DocsToBooks is operated by AANYA TECHNOLOGIES, a sole proprietorship of Pranshu Agarwal, trading as DocsToBooks, India (“DocsToBooks”, “we”, “us”). This policy explains what personal information we collect, why, where it goes, how long we keep it and how to reach us about it.
It is written with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta’s Personal Information Protection Act and British Columbia’s Personal Information Protection Act in mind, because our customers are Canadian businesses.
1. Two kinds of personal information, handled differently
Account information is information about you as our customer: your name, email address and how you use DocsToBooks. We decide why and how it is used, and we are responsible for it.
Client information is what is printed on the documents you give DocsToBooks to read: bank and card statements, invoices, receipts and similar papers. These usually contain personal information about other people, such as your clients, their customers and their suppliers.
You, or the firm you work for, decide what documents to process and why. For client information we act as your service provider. We use it only to provide the service to you, as described below, and never for our own purposes. You are responsible for having the authority to give it to us.
2. What we collect
Account information
| What | When | Why |
|---|---|---|
| Name, email address, password (stored only as an Argon2id hash) | You create an account | To let you sign in and to contact you about your account |
| Google account identifier, name and email | You choose “Continue with Google” | To sign you in. We receive no Google password |
| Plan, statement and document counts, run dates, file counts and results as statuses (for example “PASS”, “FAILED”) | You use the service | To apply your plan’s allowance and show your usage |
| Billing name, email, country, postcode, tax number if given, and transaction references | You buy a plan | Received from Paddle to link your purchase to your account. We never receive your card number |
| IP address, browser type and request times | You visit the site or use the hosted app | Security, rate limiting and fixing faults |
| What you write to us | You contact support | To answer you |
| Licence id, a hash of your computer’s identifiers, your Windows computer name, app version | You activate the Windows app | See section 3 |
Client information (hosted app only)
When you upload a document to the hosted app, we store the file and the results we derive from it: the rows read, the checks run and the certificate. We use them only to show you the results and to produce the exports you ask for.
If you create clients, we also store those clients, their charts of accounts, rules and the account heads you confirmed (with the transaction descriptions they were confirmed for).
We do not open your documents ourselves, except when you ask us in writing for help with a specific run, and then only the part needed to help.
We do not sell client information or account information, or use it for anyone else. Account-head suggestions for a client are computed only from that client’s own confirmed heads in your account; no AI model is involved.
3. The Windows app: your files stay on your computer {#windows-app}
The Windows app reads and checks statements on your own computer. Statements, rows, file names and results are not sent to us. The app keeps its runs in a folder on your computer and deletes them after the period you choose in its settings.
The app contacts us only for the purposes below, and sends exactly this:
| Purpose | When | What is sent |
|---|---|---|
| Activate a licence | Once per computer, when you enter your licence key | The licence key; a one-way hash of your computer’s Windows installation id and system drive serial number (the raw ids never leave the computer); your Windows computer name, cut to 40 characters, so you can tell your computers apart; the app version |
| Licence check-in | About every 6 hours while online, and shortly after an export | The licence token we issued; the app version; and, for each export since the last check-in, a random event id, whether it was a statement or a document, and the time. Nothing identifies which statement it was |
| Deactivate a computer | When you choose to | The licence token and any unsent usage events, as above |
| Check for updates | When the app checks | The licence token, so we can confirm your plan includes updates |
| Send diagnostics | Only when you press “Send diagnostics”, after the app shows you exactly what it will send | The app version, the Windows version and the last lines of the app’s own log. The log records ids and counts, not document contents, and every run of 4 or more digits is replaced before sending |
Like any internet connection, each of these also reveals your IP address to our server.
4. How we use personal information
To provide and secure the service; apply your plan and count usage; issue and check licences; process purchases through Paddle; send service emails (receipts, licence keys, email confirmation, password resets, notices about your account or changes to these terms); answer support requests; and meet legal obligations.
We send marketing email only where Canada’s Anti-Spam Legislation allows it. Every email that is not about your account or a purchase carries a one-click unsubscribe link, and an unsubscribe takes effect at once.
5. Consent
By creating an account you consent to the uses in this policy for your account information. You can withdraw consent at any time by closing your account, subject to legal and contractual limits (for example, records we must keep for tax purposes).
For client information, you are responsible for any consent or other authority needed to give it to a service provider. Our role is described in the data-handling summary.
