Privacy Policy

1. Who this policy applies to, and our role

Clerra serves two groups of people, and our role differs for each:

• Firm users — accounting and bookkeeping firms (each, a “Firm”) and their staff who subscribe to and use Clerra. For account, billing, and usage information about Firm users, Common Good Labs is the organization responsible for that information.
• Firm clients — the clients of those Firms, including individuals who use a Firm’s client portal. Information that a Firm enters or uploads, or that a Firm’s clients submit through the portal (“Customer Data”), is collected by and under the control of that Firm. The Firm decides what it collects, why, how long it keeps it, and with whom it is shared. Common Good Labs acts only as the Firm’s service provider, processing Customer Data on the Firm’s behalf and on its instructions. The Firm is accountable for that information under privacy law, and the Firm’s own privacy practices govern how it is handled.

This policy also covers people who visit our website or contact us, and the limited business information described in section 2 about prospective clients that a Firm researches.

2. Information we collect

• Account information: name, email address, phone number (if you choose to sign in by text), firm name, role, and authentication data. Passwords are stored only as salted hashes. Two-factor secrets are stored where you enable two-factor authentication.
• Customer Data: information Firms enter or upload about their own clients, such as names, contact details, business numbers, tax and compliance attributes, documents (including receipts, bills, statements and returns), notes, messages, invoices, and time records.
• Electronic signature and consent records: when someone signs a document or gives consent through the Service, we record the signer’s name, email address and signature (including any initials applied), the date and time of their consent and signature, IP address, device and browser details, the wording and version of the disclosure they agreed to, and a fingerprint of the signed document. This creates an evidentiary record of the signature or consent.
• Billing information: subscription plan and status, and a billing contact. Payment card details are collected and processed directly by our third-party payment processor. We do not store full card numbers.
• Usage and technical data: log data, device and browser information, IP address, and actions recorded in the audit trail (such as sign-ins, document access, deletions, permission changes, and exports), kept for security and accountability. See section 6 for diagnostic data.
• Communications: messages exchanged between a Firm and its clients within the Service, conversations with our in-app support assistant, and any correspondence you send us.
• Mobile app data: if you install a Clerra mobile app and allow notifications, a device push token and basic device type, used to deliver notifications.
• Microsoft Teams data: if you add the Clerra app in Microsoft Teams, the Teams and Microsoft identifiers needed to deliver your notifications there and, where your Firm uses Teams meeting notes, the transcripts and notes of client meetings, as described in section 6.
• Prospect information: where a Firm uses the Service’s prospect-research tools, publicly available business information about the prospective clients the Firm researches, such as business name, website, industry, and size estimates.

The Clerra browser extension accesses only your Clerra account data, such as timers, clients, and reminders. It does not read the web pages you visit or collect your browsing history.

3. How we use information

• To provide, operate, maintain, secure, and improve the Service;
• To compute filing deadlines, generate work, and deliver the features a Firm uses;
• To authenticate users, enforce access controls, and maintain the audit trail;
• To process subscriptions and payments and send transactional messages (e.g. invitations, document requests, reminders, notifications);
• To provide support and respond to enquiries;
• To detect, investigate, and prevent fraud, abuse, and security incidents;
• To comply with legal obligations and enforce our Terms of Service.

We may create aggregated or de-identified information from the use of the Service, for example usage statistics, to operate and improve it. We do not attempt to re-identify de-identified information, and we do not disclose it in a form that identifies any Firm or individual.

We do not sell personal information. We do not use Customer Data for advertising. We do not use Customer Data or Google user data to train artificial-intelligence or machine-learning models, whether ours or anyone else’s.

We do not make decisions about individuals based exclusively on automated processing. Automated features, such as computed deadlines and email triage, produce suggestions and outputs for Firm staff to review. The Firm remains responsible for the decisions it makes.

If we send you promotional messages, we do so in accordance with Canada’s Anti-Spam Legislation, and every such message includes a way to unsubscribe. Service and account messages, such as security notices and changes to our terms, are sent regardless of marketing preferences.

4. Consent, and the Firm's responsibilities

We collect, use, and disclose personal information with consent (express or implied) or as otherwise permitted or required by law.

