Privacy Policy

Effective Date: 2026-08-10
Last Updated: 2026-08-10

QanaFinance is operated by QanaFinance Inc., a Canadian company ("QanaFinance," "Qana," "we," "us" or "our"). QanaFinance provides cloud-based accounting and financial-management software for businesses.

We recognize that the information entrusted to QanaFinance may include sensitive personal, business and financial information. Protecting that information is an important part of how QanaFinance is designed and operated. This Privacy Policy explains how we collect, use, disclose, protect, retain and manage personal information when individuals use QanaFinance, our websites, applications, integrations and related services.

1. Scope

This Privacy Policy applies to personal information collected through:

• QanaFinance accounts;
• QanaFinance websites;
• applications;
• accounting software;
• bank integrations;
• payment integrations;
• customer-support interactions;
• communications;
• product registrations;
• trials;
• subscriptions; and
• other services operated by QanaFinance.

This Policy does not govern the independent privacy practices of third-party services such as banks, Stripe, Plaid or other providers. Those organizations maintain their own privacy policies and legal obligations.

2. Privacy Principles

QanaFinance manages personal information according to the following principles:

• accountability;
• appropriate purpose;
• transparency;
• meaningful consent where required;
• limiting collection;
• limiting use and disclosure;
• appropriate retention;
• accuracy;
• security safeguards;
• access and correction rights; and
• responsible disposal.

QanaFinance will not intentionally collect personal information simply because it is technically possible to collect it. We seek to collect and use information that is reasonably necessary to operate, secure and improve the services requested by our users.

3. Information We Collect

Depending upon how QanaFinance is used, we may collect the following categories of information.

3.1 Account Information

This may include:

• name;
• email address;
• telephone number;
• organization name;
• job title;
• user role;
• login information;
• authentication information;
• account preferences; and
• subscription information.

3.2 Business Information

Customers may provide business information such as:

• legal business name;
• operating name;
• business address;
• contact information;
• tax numbers;
• fiscal year information;
• accounting preferences;
• chart of accounts;
• business settings; and
• other organizational information.

Some business information may not constitute personal information, but we may nevertheless protect it as confidential Customer Data.

4. Accounting and Transaction Information

QanaFinance may process financial and accounting information supplied or authorized by Customers, including:

• invoices;
• bills;
• expenses;
• estimates;
• journal entries;
• account balances;
• bank transactions;
• credit-card transactions;
• payment records;
• customers;
• vendors;
• accounting categories;
• tax information;
• reconciliations;
• financial statements;
• project or job costing information;
• receipts;
• supporting documents; and
• other accounting records.

Some accounting information may contain personal information relating to employees, customers, contractors, vendors or other individuals.

5. Bank-Connection Information

Where a Customer chooses to connect a financial account through an integrated provider such as Plaid, QanaFinance may receive authorized financial information including:

• financial institution name;
• account name;
• account type;
• masked account identifier;
• account balance;
• transaction date;
• transaction amount;
• transaction description;
• merchant information;
• pending or posted status; and
• other authorized account information supported by the provider.

QanaFinance does not require ownership or custody of funds in a connected bank account. QanaFinance does not intentionally request or permanently store users' online-banking passwords, PINs or security answers. Bank authentication should be completed through the financial institution, Plaid or another supported financial-connectivity provider.

6. Payment Information

QanaFinance may integrate with payment providers such as Stripe. Where a Customer enables payment functionality, QanaFinance may receive information concerning a payment, including:

• transaction identifier;
• invoice identifier;
• payment amount;
• payment date;
• payment status;
• payment method type;
• processing fees;
• refunds;
• disputes;
• chargebacks;
• settlement information; and
• other information supplied by the payment provider.

QanaFinance does not hold Customer invoice proceeds. Payment providers process payment transactions according to their own terms and privacy practices. QanaFinance generally receives the information necessary to record and reconcile those transactions within the accounting system.

7. Documents and Files

Users may upload documents to QanaFinance including:

• receipts;
• invoices;
• bills;
• bank statements;
• credit-card statements;
• CSV files;
• PDF files;
• contracts;
• supporting accounting records; and
• other business documents.

