Privacy Policy

Ghumman Advisory Group Ltd. (“we”) operates Ghumman Advisory Books, bookkeeping software used by our staff to keep books for our clients. This policy covers information handled in that software.

Two groups of people appear here: our clients, whose financial records we keep, and the individuals at those clients who sign in to see their own books. We are accountable for information in our custody under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA).

Three kinds of information, for three different reasons.

• Account information — name, email address and role, for everyone we give access to. We create accounts by invitation; there is no public sign-up, and we never ask for or store a password in readable form.
• Client financial records — the chart of accounts, transactions, invoices, bills, bank lines and supporting documents needed to keep a set of books. This is the substance of the service.
• Usage records — an append-only log of who did what and when. We keep it because bookkeeping requires an audit trail, and because CRA Information Circular IC05-1 expects records to be traceable.

We do not collect information about individuals who are not connected to a client’s books, and the software has no advertising, tracking pixels or analytics that follow people across other websites.

Where a client uses QuickBooks Online, we connect to it with that client’s permission, through Intuit’s authorisation process.

• We never see or store a QuickBooks password. Intuit asks for consent directly and gives us an access token instead. The token is encrypted before it is written down.
• We read the chart of accounts and posted transactions, so that our records match the client’s books.
• QuickBooks remains the official record. Our software is a working layer on top of it, not a replacement for it.
• Access can be withdrawn at any time, either from within our software or from the client’s own QuickBooks account. Withdrawing it stops all further access immediately.

Bank activity reaches us either as a statement file a client or our staff uploads, or — where a client chooses to set it up — through a regulated account-aggregation provider.

We do not ask for, receive or store online banking credentials. Where an aggregator is used, the client enters those credentials with the aggregator, never with us, and we receive only transaction records.

We use software, including a third-party language model, to suggest which account a transaction belongs to. Being specific about this matters more than the usual phrasing about “improving our services”.

• What is sent: a transaction’s date, amount, description, the vendor name and the client’s list of account names. Enough to categorise one line.
• What is not sent: bank account numbers, credentials, tax identifiers, or documents.
• Suggestions are reviewed by a person before they affect a client’s books. The software does not post entries on its own.
• Client information is not used to train anyone’s model. We use commercial terms that exclude training on our inputs.

Client financial records are stored in Canada, in the ca-central-1 region. That was a deliberate choice: CRA Information Circular IC05-1 expects Canadian books and records to be kept in Canada unless permission is obtained otherwise.

Some processing necessarily happens outside Canada — the application is served from infrastructure with locations in the United States, and QuickBooks and the categorisation model are United States services. Information handled outside Canada may be accessible to authorities there under their laws. Clients are told this before a connection is made, and it is listed below.

We do not sell information, and we do not share it with anyone for their own marketing.

Books and records are kept for six years from the end of the tax year they relate to, which is the retention period the Income Tax Act and the Excise Tax Act require. We keep original documents rather than only what was extracted from them, because CRA expects the original to remain legible and available.

Account information is deleted when an account is closed. Audit records are kept for the same six years and cannot be altered or removed, by design.

• Every client's data is separated at the database level, not only in the application. A request scoped to one client cannot read another's records even if the application asks it to.
• Access tokens for third-party services are encrypted before storage.
• Staff access is limited to the clients each person is assigned to.
• The audit trail is append-only and chained, so an altered or deleted entry is detectable.
• Connections are encrypted in transit.

No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify the affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and keep a record of the breach.

Under PIPEDA and Alberta PIPA you may:

• Ask what personal information we hold about you and receive a copy.
• Ask us to correct anything inaccurate.
• Withdraw consent, subject to the records we are legally required to retain.
• Ask how your information has been used and who it has been given to.

Write to info@ghummanadvisory.ca and we will respond within 30 days. If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner of Alberta.

If this policy changes in a way that materially affects how information is handled, we will tell affected clients before the change takes effect. The date at the top shows when it was last revised.