Privacy Policy

CubeBooks is built and operated by iCubeLabs, based in Laval, Québec, Canada. We are the party responsible for the personal information described in this policy. You can reach us at privacy@cubebooks.ai about anything on this page.

This policy covers the CubeBooks web application, the iOS and Android apps, and the cubebooks.ai website.

Three kinds of information, and nothing beyond them.

• Account information — your name, email address, company name, and the country and province or state you file taxes in. This is what identifies you and determines which tax rules apply.
• Your books — invoices, bills, receipts, expenses, journal entries, payroll records, customer and supplier contacts, and bank transactions you import or connect. This is your business data. It includes personal information about third parties, such as a customer name on an invoice, which you provide and remain responsible for.
• Usage information — which screens you open and which features you use, along with error reports when something fails. We use this to find defects and to decide what to build next.

We do not collect location data, we do not read your device contacts, and we do not run advertising or third-party analytics trackers in the product.

To run the service you are paying for: keeping your books, producing your statements and filings, sending the invoices and reminders you ask us to send, and answering you when you contact support.

To bill you, to secure your account, and to comply with our own legal obligations — Canadian bookkeeping records carry statutory retention periods that apply to us as well as to you.

We do not sell your information, we do not rent it, and we do not share it with anyone for their own marketing.

CubeBooks reads documents you upload and drafts bookkeeping entries from them, transcribes what you dictate, and — if you enable the receptionist — speaks with people who call your business number. Those features send the relevant content to specialist providers to process: Anthropic and OpenAI for language and transcription, Vapi and Twilio for telephony.

What is sent is limited to what the task needs: the document being read, the sentence being transcribed, the call being handled. Under our agreements with those providers, your content is not used to train their models.

Automated entries are drafts. Nothing posts to your books, and no payment is ever taken, without a person approving it.

Where the receptionist places or answers a call, it identifies itself as an automated assistant, and calls are recorded only where you have enabled recording and the applicable law permits it.

We use a small number of service providers, each for one job, each bound by contract to handle your information only on our instructions.

• Supabase — application database, file storage and authentication.
• Stripe — subscription payments. Card numbers go to Stripe directly and never reach our servers.
• Plaid — bank account connections, where you choose to connect one.
• Anthropic and OpenAI — document understanding, drafting and transcription.
• Vapi and Twilio — the voice receptionist and outbound calls, where enabled.
• Google, Intuit QuickBooks, Xero and Dext — only when you import from them, and only for that import.

We may also disclose information where the law requires it, or to protect our rights or someone’s safety. If we are ever compelled to hand over your records, we will tell you unless we are legally barred from doing so.

Your books are stored in Canada. Some of the providers above process data in the United States and the European Union, which means your information may be transferred outside Canada and may be accessible to authorities in those jurisdictions under their own laws.

We say this plainly because Québec’s Law 25 requires it, and because it is the kind of thing a policy should not bury.

While your account is open, we keep your books so that you have them. When you close your account we delete your data within 30 days, with one exception: records we are required to retain by tax and corporate law, which we keep for the statutory period and use for nothing else.

Backups are retained for 35 days and then overwritten, so a deletion can take up to that long to disappear from every copy.

You can see what we hold, correct it, export it, or have it deleted. Most of this you can do yourself: Settings has a full export of your company’s data, and Settings → Account will delete your account.

For anything you cannot do from the app, write to privacy@cubebooks.ai and we will answer within 30 days. If you are in Québec and you are not satisfied with our answer, you may complain to the Commission d’accès à l’information; elsewhere in Canada, to the Office of the Privacy Commissioner.

Your data is encrypted in transit and at rest, access is scoped so that one company cannot read another’s books, and administrative access is limited to the people who need it. The Security page sets this out in more detail.

If a breach ever puts you at risk of serious harm, we will notify you and the relevant regulator, as Law 25 and PIPEDA require.

CubeBooks is a business product and is not directed at anyone under 16. We do not knowingly collect information from children.

If we change this policy in a way that matters, we will tell you in the app before it takes effect, and the date at the top will change. Older versions are available on request.