Users are responsible for ensuring they have appropriate authority to provide these documents to QanaFinance. QanaFinance may process uploaded documents to extract, categorize, organize, store or reconcile information.

8. Employee and Third-Party Information

Customers may enter information relating to individuals who are not direct QanaFinance account holders. Examples include:

• employees;
• contractors;
• customers;
• vendors;
• suppliers;
• bookkeepers;
• accountants; and
• customer contacts.

The Customer is responsible for ensuring it has an appropriate legal basis or authority to collect and provide that information to QanaFinance. QanaFinance processes such information primarily on behalf of the Customer in providing the Service.

9. Technical and Usage Information

We may automatically collect technical information required to operate and secure the Service, including:

• IP address;
• browser type;
• device information;
• operating system;
• login date and time;
• session information;
• security events;
• error logs;
• application activity;
• feature usage; and
• system-performance information.

This information may be used for:

• security;
• fraud prevention;
• troubleshooting;
• service operation;
• system reliability;
• product analytics; and
• service improvement.

10. Audit Log Information

Because QanaFinance is an accounting platform, we may maintain audit records concerning activity within an organization. Audit records may include:

• user identity;
• date and time;
• action performed;
• transaction affected;
• original value;
• changed value;
• login event;
• approval;
• reconciliation activity; and
• other material accounting or administrative actions.

Audit information may be retained where reasonably necessary to preserve accounting integrity, security or legal records. Users should not expect that every action affecting accounting records can be permanently erased from audit history.

11. Why We Collect and Use Information

QanaFinance may collect and use information to:

• establish and manage accounts;
• provide accounting functionality;
• process Customer instructions;
• import bank transactions;
• operate bank connections;
• integrate with payment providers;
• process uploaded files;
• generate invoices and reports;
• maintain accounting records;
• perform reconciliations;
• provide automation;
• provide customer support;
• authenticate users;
• protect account security;
• prevent fraud and abuse;
• maintain audit trails;
• troubleshoot technical issues;
• operate and improve the Service;
• administer subscriptions;
• communicate important service information;
• comply with legal obligations; and
• enforce applicable agreements.

We will not use personal information for an unrelated purpose without appropriate authority, consent or other lawful basis where required.

12. Artificial Intelligence and Automated Processing

QanaFinance may use artificial intelligence, machine learning or automated systems to assist with functions such as:

• extracting information from documents;
• transaction categorization;
• matching transactions;
• reconciliation suggestions;
• anomaly detection;
• account coding suggestions;
• descriptions;
• reporting;
• workflow automation; and
• support functions.

Where AI functionality is used, QanaFinance should seek to limit information provided to the information reasonably necessary for the relevant function. Customer financial information must not automatically be treated as public information. QanaFinance will not sell Customer financial records for the purpose of training unrelated third-party artificial-intelligence products. Where third-party AI providers are used, QanaFinance will seek to configure and contract for those services in a manner appropriate to the sensitivity of the information involved. Material accounting decisions generated through automation may require user review or confirmation depending upon the nature of the action.

13. Consent

Where consent is required, QanaFinance will seek consent that is appropriate to the sensitivity of the information and the circumstances in which it is collected, used or disclosed. Consent may be:

• express;
• implied where permitted by law; or
• provided through authorized Customer instructions.

Certain processing is necessary in order to provide the Service. For example, QanaFinance cannot provide a requested bank feed without processing the bank information the user has authorized for that purpose. Where optional processing is offered, users may be provided with an appropriate choice.

14. Customer Authorization

An organization administrator may authorize QanaFinance to process information on behalf of that organization. Authorized administrators may also:

• invite users;
• assign roles;
• connect integrations;
• connect bank accounts;
• configure organization settings; and
• determine access permissions.

Individuals should contact their organization's administrator regarding access controlled by that organization.

