Privacy Policy

Last updated: October 20, 2026

1. Who we are

Northbooks is an accounting and payroll service operated by Autana Solutions, based in British Columbia, Canada ("we", "us"). We are responsible for personal information under our control and follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA).

Questions or requests go to our Privacy Officer at [email protected].

2. Our role

For your account details (name, email, sign-in information) we decide how the information is used. For the records you put into Northbooks about your business, customers, vendors and employees, you are in control: we hold and process that information on your behalf, to provide the service you asked for. You are responsible for having the right to give it to us, for example by telling your employees that you use Northbooks for payroll.

3. What we collect

• Account information: your name, email address, password (stored only as a one-way hash), two-factor and passkey settings, and, if you sign in with Google, your Google account ID and email.
• Business records you enter or import: chart of accounts, invoices, bills, receipts and their images, bank transactions, customers, vendors, sales tax returns, budgets and reports.
• Employee and payroll information you enter: names, contact details, dates of birth, Social Insurance Numbers, tax credit (TD1) amounts, pay rates, hours, time-clock punches (which can include location when a geofenced clock is used), and direct-deposit banking details.
• Usage and security data: IP addresses, browser or device type, sign-in times, and an audit log of who changed what and when. We use these to keep accounts secure and to show you a history of changes.

We use cookies only to keep you signed in and to protect forms against cross-site request forgery. We do not use advertising or tracking cookies.

4. How we use it

• To provide Northbooks: keep your books, calculate sales tax and payroll, produce reports, and send the emails you trigger (invoices, reminders, invites).
• To read receipts and bills you upload, and to suggest categories for bank transactions (see AI processing below).
• To keep the service secure: detect unusual sign-ins, rate-limit attempts, and keep an audit trail.
• To send you service messages, for example sign-in alerts, password resets and important changes to these policies.
• When someone creates a new Northbooks account, our team receives an internal notice with the account's name, email and business name, so we can welcome and support new customers.

We do not sell personal information, share it for advertising, or use your business records to market to you.

5. AI processing

When you upload a receipt or bill, or ask Northbooks to suggest how to categorize transactions, the document or the transaction details are sent to Anthropic's Claude AI to read them. The results are checked by our own software, and nothing is posted to your books until you, or a rule you set up, approve it. Anthropic processes this data in the United States under its own terms and privacy policy.

6. Where your information is stored, and who helps us

Northbooks runs on servers located in the United Kingdom. Backups are stored with Google in Google Drive. Some providers below process information in the United States or other countries, where it may be accessible to courts and authorities under local law. We only share what each provider needs to do its job.

We may also disclose information if the law requires it, for example a valid court order, or to protect the rights and safety of our users. If Northbooks is sold or merged, your information would move to the new operator under the same protections, and we would tell you first.

7. How we protect it

• All connections use HTTPS.
• Social Insurance Numbers and direct-deposit banking details are encrypted with AES-GCM, and access to them is logged.
• Each organization's records are separated at the database level, so one customer cannot see another's data.
• Two-factor authentication is required for account owners, and passkeys are supported.
• Every change to your books is recorded in an audit log that cannot be edited.

No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm, we will notify affected people and the Office of the Privacy Commissioner of Canada as the law requires.

8. How long we keep it

We keep your records for as long as your organization has an account. You can export all of your data (CSV, JSON and original attachments) at any time from Settings. An owner can permanently delete an organization; payroll records are kept for six years after the last pay date, as Canadian payroll record-keeping rules require, and deletion becomes available after that. Deleted data leaves our backups as they rotate out.

9. Your rights

You can ask to see the personal information we hold about you, to correct it, or to withdraw your consent (which may mean we can no longer provide the service). Email [email protected] and we will answer within 30 days. If an employee or customer of one of our users contacts us, we will refer them to that business and help it respond.

If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.

10. Children

Northbooks is a business tool and is not meant for anyone under 18 to sign up.

11. Changes

If we change this policy, we will update the date above. For important changes we will email account owners before they take effect.