Privacy Policy

Who we are

Tenth Ledger is operated by 1000597982 Ontario Inc. (operating as Tenth Ledger). TenthLedger is white-label practice management software for Canadian accounting firms. Sign-up is by invitation. Contact: hello@tenthledger.com.

Firms are responsible for having the right to provide their clients’ data, including any required consent. We process that data on the firm’s behalf.

Information we collect

• Account data: email, name, and Google sign-in profile.
• Firm profile and branding.
• Client records that firm users enter or import: names, contact details, entity type, relationships, fiscal year end, and tax identifiers such as SIN/BN.
• Basic usage and technical logs used to operate and secure the service.

QuickBooks Online

The QuickBooks connector is not enabled yet. The following describes the intended connection and data handling when it becomes available.

When a firm connects its own QuickBooks Online company, we will request the accounting scope (com.intuit.quickbooks.accounting) and use it only for read-only access to the company profile, Customers, Invoices, Sales Receipts, Credit Memos, Payments and Items. This scope is named “accounting” by Intuit; our intended use is read-only. We use these records to build and update the firm’s client list, services and billing summaries.

We will not write to QuickBooks, move money, or access payment-processing services or payroll. Reading accounting Payment records is not access to QuickBooks Payments services.

Before the connector is enabled, OAuth tokens must be stored encrypted, server-side only, and never sent to the browser. The firm will be able to disconnect at any time in TenthLedger or QuickBooks. On disconnect we will revoke and delete the tokens. Data already imported stays in the firm’s account until the firm deletes it or asks us to.

How we use data

We use data to provide the service, provide AI-assisted extraction and classification, support users, and maintain security. A firm user reviews AI-extracted records before anything is saved. We don’t sell personal information. We don’t use QuickBooks or client data for advertising.

AI processing

Text submitted for AI-assisted extraction is sent to AI models through our hosting provider’s AI gateway to extract and classify records. We don’t use customer data to train our own models.

Service providers

Our service providers include Lovable (application hosting), Supabase on Amazon Web Services (database, authentication and storage), the AI model providers reached through the Lovable AI gateway, Google (sign-in), and Intuit (when a firm connects QuickBooks).

Where data is stored

Data is stored in the United States (AWS us-east-1 region via Supabase). We plan to move hosting to Canada. Data may be accessed or processed in the United States and is subject to its laws.

Security

We use encryption in transit (HTTPS), access controls by firm membership and role, row-level security, and an audit log. Encrypted storage of integration tokens is required before integrations are enabled. We are adding field-level encryption for tax identifiers; it is not complete. No service can guarantee absolute security.

Retention and deletion

We retain account and firm data while needed to provide the service, meet legal obligations, resolve disputes, or maintain security. Firms may delete records in their account or contact us to request deletion or account closure. Some information may remain in backups or legally required records until their applicable retention periods end. Disconnecting an integration does not delete records already imported.

Your rights under PIPEDA

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you may request access to your personal information, correction of inaccurate information, or withdraw consent, subject to legal and contractual restrictions. Withdrawing consent may limit our ability to provide the service. For client records managed by a firm, contact that firm first; we will assist it with requests.

Contact hello@tenthledger.com with a privacy request or complaint. You may also complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Changes and contact

We may update this policy and change the date above. We will notify affected users of material changes as appropriate. Questions or requests: hello@tenthledger.com. Tenth Ledger is operated by 1000597982 Ontario Inc. (operating as Tenth Ledger).