15. Information We Do Not Intend to Collect

Unless specifically required for a supported service, QanaFinance does not seek to collect:

• complete online-banking passwords;
• banking PINs;
• banking security-question answers;
• unrelated medical information;
• unrelated government identification documents;
• biometric information; or
• other sensitive information unrelated to QanaFinance's accounting services.

Users should avoid uploading unnecessary sensitive information.

16. How We Share Information

QanaFinance does not sell Customer accounting records or bank transaction information to data brokers. We may disclose information in the circumstances described below.

17. Service Providers

We may use service providers to operate portions of QanaFinance. These may include providers of:

• cloud hosting;
• data storage;
• cybersecurity;
• authentication;
• payment processing;
• bank connectivity;
• email;
• customer support;
• monitoring;
• analytics;
• document processing;
• artificial intelligence; and
• other infrastructure.

Service providers should receive access only to information reasonably necessary to perform their services. QanaFinance seeks to use contractual and technical safeguards appropriate to the nature of the information being processed.

18. Stripe

Where Customers choose to use Stripe integrations, information required to support payment functionality may be exchanged between QanaFinance and Stripe. Stripe acts independently with respect to payment processing activities governed by its own terms and privacy practices. QanaFinance may use Stripe transaction information to update:

• invoices;
• payment records;
• accounting entries;
• fees;
• refunds;
• reconciliation information; and
• payment status.

19. Plaid

Where Customers choose to connect financial accounts through Plaid, information may be exchanged between QanaFinance and Plaid as necessary to establish and maintain the requested bank connection. Access is subject to:

• Customer authorization;
• financial-institution availability;
• Plaid's services;
• applicable permissions; and
• applicable law.

Customers may disconnect supported bank connections. Disconnecting a bank feed does not necessarily delete accounting transactions that have already been imported into QanaFinance because those transactions may form part of the Customer's accounting records.

20. Legal Disclosures

QanaFinance may disclose information where reasonably necessary to:

• comply with applicable law;
• respond to lawful court orders;
• respond to legally valid government demands;
• protect the legal rights of QanaFinance;
• investigate fraud;
• respond to security threats;
• protect users or the public;
• enforce agreements; or
• establish, exercise or defend legal claims.

Where legally permitted and reasonably practical, QanaFinance will seek to limit disclosures to the information required.

21. Business Transactions

If QanaFinance or QanaFinance Inc. is involved in a merger, acquisition, financing, restructuring, sale or other business transaction, information may be disclosed as permitted by applicable privacy law. Appropriate confidentiality protections should be applied during such transactions. Any successor receiving personal information will be expected to respect applicable privacy obligations.

22. We Do Not Sell Customer Financial Data

QanaFinance does not sell Customers' accounting records, banking transactions, invoices or business financial information to third parties for third-party advertising. QanaFinance does not permit third parties to independently use Customer financial records to market unrelated products directly to individuals merely because those records are stored in QanaFinance.

23. Advertising

QanaFinance is a business software platform. If QanaFinance uses advertising or marketing analytics on public-facing websites, those technologies should be kept appropriately separated from sensitive authenticated accounting areas. Sensitive accounting and bank-transaction information should not be used to create third-party behavioural advertising profiles.

24. Marketing Communications

QanaFinance may send marketing communications where permitted by applicable law. Individuals may unsubscribe from marketing messages using the unsubscribe mechanism provided with those communications. Unsubscribing from marketing does not prevent QanaFinance from sending important non-marketing communications such as:

• security alerts;
• password notifications;
• billing notices;
• service announcements;
• legal notices; and
• account-related communications.

25. Cookies and Similar Technologies

QanaFinance websites and applications may use cookies and similar technologies for purposes such as:

• authentication;
• security;
• remembering preferences;
• session management;
• functionality;
• performance; and
• analytics.

Where consent is legally required for particular technologies, QanaFinance will provide appropriate choices. Essential security and authentication technologies may be necessary for the Service to operate.

