Privacy policy

Heedlight ("we", "us") provides practice management software to accounting, tax, bookkeeping and similar firms ("practices"). This policy explains what personal information we handle, why, and your choices. It follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Two kinds of information

Information practices keep in Heedlight about their clients. When a practice uses Heedlight to serve you (for example, your accountant's client portal), the practice decides what is collected and why, and is responsible for it. We process that information only to provide the service to the practice, under our agreement with them. Questions about it, or requests to see or correct it, are best sent to the practice; we will help them respond.

Information about our own customers and visitors. For practice owners and staff, people who ask for early access, and visitors to heedlight.com, we are responsible for the information and this policy describes how we handle it.

What we collect

• Account details: name, email, phone number, practice name, role and sign-in settings.
• What you send us: early access requests, support messages and feedback.
• Usage: pages visited, actions taken, device and browser type, IP address and times, used to run, secure and improve the service.
• Billing details for the Heedlight plan. Card numbers are handled by our payment processor, Stripe; we never store them.

How we use it

• To provide, secure and support the service, and to keep a record of changes (an audit history).
• To send service messages: sign-in links, invitations, notifications you've asked for, and billing.
• To reply to early access requests and support questions.
• To understand how the service is used and make it better.

We do not sell personal information, and we do not use practices' client information to market to anyone.

Service providers

We use a small number of providers to run Heedlight, under contracts that limit them to providing their service:

• Hosting and storage of the application and its data.
• Postmark, to send and receive email.
• Twilio, to send text messages when a practice turns them on.
• Stripe, to process card payments.
• Anthropic, for the optional AI assistant. Social insurance numbers, business numbers, email addresses and phone numbers are removed before text is sent to it, and a practice can turn the assistant off.
• DocuSeal, run on our own servers, to collect signatures on documents a practice sends.
• An error monitoring service, to find and fix problems.

These providers may store or process information outside Canada, including in the United States, where it may be subject to the laws of that country.

Connecting an AI assistant

You can choose to connect an AI assistant you use, such as Claude, ChatGPT, Microsoft Copilot or Google Gemini, to Heedlight. You sign in and approve it, and you can disconnect it at any time from Heedlight or your client portal. A practice can turn this off for its team or its clients.

• The assistant can see and do only what you can in Heedlight or your portal, and for a client, only for the files you chose when connecting.
• Social insurance numbers, business numbers, account numbers and bank details are never shared with an assistant.
• What the assistant receives from Heedlight, and what you send through it (such as a document), is handled by the assistant's provider under its own terms and privacy policy, which you agreed to with that provider. Before you send your first document through an assistant, we tell you this and offer a secure upload link instead.
• Messages to clients, payments and signatures are never completed by an assistant alone: a person confirms messages, and payments and signatures happen on secure Heedlight pages.
• We record what is done through an assistant, with who did it and which assistant, in the practice's history.

How we protect it

Information is sent over encrypted connections. Social insurance numbers and business numbers are encrypted in the database, shown masked, and revealed only to people a practice allows, with each reveal recorded. Every practice's records are kept separate. Staff can protect their accounts with two-step sign-in.

How long we keep it

We keep a practice's information while it uses Heedlight. When a practice leaves, it can download a full backup first; we then delete its information within 90 days, except where we must keep records longer by law (for example, billing records).

Your choices

You can ask to see, correct or delete personal information we hold about you, and you can withdraw consent to optional messages at any time. Write to us at the address below. If you are a client of a practice, contact the practice first. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Cookies

We use cookies that are needed to sign you in, keep your session secure and remember your settings. We do not use advertising cookies.

Changes

If we change this policy in a way that matters, we will tell practices by email and in the app before the change takes effect.

Contact

Privacy questions: support@heedlight.com.