Because each Firm controls its Customer Data, each Firm is responsible for:

• having a lawful basis and any consents required to collect its clients’ information and enter it into the Service;
• informing its clients that it uses service providers such as Clerra, including that some processing occurs outside Canada (section 5);
• deciding which information to collect and upload, and limiting it to what its engagement requires;
• obtaining any additional consent the law requires for sensitive information it uploads, such as health information contained in medical receipts or disability tax credit forms;
• responding to its clients’ privacy requests and complaints;
• controlling which staff and clients have access, and removing access promptly when a person leaves or a relationship ends; and
• complying with Canada’s Anti-Spam Legislation and other laws for messages the Firm sends to its clients through the Service.

5. Where information is stored and processed

Customer Data and Firm account data are stored in Canada, in data centres in a Canadian cloud region (Montréal, Québec). This includes our database, sign-in system, file storage, and backups. The Clerra application also runs on servers in Canada (Montréal). Static website content, such as images and scripts, may be delivered from a global content-delivery network.

Some of our service providers process information outside Canada, mainly in the United States. Section 6 lists them. Information processed outside Canada is subject to the laws of that country, and may be accessible to its courts, law-enforcement, and national-security authorities. Our service providers’ personnel may also access information from outside Canada to support and maintain their services, subject to their contractual obligations to us. In limited circumstances, such as a regional outage, a provider may temporarily process information in another region. We protect cross-border processing with contractual and technical safeguards.

6. Service providers (sub-processors)

We rely on a small number of service providers to operate the Service. We describe them here by category and function. A current, named list is available to Firm administrators on request.

