Privacy Policy

Last updated: October 2026

Who we are

This policy covers the bookkeeping, payroll and tax services operated by Powerplay Systems Inc., trading as Brian Bookkeeping, Brian Business and My Local Bookkeeper. It explains what personal information we collect, why we have it, who else handles it and where it is kept. We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA).

We work with bookkeepers in more than one province. Your bookkeeper is local to you; the records are kept in one system, described below.

Where your information is stored

Your books, the documents you send us and your account details are stored on Supabase infrastructure in the UNITED STATES (AWS region us-east-1). Backups are held in the same place.

That means your information is subject to United States law while it is there, including lawful access requests by US authorities, and you should know that before you send us anything. It does not change our obligations to you under Canadian law, or the protections in our agreement with you.

If this changes, we will say so here and date the change.

Automated tools and AI

We use software, including AI, to do the repetitive part of bookkeeping faster. It proposes; a person decides. Nothing an AI suggests is booked to your accounts without a bookkeeper reviewing it first.

THERE IS ONE AI PROVIDER, not several: Anthropic, the company behind Claude. Four things are worth knowing about what reaches it.

FIRST, most statements are read on our own infrastructure. A PDF with a text layer — which is what a bank or a credit-card issuer produces — is read locally by our own software, and no third party sees the file.

SECOND, the text we extract from a statement is what goes to Anthropic, not the statement itself.

THIRD, a photograph, a scan or a receipt has no text to extract, so for those the image itself goes to Anthropic to be read.

FOURTH, if you ask us to read an agreement — a lease, a loan, an insurance policy, or a franchise, service, employment or contractor agreement — it goes to Anthropic to be read: as its text when the file has a text layer, and as the image when it is a scan or a photograph. We remove Social Insurance Numbers and other government ID numbers from the text before it is sent, and from everything we keep. What comes back is a list of the agreement's dates and terms and a plain-English account of what each clause says, and a bookkeeper checks each one against the document before you see it. An agreement can name other people — a landlord, a guarantor, an employee — and what it says about them is read in the same way.

Anthropic may not use your information for its own purposes, including training models on it. No other AI service reads your records or documents.

Who else handles your information

We use other companies to run the service — to host it, to take payments, to send email — and, on our websites, to measure how the pages are used and whether our advertising works. The companies that run the service act on our instructions and may not use your information for their own purposes. The advertising companies work differently, and their entries below say how. For each one, the list says what it actually receives rather than describing it in general terms.

Most of them are in the United States, for the reason given above. If we add or change a provider, this list changes with it.

Supabase
Hosts the database, file storage and sign-in for the bookkeeping system.
What it receives:
Everything we hold for you: transactions, statements, receipts and other documents you send us, payroll figures, your CRA business and program account numbers, and your contact details.
Where:
United States (AWS us-east-1)
Vercel
Serves the websites and the client portal.
What it receives:
Whatever you type into a page or upload through it, in transit, plus standard request logs. Vercel does not hold your books.
Where:
Global edge network; the application runs in the United States
Anthropic (Claude)
The only AI service we use. It reads statement text to draft transaction categories, and reads receipts, tax documents and other files you send to suggest what they are and what they say. A person reviews the result before anything is booked to your accounts.
What it receives:
The TEXT extracted from a statement; the IMAGE itself for a photograph, a scan or a receipt; and the text, or for a scan the image, of an agreement you ask us to read. Not your contact details and not your CRA account numbers.
Where:
United States
Stripe
Takes subscription and invoice payments, including pre-authorized debit.
What it receives:
Your name, email address, business name and payment details. Bank account details for pre-authorized debit go to Stripe directly; we never see or store them.
Where:
United States
Resend
Sends the email we send you — invoices, statements, reminders and replies.
What it receives:
Your email address and the contents of that message, which for an invoice or a statement includes the amounts in it.
Where:
United States
PostHog
Shows us how our websites and the client portal are used, so we can see which pages help people and which confuse them.
What it receives:
On the marketing pages of bookkeeperbrian.com and on brianbusiness.com: the pages you visit, including the full web address; your IP address and device and browser details; what you click; and it may record your visit to a page so we can replay how it was used. Text you type into a form is hidden from those recordings, and so are the confirmation screens that show your details back to you. In the client portal it receives only which portal pages are visited, with the same IP and device details: no recording and no click tracking. We do not tell PostHog your name or which account you use. It does not run on invoice links or booking-management links at all, and it is not used on mylocalbookkeeper.ca.
Where:
United States
Google (Google Ads)
Measures whether our advertising leads to enquiries. It runs on two of our websites, under two different rules.
What it receives:
On bookkeeperbrian.com, on the marketing pages only, it loads for every visitor without asking first, and receives the pages you visit including the web address, your IP address and device details, advertising cookie identifiers, and a signal when you submit an enquiry or estimate form. Google may use this to measure our ads and to show our ads to people who have visited the site before. It does not run in the client portal or on invoice or booking-management links. On mylocalbookkeeper.ca, it runs by default and stops if you turn measurement off or your browser sends a Global Privacy Control or Do Not Track signal. When it runs, it receives browser and device information, IP address, page and ad-click information, cookies, and an opaque reference confirming an inquiry was saved; enhanced conversions and ad personalization are switched off there. On neither site do we send it the name, email address, phone number or message from a form, or any bookkeeping records.
Where:
Google infrastructure worldwide, including the United States
OpenAI (ChatGPT advertising)
Measures whether our advertising in ChatGPT leads to enquiries, on the marketing pages of bookkeeperbrian.com only. This is advertising measurement: it is separate from the AI service described above, and it never reads your records or documents.
What it receives:
The pages you visit on those marketing pages, your IP address and device details, and a signal when you submit an enquiry or book a call. It does not run in the client portal, on invoice or booking-management links, or on brianbusiness.com or mylocalbookkeeper.ca.
Where:
United States
Cloudflare (Turnstile)
Tells a person from an automated script on two forms: the quote form of a client website we build and host, and the form for writing to the seller of a business listed for sale on brianbusiness.com. Without it, a public form can be used to send hundreds of fake messages.
What it receives:
The network address and browser details of whoever is filling in one of those forms, while it decides. It does not receive what they typed, and it does not run anywhere else — not on the rest of our websites and not in the client portal.
Where:
Cloudflare’s global network

