asks.
Document scanning and cross-border processing
When you scan a receipt or bill, or import a bank statement as a PDF or photo, to be read automatically, that file is sent to an automated document-reading provider located in the United States to extract the text and figures, and the result is returned to Todah.
This means the contents of those documents — which may include names, addresses, account details and amounts — leave Canada during processing. While outside Canada, information may be accessible to foreign courts and law enforcement under the laws of that country.
Scanning is available on every plan, and a file is only sent when you choose to scan it. If you prefer that no document is read this way, enter bills manually and import statements as CSV files instead — those are never sent to a document-reading provider.
6. How long we keep it
We keep your information for as long as your workspace is open. When you delete your workspace, your company record and the data attached to it — users, clients, invoices, bills, bank transactions, attachments and activity log — are deleted from our live systems.
Deleting a workspace also cancels its Todah subscription and disconnects any connected banks. Where database backups exist, they are overwritten within 7 days, so deleted data may persist in a backup for up to that long. Before deleting, an owner or admin can download a CSV copy of all workspace records from Settings → Account & security; attached files are not included in that download.
7. Cookies
Todah sets two cookies, both strictly necessary: a session cookie that keeps you signed in, marked HttpOnly (unreadable by scripts) and Secure (sent only over HTTPS) and cleared when you sign out; and a security token that protects your account against cross-site request forgery.
We use no advertising, analytics or tracking cookies, and our pages load no third-party scripts, except our bank-data provider’s secure connection window, which loads only when you choose to connect a bank. There is nothing here to opt out of.
8. Your rights
Under PIPEDA you may:
- Access the personal information we hold about you and be told how it has been used and to whom it has been disclosed.
- Correct anything inaccurate — most of it you can edit yourself in Settings.
- Withdraw consent and close your account.
- Export your workspace records to CSV at any time: owners and admins, from Settings → Account & security.
- Complain to us, and if you are unsatisfied with our response, to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376).
Write to our Privacy Officer at the address in section 1. We will respond within 30 days, as PIPEDA requires. There is no charge for a reasonable request.
9. How we protect information
- Encrypted in transit over HTTPS.
- Passwords stored only as salted hashes, never in readable form.
- Each workspace’s records isolated at the database level.
- Two-step sign-in with an authenticator app, required before connecting a bank.
- Bank-connection credentials and two-step sign-in secrets encrypted at rest.
- Sign-in and signup attempts rate-limited against password guessing.
- Access to production systems limited to those who need it. Todah support staff can open your workspace only to help you, and every such access is recorded in your workspace’s activity log.
No system can be guaranteed completely secure. If a breach creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner as the law requires.
10. Children
Todah is business software and is not intended for anyone under 18. We do not knowingly collect information from children.
11. Changes to this policy
We may update this policy as Todah changes. The date at the top always shows the current version, and we will tell account holders by email about changes that materially affect how we handle personal information.