26. Security

QanaFinance recognizes that financial information can be highly sensitive. We use administrative, technical and organizational safeguards appropriate to the information being protected. Safeguards may include:

• encryption in transit;
• encryption at rest where appropriate;
• secure authentication;
• role-based permissions;
• multi-factor authentication;
• access controls;
• secure credential storage;
• audit logging;
• monitoring;
• backups;
• vulnerability management;
• security testing;
• API security;
• webhook verification;
• session security; and
• incident-response procedures.

No system connected to the internet can guarantee absolute security.

27. Passwords and Credentials

User passwords must not be stored in readable plaintext. Where passwords are managed by QanaFinance, they must be stored using accepted secure password-protection methods. Sensitive credentials such as:

• Stripe secrets;
• Plaid access tokens;
• integration credentials;
• API keys; and
• authentication secrets

must be appropriately protected and restricted from unauthorized access. Sensitive credentials must not be exposed through standard application logs or normal user interfaces.

28. Access Controls

QanaFinance may allow organization administrators to assign different access levels to users. Permissions may include roles such as:

• Administrator;
• Business Owner;
• Accountant;
• Bookkeeper;
• Accounts Receivable;
• Accounts Payable;
• Manager;
• Employee;
• External Accountant; and
• Read Only.

Customers are responsible for assigning appropriate permissions to their users. QanaFinance should apply the principle of least privilege when designing its internal administrative access.

29. Internal Access

QanaFinance employees, contractors and service providers should not have unrestricted access to Customer financial information merely because they support the platform. Access should be limited to individuals who reasonably require it for purposes such as:

• customer support;
• security;
• incident investigation;
• maintenance; or
• authorized technical operations.

Where appropriate, administrative access should be logged.

30. Data Location and International Processing

QanaFinance may use service providers located in Canada, the United States or other jurisdictions. As a result, personal information may be processed or stored outside an individual's province or outside Canada. Information processed in another jurisdiction may be subject to lawful access requirements in that jurisdiction. QanaFinance will seek to use service providers and safeguards appropriate to the sensitivity of the information being processed.

31. Data Retention

QanaFinance retains information only for as long as reasonably necessary for:

• providing the Service;
• maintaining accounting records;
• security;
• fraud prevention;
• audit requirements;
• backup and disaster recovery;
• legal obligations;
• dispute resolution;
• enforcement of agreements; and
• legitimate business requirements.

Different types of information may require different retention periods. Accounting records may need to be retained longer than ordinary application data.

32. Account Closure

When a Customer closes a QanaFinance account:

1. active access may be terminated;
2. the Customer should be provided a reasonable opportunity to export available accounting records;
3. production data may be scheduled for deletion or anonymization according to QanaFinance retention procedures;
4. backups may retain information for a limited additional period;
5. security and audit records may be retained where reasonably necessary; and
6. information required by law may be retained for the legally required period.

Closing an account does not require QanaFinance to destroy records that it is legally required or reasonably required to retain.

33. Data Export

Customers should be provided with reasonable mechanisms to export important accounting information. Export functionality may include formats such as:

• CSV;
• PDF;
• spreadsheets;
• accounting reports; or
• other supported formats.

Available export formats may vary depending upon the type of information.

34. Access to Personal Information

Subject to applicable law, individuals may request access to personal information QanaFinance holds about them. Certain information may be withheld where permitted or required by law, including information that:

• identifies another individual;
• is protected by legal privilege;
• would compromise security;
• consists of confidential commercial information; or
• is otherwise exempt from disclosure.

Where information is primarily controlled by a QanaFinance business Customer, an individual may be directed to that Customer to exercise applicable access rights.

35. Correction

Individuals may request correction of personal information that is inaccurate or incomplete, subject to applicable law. Accounting records may require correction through an adjusting, reversing or audit-preserving transaction rather than deletion of the historical entry. This protects the integrity of financial records.

36. Withdrawing Consent

Where processing is based on consent, an individual may withdraw consent subject to:

• legal restrictions;
• contractual restrictions; and
• reasonable notice.

Withdrawing consent may prevent QanaFinance from providing functionality that depends upon the relevant information. For example, withdrawing authorization for a bank connection may disable future bank-feed imports.

