Privacy Policy

Who is responsible

ParagonBooks is provided by Altumo Software Inc., at 99603 Market Crossing, Burnaby, British Columbia, Canada. We are responsible for the personal information we hold about you.

We are a British Columbia company, so British Columbia’s Personal Information Protection Act governs how we handle personal information in British Columbia. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs it when it crosses provincial or national borders. For people in Québec, Québec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, also applies.

The person in charge of protecting personal information is our Privacy Officer, at hello@altumo.com.

What we collect

Your account. Your name and email address. You sign in with a one-time code sent to that address, and ParagonBooks holds no password. If you add a passkey or an authenticator app, our sign-in provider holds what it needs to check it. We also record sign-in events and your active sessions so you can see and end them.

Your books and records. What you and the people in your organizations enter or import: accounts, transactions, bank files, invoices, bills, payroll, tax returns, cap tables, plans and the rest. This often includes information about other people, such as employees, customers, suppliers and shareholders.

Documents. Receipts, bills, statements and other files you upload, and the details ParagonBooks reads from them.

Conversations with Paragon. Your questions and its answers. Paragon also remembers things you tell it, such as decisions and preferences, so it doesn’t ask twice. You can see everything it remembers on its “What I remember” page, and correct or delete any item there. In books you share, each person’s memory is their own.

Voice. When you dictate, the recording is sent for transcription and isn’t stored. A recording you upload as a file is kept with your other files.

Email at a ParagonBooks address. If you receive mail at a ParagonBooks email address, we store a copy for as long as you choose and forward it to your own inbox. Receipts and bills in that mail can become records in your books.

Feedback. What you send through “Send feedback”, including any screenshot or voice memo you attach.

Technical logs. Requests to the service, with times, IP addresses and error details, kept to run and secure the service.

This website. https://paragonbooks.net sets no cookies, runs no analytics and loads nothing from other companies. Its server keeps standard request logs.

Why we use it

We use your information to:

• provide the service: keep your books, prepare returns and reports, answer your questions and send the reminders and notices you rely on;
• sign you in and keep your account and organizations secure;
• keep the audit trail and the tamper-proof ledger;
• meet our legal obligations, such as keeping records for the period tax law requires;
• answer your requests and feedback.

Product analytics and news by email are separate choices. Both are off unless you turn them on in the app, and turning them off never affects the service. We don’t run either today.

We don’t use your information for advertising, and we don’t sell it, rent it or share it for anyone else’s marketing.

Who we share it with

People you choose. Members of your organizations see what their roles allow. A professional you invite, a data-room guest you invite, and anyone you send an invoice, report or export to receive what you send them.

Our service providers. A few companies process information for us so we can run the service. Each is bound by contract to use it only for that purpose. The Subprocessors page lists them.

When the law requires it. We disclose information when the law requires it, for example in answer to a valid court order or a demand from the Canada Revenue Agency. We give out only what is required, and we tell you unless the law forbids it.

If the business changes hands. If Altumo Software Inc. or the ParagonBooks business is sold or merged, your information may pass to the new owner, who must keep honouring this policy.

Where your information is kept

ParagonBooks’s production service, with its database and stored files, is hosted in Burnaby, British Columbia, Canada.

Some information leaves Canada. Three of our service providers are in the United States:

• Sign-in (Clerk): your name, email address, sign-in methods and sign-in events.
• Paragon’s answers and speech to text (OpenAI): the question you ask and the parts of your records that question needs, documents you ask Paragon to read, and dictated recordings.
• Email (Resend): the addresses and contents of the email ParagonBooks sends, such as deadline reminders, digests, invitations and the invoices you send to your customers, and mail received at a ParagonBooks address.

Information held in another country may be accessible to that country’s courts, law enforcement and national security authorities under its laws. We use contracts to require these providers to protect your information as we would.

If you turn on notifications on your phone or computer, your browser’s push service (run by the browser’s maker) delivers them. The notice is encrypted so that only your device can read it.

Paragon and AI

When you ask Paragon something, it reads your records as you, seeing only what your role allows in the organization you have open, and sends the AI provider only what that question needs. We ask the provider not to store each request. OpenAI’s terms for its API say it doesn’t use API data to train its models unless the customer opts in, and we haven’t. OpenAI may keep requests for up to 30 days to watch for abuse; transcription requests aren’t kept.

Your information is not used to train AI models, ours or anyone else’s. If we train our own models, the only data drawn from customers that can enter training is synthetic data produced by an anonymizer that runs inside the same protected environment as your books and is checked so that it can’t identify anyone. Identifiable customer data never enters training. We don’t run that anonymizer today, and we will update this policy and tell you before it uses your information.

Automated decisions

ParagonBooks doesn’t make decisions about you as a person, such as about credit, employment or eligibility, by automated processing alone.

Paragon’s proposals are drafts that a person confirms. If your organization allows it, ParagonBooks codes routine bank lines on its own (see the Terms of Service); each is marked as automatic and can be undone. If you think Paragon made a decision on its own that affects you, you can ask in the app for a person to review it, ask what information and main factors it used, and correct that information.

How long we keep it

Posted books and the documents behind them are kept for at least six years from the end of the last tax year they relate to, as Canadian tax law requires. Nothing in that period is destroyed early, even if an organization is closed. The audit trail is kept as long as the books it describes, and it can’t be edited or deleted by anyone.

Stored copies of mail follow the retention you choose (30, 90 or 365 days, or forever). Sessions and operational logs are kept only as long as needed to run the service. Records of security breaches are kept for at least 24 months.

When an organization is closed, you receive the full export, the books are frozen until the retention period ends and then destroyed, and everything else is removed. Because the books and audit trail must be kept, asking us to delete your information can’t erase what you recorded in them during that period; we delete or anonymize everything else.

Your rights

You can:

• See your information. Ask in the app (Settings, then Data & privacy) and your personal export is ready at once, or write to our Privacy Officer.
• Take it with you. Personal and organization exports come in common formats any software can read.
• Correct it. Change it yourself in the app, or ask in the app or by email. Corrections to posted books are made by a correcting entry, so the history stays intact.
• Withdraw consent. Turn optional uses off at any time. You can also close your account, subject to the record-keeping rules above.
• Ask for a human review of a decision made by automated processing alone.

We answer within 30 days. If we need longer, we will tell you why within those 30 days. We may need to confirm your identity first.

Questions and complaints

Write to our Privacy Officer at hello@altumo.com. We will look into every complaint and tell you the outcome.

If you aren’t satisfied, you can complain to the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec if you are in Québec, or the Office of the Information and Privacy Commissioner of Alberta if you are in Alberta.

If something goes wrong

If personal information is lost, accessed or disclosed without authorization, we act at once to contain it and reduce the harm. We assess whether it creates a real risk of significant harm to anyone. If it does, we report it to the privacy commissioners concerned and notify the people affected as soon as we can, with what happened, what information was involved, what we have done and what you can do. We record every breach, whether or not it had to be reported, and keep the record for at least 24 months.

How we protect it

• Roles and organization membership are checked on every request, for reading as well as changing, and the database keeps each organization’s records apart as a second barrier.
• Connections to the service are encrypted.
• Every material change is recorded in an audit trail that can’t be rewritten.
• Our own staff’s access is limited to what their work needs.

The Security page says more, and how to report a problem.

Children

The service is for adults and isn’t directed to children. We don’t knowingly collect children’s information except as records an adult keeps, such as a dependant on a tax return.

Changes to this policy

The effective date and version are at the top of this page. If we make a material change, we will tell you by email and in the app before it takes effect.