• Cloud infrastructure — database, authentication, file storage, and backups, hosted in Canada (Montréal, Québec).
• Application hosting — hosted in Canada (Montréal, Québec), with static content delivered from a global content-delivery network.
• AI processing — our third-party AI provider, in the United States, processes content for the following features:
  • email triage of messages clients send to a Firm, which a Firm administrator can switch off;
  • the in-app support assistant;
  • prospect research, when a staff member requests it for a prospective client;
  • notes from a client meeting in Microsoft Teams (a summary, action items and what the client promised to send), where a Firm has switched on AI meeting notes; and
  • other on-demand features a Firm user chooses to run, which may include client names and the client details the feature needs.
  The provider uses this content only to return the result to us. It does not use the content to train AI or machine-learning models, and retains it, if at all, only for a limited period under its commercial terms for safety and abuse monitoring. Where a Firm has an optional higher-capability AI model enabled, that model comes from the same provider (United States) on the same terms.
• Payment processing — subscription billing and, where a Firm accepts online payment, its clients’ payments of invoices and proposals. Card details are handled directly by the processor and never stored on our servers. The processor may process information outside Canada.
• Transactional email delivery — United States.
• SMS delivery — one-time sign-in codes, for users who choose to sign in by text (United States).
• Mobile push notifications — delivers short notification text to the mobile app (United States).
• Document processing — scanning uploaded files for viruses, and converting tax-authority PDF forms so they can be filled and signed. Both run on servers in Canada (Toronto and Montréal) and keep no copy of the file.
• Bot and abuse protection — on sign-in and public forms (United States).
• Website analytics — counts visits to our public website, without cookies and without identifying you personally (United States). It is not used inside the Service.
• Background-job orchestration — schedules work such as generating a complete client-file export or scanning an upload. It receives only record identifiers and counts, never the contents of client records or documents (United States).
• Error monitoring & diagnostics — captures errors and performance data, with technical context such as user and request identifiers, IP address, browser details, and details of the request that caused the error. For a sample of sessions, and for sessions where an error occurs, it also records a reconstruction of on-screen interactions, with on-screen text and form inputs masked. We use this to keep the Service reliable and secure (United States).
• Optional integrations a Firm connects — such as accounting software, tax software, or a third-party sign-in. When a Firm connects an integration, information flows to that provider at the Firm’s direction and is handled under that provider’s own terms and privacy policy. We are not responsible for that provider’s practices.
• Microsoft 365 mailbox and calendar — where a staff member connects their own Microsoft 365 / Outlook account, Clerra keeps a copy of that mailbox (message text and formatting, senders and recipients, subjects, dates, folders and read state — the last 90 days, plus any older mail they choose to load) and of their Outlook calendar, stored in Canada, so it can be shown and searched in the Service and kept in step with Microsoft both ways. Attachments stay with Microsoft until the staff member saves one to a client’s file. A conversation with one of a client’s known email addresses (or an address the Firm confirmed before) is linked to that client automatically, and staff who can see that client can then see it; the rest of the mailbox is visible only to that staff member (and to anyone they hand a conversation to). A staff member can turn automatic linking off for their own mailbox, or mark a conversation personal so it is never linked. Disconnecting the account deletes Clerra’s copy of the mailbox and calendar, except conversations linked to a client, which stay on that client’s record. The mailbox itself, at Microsoft, is never changed by disconnecting. Where a Firm switches on Next steps, a conversation a staff member opens (never Junk or Deleted mail) is sent to our AI provider to suggest calendar items, a reply and to-dos, on the terms described above. Where a Firm switches on automatic job filing, a new email from a client is sent to the Firm’s configured AI model to pick the job it belongs to, on the same terms. Connecting can also add a separate “Clerra” calendar to the staff member’s Outlook with their deadlines, jobs and time off, if they choose.
• Gmail / Google Workspace mailbox — where a staff member connects their own Gmail or Google Workspace account, Clerra keeps a copy of that mailbox (message text and formatting, senders and recipients, subjects, dates, labels and read state — the last 90 days, and new mail from then on; messages in Spam are kept without their content), stored in Canada, so it can be shown and searched in the Service and kept in step with Gmail both ways. What the staff member does in Clerra — sending, replying, archiving, labelling, moving to Trash or Spam, marking read — is done in their Gmail account. Attachments stay with Google until the staff member saves one to a client’s file. Linking to clients, who can see a conversation, Next steps, automatic job filing and disconnecting work exactly as described for Microsoft 365 above: disconnecting deletes Clerra’s copy (except conversations linked to a client) and revokes Clerra’s access at Google, and never changes the mailbox at Google.
• Google Calendar — where a staff member connects their Google Calendar, Clerra reads their calendar events to show them, and the times they’re busy, in the Service.
• A Firm’s own document storage (OneDrive, SharePoint or Google Drive) — where a Firm connects its own storage, client documents are kept there instead of in Clerra’s vault; files already in the vault stay there until the Firm moves them. A file that reaches the Firm through Clerra (for example a portal upload or a saved email attachment) is held briefly on our servers in Canada so it can be scanned for viruses, written to the Firm’s storage and checked, and is then deleted from our servers, within 24 hours. Clerra keeps only what it needs to show and manage each file there (its name, folder, size and identifiers). Clerra does keep, on its servers in Canada and with no set end date, a PDF copy of each file a staff member sends for signature from the Firm’s storage (including drafts never sent and requests that ended unsigned, until a staff member discards the draft), the signed PDF and certificate of completion of every document signed through Clerra, and any complete client-file PDF the Firm generates, even when a copy is also saved to the Firm’s storage. Files in the Firm’s storage are held wherever that provider stores them, which may be outside Canada (with Google Drive, for example, Google decides where files are kept, and Clerra can’t promise Canada). With Google Drive, Clerra can see only the folders and files it created, or that a staff member chooses to add with Google’s file picker. Clerra does not back up files kept in the Firm’s own storage: their backups and retention follow the Firm’s Microsoft or Google settings. Clerra’s own records, including the list of those files, are backed up as usual. Disconnecting the storage leaves every file in it where it is.
• Microsoft Teams — where a staff member adds the Clerra app in Microsoft Teams, Clerra keeps what it needs to send them notifications in a personal chat: the Teams chat (conversation) ID and the address Microsoft gives for it, their Microsoft user ID and organization (tenant) ID, and their Microsoft sign-in name, which is used to match them to their Clerra account. These are stored in Canada. The text of each notification, which can include a client’s name, is delivered through Microsoft and kept in the staff member’s Teams chat under their organization’s Microsoft 365 settings. Removing the app, or typing “sign out” in the chat, stops all messages to that chat. Where a Firm turns on Microsoft Teams meetings and a staff member connects their own Microsoft account, Clerra keeps that account’s Microsoft user ID, email address and an encrypted access token, stored in Canada, and reads the transcripts of Teams meetings that staff member organizes. When one of a client’s contacts attended, Clerra saves the transcript, with the meeting’s subject, times and attendees’ names and email addresses, to that client’s record in Canada. Meetings with no client in them are never stored, and recordings stay with Microsoft. Where the Firm has switched on AI meeting notes, the transcript is sent to our AI provider (United States) to write a summary, action items and what the client promised to send, on the terms described above. Saved transcripts and notes are Customer Data, kept and deleted like the rest of the client’s record (section 10). Disconnecting the Microsoft account deletes Clerra’s access token and stops new meetings from being read; meetings already saved stay on the client’s record.