6. Who we share it with (subprocessors)
We share personal information only with the service providers below, and only what each needs.
| Provider | What it does | What it receives | Location |
|---|---|---|---|
| Contabo GmbH | Hosts the server for the website, the hosted app and licence checks | Everything stored on the hosted app, including uploaded documents | Server in France (company in Germany) |
| Cloudflare, Inc. | Domain name service, TLS and traffic protection in front of our server; Turnstile, the check on the sign-up page that tells people from automated sign-ups; and, once we switch it on, storage for an off-server copy of our nightly backups (R2) | All traffic to our website and hosted app passes through it encrypted, and is decrypted at its network edge to be forwarded to our server. Turnstile receives your browser’s signals on the sign-up page. Backup copies are encrypted on our server before they leave it, and Cloudflare never holds the key. It does not store your uploaded documents | Global network (company in the United States) |
| Paddle.com Market Limited | Merchant of record: sells you the subscription or licence, takes payment, charges sales tax, sends invoices | Your billing details and purchase; not your documents | United Kingdom |
| Resend (Plus Five Five, Inc.) | Sends our service emails | Your email address and the email’s contents (for example a licence key or receipt); not your documents | United States |
| Google LLC | “Continue with Google”, only if you use it | The fact that you are signing in to DocsToBooks | United States |
We will list any new subprocessor on this page at least 30 days before it receives client information. We may also disclose information where the law requires it, and only to the extent it requires.
7. Where your information is stored, and transfers outside Canada
The hosted app’s server is in France. Uploaded documents, results and account information are stored there. DocsToBooks is operated from India, and the person who runs the service may access account information, and client information when you ask for support, from there. Cloudflare, Paddle, Resend and Google may process information in other countries, as listed above.
Information stored or accessed outside Canada is subject to the laws of that country, and may be available to its courts, law enforcement and national security authorities.
For Alberta: you may ask for written information about our policies and practices for service providers outside Canada. Questions about how they collect, use, disclose or store personal information can be sent to our privacy officer, AANYA TECHNOLOGIES, at [email protected].
The Windows app does not transfer your documents anywhere.
8. How long we keep it, and how deletion works
| Information | How long |
|---|---|
| Uploaded documents and their results (hosted app) | Until the retention period you choose, 24 hours by default (or 7 or 30 days). You can also delete a run at any time |
| Clients you create, their charts of accounts, rules and the account heads you confirmed (with the transaction descriptions they were confirmed for) | Until you delete the client or your account |
| Account information | While your account is open; deleted when you close it (backups roll off within 14 days) |
| Usage counts | While your account is open; deleted when you close it |
| Licence and payment records | 2 years after the last payment, for billing and tax questions (revoked licences are kept as records, without your name) |
| Purchase records | As long as tax and accounting law requires. Paddle keeps its own records as merchant of record |
| Server logs | 30 days. Our logs are designed not to contain document contents |
| Support email | 2 years after the conversation ends |
What “deleted” means here. When a retention period ends, or you delete a run, we delete the files and results from the hosted app’s storage and remove our references to them. We do not claim that deletion physically overwrites the disk underneath. Uploaded statements, other documents and their results are never backed up. Backups of the database (names, emails, plans, clients, usage counts, licence records) and of your clients’ charts of accounts, rules and coding memory are made nightly onto the server’s encrypted volume, and each backup is kept for 14 days, so anything deleted from our servers rolls off the backups within 14 days.
Deleting your account. You can delete your account yourself from Settings. This removes your runs, uploaded files, results, clients and usage records; we keep only what tax and billing law requires (invoices and payment records, held by Paddle and in our billing records, for the period the law sets). They are deleted from our servers at once, and roll off our backups within 14 days.
9. How we protect it
We use safeguards appropriate to how sensitive the information is. The measures in place are listed on our security page and in the data-handling summary. No system is perfectly secure, and we do not claim ours is.
10. Your rights
You may ask us whether we hold personal information about you, what it is, how it has been used and to whom it has been disclosed; to correct information that is inaccurate or incomplete; and to withdraw consent or close your account. You can also delete your account yourself from Settings (see section 8).
Write to [email protected]. We may need to confirm your identity. We will answer within 30 days, or tell you within that time if we need longer and why. There is no fee for a simple request.
If your information is in a document one of our customers uploaded, that customer (for example your accountant or bookkeeper) controls it. We will pass your request to them and help them answer it.
11. If there is a breach
If a breach of our safeguards involving personal information creates a real risk of significant harm to anyone, we will report it to the Office of the Privacy Commissioner of Canada and, where the law requires, to the relevant provincial commissioner, and notify the people affected as soon as feasible. We keep a record of every breach of security safeguards for at least 24 months.
If the breach involves client information, we notify the affected customer without undue delay, and within 72 hours of confirming it, with what we know, so they can meet their own obligations.
12. Cookies
We use only the cookies needed to keep you signed in and to protect sign-in. We use no analytics or advertising cookies. When you open checkout on the billing page, Paddle’s payment window may use its own cookies to process the payment. The Windows app keeps no cookies between launches.
13. Children
DocsToBooks is a business tool and is not directed at anyone under 18.
14. Changes to this policy
We will post changes here with a new date, and email account holders about material changes at least 30 days before they take effect.
15. Contact and complaints
Privacy officer: AANYA TECHNOLOGIES, DocsToBooks, India. Postal address: 25 Clouston Avenue, Bushey WD23 2PU, United Kingdom. Email: [email protected].
If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, or the Office of the Information and Privacy Commissioner for British Columbia, as applies to you.