37. Security Incidents and Privacy Breaches

QanaFinance maintains procedures for identifying, investigating and responding to suspected privacy and security incidents. Where a breach occurs, QanaFinance will assess:

• the information involved;
• sensitivity of the information;
• likelihood of misuse;
• potential impact;
• number of individuals affected;
• whether information was encrypted or otherwise protected; and
• other relevant circumstances.

QanaFinance will notify affected individuals, regulators or other parties where notification or reporting is required by applicable law. QanaFinance will maintain breach records as required by applicable privacy legislation.

38. Customer Security Responsibilities

Security is shared between QanaFinance and its Customers. Customers are responsible for:

• using strong passwords;
• protecting login credentials;
• enabling available multi-factor authentication where appropriate;
• restricting access to authorized users;
• promptly removing former employees or contractors;
• protecting devices used to access QanaFinance;
• reviewing account permissions; and
• notifying QanaFinance of suspected unauthorized access.

39. Children

QanaFinance is business accounting software and is not intended for independent use by children. Individuals must meet applicable legal requirements to create and manage a QanaFinance business account. QanaFinance does not knowingly design its accounting platform to collect personal information directly from children for consumer purposes.

40. Privacy by Design

Privacy and security requirements should be considered when QanaFinance develops new functionality. Before introducing functionality involving new types of sensitive information, QanaFinance should consider:

• why the information is required;
• what information is actually necessary;
• how consent or authorization will operate;
• who may access the information;
• how it will be secured;
• which third parties will receive it;
• how long it will be retained;
• how it can be corrected;
• how it can be exported; and
• how it will eventually be deleted or anonymized.

Features involving significantly increased privacy risk may require a privacy or legal review before launch.

41. Third-Party Integration Standard

Connecting an external service to QanaFinance must not automatically grant that provider unrestricted access to all Customer Data. Integrations should request only the permissions and information reasonably required for their intended function. Customers should be able to understand:

• which provider is being connected;
• what information will be shared;
• what functionality the connection enables; and
• how the connection can be removed.

42. Disconnecting Integrations

Customers may disconnect supported third-party integrations. Disconnecting an integration should stop future information exchange where technically and contractually possible. Information previously imported into QanaFinance may remain where it forms part of:

• accounting records;
• invoices;
• reconciliations;
• audit history;
• reports; or
• other legitimate Customer records.

43. Changes to This Privacy Policy

QanaFinance may update this Privacy Policy to reflect:

• changes to the Service;
• new integrations;
• legal requirements;
• privacy guidance;
• security practices; or
• business operations.

Material changes will be communicated through reasonable means where appropriate. The effective date and last-updated date will be displayed at the beginning of this Policy.

44. Privacy Questions and Complaints

Questions, concerns, complaints, access requests or correction requests relating to privacy may be directed to:

Privacy Officer
QanaFinance Inc.
Operating as QanaFinance
[Mailing Address]
Email: [Privacy Email]

QanaFinance will review privacy concerns and respond in accordance with applicable privacy requirements. Individuals may also have rights to contact the applicable provincial or federal privacy regulator.

45. Accountability

QanaFinance Inc. is responsible for establishing policies and procedures appropriate to its role in handling personal information through QanaFinance. A designated Privacy Officer will oversee QanaFinance's privacy program. The Privacy Officer's responsibilities should include:

• privacy-policy oversight;
• handling access and correction requests;
• privacy complaints;
• breach response;
• reviewing new sensitive-data uses;
• service-provider privacy considerations;
• training;
• retention practices; and
• monitoring compliance with QanaFinance privacy requirements.

46. QanaFinance Privacy Commitment

QanaFinance exists to help businesses understand and manage their financial records. Customer accounting information is not a commodity to be sold. Our objective is to collect and process the information reasonably required to provide the Service, protect that information appropriately, give Customers meaningful control over their accounts, and remain transparent about how information is used.

Financial information entrusted to QanaFinance should be used to provide QanaFinance — not to create an unrelated business from the Customer's data.