How we handle your information

What we keep to run the product

This layer is not optional. Using Novenance includes it. We use it only to operate and improve your account — Today and reliability for this tenant — not another agency's desk.

• Account data — name, email, hashed password, role.
• Your catalog and orders — items, suppliers, customers, invoices. That is your agency's operational record.
• Mandatory audit log — who changed what, and when, so you can see writes and we can be accountable.
• Tenant-scoped action events — a thin log of high-value actions: the verb (what happened), object type, object id, timestamp, and how you got there (Today, Settings, inbound, and so on). Used only for this tenant.

The action log does not store MIME, email bodies, prices, customer names, or spreadsheet guts.

Data lives in Postgres in Toronto, with row-level security so one tenant cannot read another. Sub-processors stay DigitalOcean (app and database) and the encrypted backup already documented in our internal privacy programme. We are not adding a new vendor for this core log.

Retention. Action events about 18 months, or until the tenant is deleted. Audit and tax records follow the existing AGCO / CRA carve-out — not this 18-month clock.

Share usage to improve Novenance

Optional. Off by default. Not required to use the product. The switch is not live yet; the words below are what Settings will say when it is.

If you turn it on, we may contribute sanitized aggregates only — verb sequences and counts — to a store with no tenant id, object ids, emails, money, or way to join back to your tables.

We would use that only to decide named product tiles we ship. We would not use it to render another agency's Today.

You can withdraw anytime. We stop contributing. We do not promise to unlearn tiles already shipped.

Your rights

You can ask what we hold, get a tenant export from Settings, and ask us to delete an account after the published grace window. Write [email protected]. We aim to answer within seven days; PIPEDA allows up to 30.

You can also complain to the Office of the Privacy Commissioner of Canada if we do not resolve it.