We require our service providers, by contract, to protect personal information with appropriate safeguards and to use the content we send them to provide their services to us. Some providers, such as our communications providers, also act independently for limited purposes, such as security, fraud and abuse prevention, legal compliance, and improving their own services, for which they may use account, usage, and message-routing information (for example, a phone number and delivery status) under their own privacy policies. We will make reasonable efforts to give Firm administrators advance notice before adding a new category of service provider that processes Customer Data.

Google user data — Limited Use. Clerra’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use data accessed through Google APIs (Gmail, Google Calendar and Google Drive) only to provide and improve the user-facing features described above. We never sell it or use it for advertising. We do not use it to develop, improve, or train generalized or standalone AI or machine-learning models, and neither do our providers.

Our personnel do not read Google user data except (a) with the user’s consent for specific messages, for example to provide support; (b) where necessary for security, such as investigating abuse; (c) to comply with applicable law; or (d) where the data has been aggregated and de-identified for internal operations.

Who we share Google user data with. We share data obtained through Google APIs only with the service providers strictly necessary to deliver the features above, and only for that purpose:

• Our cloud infrastructure provider (hosted in Canada, Montréal/Québec) — stores the copy of a connected Gmail mailbox described above, what a staff member saves from a message (such as a logged communication or an attachment saved to the client’s vault), and the names and identifiers of the Google Drive files Clerra manages; and holds a file on its way to Google Drive for at most 24 hours.
• Our third-party AI provider (United States) — receives the content of an email only (a) where the Firm has switched on Next steps, when a staff member opens a conversation, or (b) where the Firm has switched on automatic job filing, when a new email arrives from a client — to return that result, on the non-training terms described above. A Google Drive file is sent to it only when a staff member runs a feature on that file, such as reading a receipt.
• Our document-processing providers (Canada, Toronto and Montréal) — scan a file for viruses before it is written to Google Drive, and convert a file a staff member sends for signature. They keep no copy.
• Our background-job orchestration provider (United States) — receives only record identifiers and counts, never the content of an email or a file.

We do not otherwise share, transfer, sell, or disclose Google user data to any third party.

7. When we disclose information

We disclose personal information only:

• to our service providers, as described in section 6;
• at a Firm’s direction, for example when a Firm shares documents with its client through the portal or connects an integration;
• where required or permitted by law, such as to comply with a court order, warrant, subpoena, or a demand or requirement from a government authority (including tax authorities). Where Customer Data is involved, we will refer the request to the Firm where reasonable. Where the law allows and it is reasonable, we will notify the affected Firm before disclosing;
• where reasonably necessary to protect the rights, property, or safety of our users, the public, or Common Good Labs, or to investigate fraud or a breach of our Terms of Service;
• in connection with a prospective or completed business transaction, such as a financing, merger, acquisition, or sale of all or part of our business. Disclosure is limited to what the transaction requires, the recipient must agree to use and protect the information only for that purpose, and any successor remains bound by the commitments in this policy for information it receives; and
• otherwise with your consent.

8. Security

We apply layered safeguards, including:

• encryption in transit and at rest;
• row-level data isolation between Firms, and between a Firm and its clients;
• least-privilege access controls;
• short-lived signed links for document downloads;
• optional two-factor authentication;
• bot protection on public endpoints; and
• an audit trail of sensitive actions.

Our personnel access Customer Data only where necessary to provide support a Firm requests, to maintain the security and integrity of the Service, or to comply with law.