Analytics and advertising on our websites

Our three websites do not work the same way, so this section says, site by site, what runs and under what rule.

On bookkeeperbrian.com, the marketing pages — the pages that describe our services and take enquiries — load PostHog, Google Ads and ChatGPT advertising for every visitor, without asking first. PostHog shows us how the pages are used; Google Ads and ChatGPT advertising measure whether our advertising leads to enquiries.

In the client portal we use PostHog to count which pages are visited, and nothing else: no recording, no click tracking and no advertising tools.

Invoice links and booking-management links load none of these tools. Those pages carry a private link in their web address, so nothing on them is sent to an analytics or advertising company.

On brianbusiness.com we use PostHog only, without asking first.

On mylocalbookkeeper.ca, website measurement is on unless you turn it off. A short notice says so on your first visit, and the Website measurement link in the footer turns it off or back on at any time. Your inquiry form works either way.

When measurement is on, our reporting tool records the page and campaign associated with a visit and inquiry, and Google Ads uses advertising cookies and receives visit information and a conversion event when an inquiry has been saved. We disable enhanced conversions and ad personalization for this integration. Google still processes measurement data to provide and improve its services and prevent fraud, as described in its privacy policy.

If you turn measurement off, we stop loading the Google Ads tag and stop our conversion events, send Google a consent update if its tag had already loaded, delete the Google Ads cookies this site set in your browser, and remember your choice in this browser so it stays off on later visits. It does not erase information already sent to Google. If your browser sends a Global Privacy Control or Do Not Track signal, measurement is off from the moment the page loads, any Google Ads cookies left from an earlier visit are deleted, and nothing is sent for measurement — an inquiry you send is still recorded, as the next paragraph explains. Google explains its processing at policies.google.com/technologies/partner-sites and policies.google.com/privacy.

Enquiries sent through mylocalbookkeeper.ca are also recorded in our own lead and campaign reporting system, which keeps them on Supabase in AWS us-west-2 — also in the United States, and separate from the bookkeeping system described above. That happens whether or not measurement is on: the name, email address, phone number and message you send are recorded there either way, and measurement adds only the page and campaign information described above. Enquiries sent through our other websites are not recorded there.

On bookkeeperbrian.com and brianbusiness.com, these tools use cookies and similar browser storage to recognize a returning browser. On mylocalbookkeeper.ca, while measurement is on, our reporting tool uses storage in your browser and Google Ads uses advertising cookies; if you turn measurement off, those cookies are deleted and your choice is kept in your browser so it can be remembered. Blocking these tools, for example with an ad blocker, does not stop our websites from working.

Social Insurance Numbers

We do not store your Social Insurance Number as data. There is no field for it anywhere in our system — deliberately, because information we never hold cannot be leaked, cannot be compelled from us and cannot be mishandled in a backup. Where a preparer needs to confirm they are looking at the right person, we keep the last three digits only, which cannot be used to file anything.

DOCUMENTS ARE DIFFERENT, and you should know this. A Notice of Assessment, a filed return or a signed T183 contains a full SIN, and if you send us one we hold that document. It is stored with your other documents, under the same access controls, and kept for the retention period below.

Your banking

We work from the statements you send us. We do not ask for, store or use your online banking usernames or passwords, and we have no direct access to your accounts. There is nowhere in our system that such a credential could be kept.

Writing to the seller of a business for sale

If you write to the seller of a business listed for sale on brianbusiness.com, we pass your name, email address, phone number (if you give one) and message to that seller, in their client portal. The seller replies to you directly. We do not contact you about it, add you to any list, or use your message for anything else.

Your message is kept with the seller’s records, for as long as we keep theirs.

How long we keep it

Enquiry messages are kept only as long as needed to follow up.

If you ask for one of our free templates, we use your name and email address to send it and keep them as a record of the request.

Client records are kept for the length of the engagement and then for at least six years, because the CRA generally requires business records to be kept that long — we do not delete them before that. Once that period has passed we are no longer required to keep them, and you can ask us to delete anything we are not legally required to keep. See Your rights, below.

What we do not do

We do not sell, rent or trade your information. We do not use your financial records for advertising. We hold no certifications — no SOC 2, no ISO — and we would rather tell you that than imply otherwise.

Your rights

You can ask us at any time what personal information we hold about you, ask us to correct it, ask for a copy, or ask us to delete anything we are not legally required to keep. Ask your bookkeeper, or use the contact form, and we will respond promptly.

If you are not satisfied with how we have handled a privacy question, you can complain to the Office of the Privacy Commissioner of Canada.

Changes to this policy

If we make material changes we will update this page and the "Last updated" date above.

Contact

Questions about privacy or our data practices? Reach us through the contact form.