You are responsible for keeping your sign-in credentials confidential, enabling two-factor authentication, securing the devices you use to access the Service, and managing the access you grant to others. No method of transmission or storage is perfectly secure. We cannot guarantee absolute security, but we protect personal information with safeguards appropriate to its sensitivity.

9. Privacy incidents

If we confirm a security breach affecting Customer Data, we will notify the affected Firm without undue delay. We will give it the information reasonably available to us to help it meet its own obligations. Because the Firm controls Customer Data, the Firm decides whether and how to notify its clients and regulators, and we will reasonably assist it. For personal information that Common Good Labs controls, we will report incidents to the appropriate privacy regulator and notify affected individuals where the law requires. We keep records of breaches as the law requires.

10. Retention

Because Clerra supports regulated financial and tax workflows, records (including documents and the audit trail) are retained for a configurable minimum period — seven (7) years by default — before they become eligible for deletion, consistent with common professional record-keeping practice in Canada. While a Firm’s account is open, Clerra never deletes the Firm’s documents automatically, including once that period has passed. A document can be deleted before the period ends only with the approval of one of the Firm’s Company Admins, confirmed with that admin’s own security code, and each such deletion is recorded in the audit trail. A document under a legal hold can’t be deleted. Firms may archive a client at any time. Each Firm is responsible for setting retention that meets its own professional and legal obligations.

We retain account information and Customer Data for as long as a Firm maintains its account. A Firm can export its data before closing its account. After an account is closed, we delete or de-identify Customer Data within a reasonable period, except where we must keep information to meet legal, tax, or accounting obligations, or to resolve disputes. Copies held in backups are removed as those backups expire in the ordinary course, and remain protected until then.

If you ask us for a demo, we keep your request (your name, email, firm, team size and message) for up to 24 months, then delete it.

11. Your rights

Subject to applicable law, you may request access to, or correction of, your personal information, and may withdraw consent (which may limit your ability to use the Service). Residents of Québec also have rights under Québec law, including the right to receive certain computerized personal information in a structured, commonly used technological format.

• If you are a member of a Firm, contact your Firm administrator or us.
• If you are a client of a Firm, please direct requests about your information to that Firm, which controls it. If you contact us, we will refer your request to the Firm and assist the Firm as its service provider.

We will respond within the time required by law, generally within 30 days. We may need to verify your identity first. We may decline a request where the law permits, for example where responding would reveal another person’s information or information subject to legal privilege.

If you have a concern, please contact our Privacy Officer first (section 16) so we can try to resolve it. You also have the right to complain to the Office of the Privacy Commissioner of Canada or the privacy regulator of your province, such as the Commission d’accès à l’information du Québec.

12. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, maintain security (including bot protection), and remember your preferences. Our error-monitoring provider uses browser technologies as described in section 6. We do not use advertising cookies or cross-site tracking cookies. Clerra’s public website uses Vercel Web Analytics to count visits. It doesn’t use cookies and doesn’t identify you personally; that data is processed by Vercel in the United States. The public website also sets one first-party cookie, clerra_src, for up to 90 days. It records how you first arrived (campaign tags, the referring website and the first page you visited), never your name, email or other personal details. If you create an account, this is saved with your firm’s account so we can see which of our marketing works.

13. Children

The Service is intended for businesses and is not directed to individuals under the age of majority. We do not knowingly collect personal information directly from children. A Firm may hold information about its clients’ dependants as part of its professional services. That information is Customer Data, and the Firm is responsible for it.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post changes here with a revised “Last updated” date. For material changes that reduce your privacy protections, we will give Firm administrators reasonable advance notice by email or within the Service, normally at least 30 days, unless a change is required sooner by law.

15. How this policy relates to our agreements

This policy describes our privacy practices. It is not a contract and does not create contractual rights or obligations. Our relationship with Firms is governed by our Terms of Service, our Data Processing Addendum, and any other written agreement with the Firm. If a written agreement with a Firm conflicts with this policy about Customer Data, the agreement prevails.

16. Contact us

Common Good Labs Inc. is the organization responsible for personal information under its control. Our Privacy Officer is the person in charge of the protection of personal information. To exercise your rights, ask a question, or make a complaint, contact the Privacy Officer, Common Good Labs Inc., at privacy@commongoodlabs.ca.