Privacy Policy

Who we are

1001494310 ONTARIO INC. d/b/a InletAP, 10 Macphail Ave, Toronto, ON, M4K 4A2, Canada. We are the business responsible for this website and for the account data described below. Privacy questions and requests go to privacy@inlet-ap.com, or by post to the same address.

Information we collect

Account information: the names, work email addresses and roles of the users you invite to your workspace. It is used to operate the workspace and kept for as long as the workspace is active.

Invoice content: the documents your team forwards or uploads, and the fields extracted from them, such as vendor, property, amounts, dates and GL coding. An invoice can carry personal information about a supplier, a contractor or a tenant, which is why it is treated as your accounting record and used for nothing but running the service.

Usage information: the actions taken in the workspace — reviews, approvals, rule changes and exports — recorded so the audit log remains complete.

Billing information: the subscription, plan and billing contact for your organization. Card details are handled by our payment processor and never reach our servers. Financial records are kept for the six years Canadian tax law requires.

Website information: the pages visited on this marketing site, the campaign or link that brought you here, and, unless you have opted out, the cookies set by the advertising tags described below. Raw inbound email messages are deleted after 90 days and application logs after 30 days.

We do not collect what California calls sensitive personal information — no government identifiers, precise geolocation, health or biometric data, and no credentials beyond what signing in requires. We do not knowingly collect information from children: InletAP is a business product and is not directed at them.

How we use information

We use it to operate the service: extracting invoice fields, routing documents for approval, producing exports, and maintaining the audit trail your controller relies on.

We use aggregate, non-identifying usage information to diagnose problems and improve accuracy. We do not sell your data or use your invoice content for advertising, and no workspace data is sent to an advertising network at any time.

Cookies, advertising and your opt-out

The marketing site can load four advertising-network tags: the Meta pixel, the Reddit pixel, the Microsoft advertising (UET) tag and the LinkedIn Insight tag. They set cookies and tell those networks that a browser visited a page here, which is how we measure whether an ad worked. California law treats that as sharing personal information for cross-context behavioral advertising, and several other states treat it as targeted advertising, so you can switch it off: Do Not Sell or Share My Personal Information. We do not sell personal information for money, and we have never done so.

If your browser sends the Global Privacy Control signal, we read it on every visit and treat it as an opt-out of sale and sharing. No advertising tag loads, you do not have to tell us anything else, and we will not ask you to confirm it.

In the EEA, the UK and Switzerland no advertising tag loads until you say it may, and you are asked when you first arrive.

Our own site analytics are not part of that opt-out, and it is more honest to say so than to bundle them in. They are first-party and deliberately small: page-view analytics that sets no cookie and stores nothing on your device, and product analytics run in a cookieless mode. Neither builds an advertising profile and neither is shared with an advertising network.

Access and confidentiality

Access to your workspace data is limited to the users you invite and to InletAP personnel who need it to provide support or resolve an incident.

Support access is logged. If you would prefer we not access a specific document, tell us and we will work from the details you provide instead.

Retention and deletion

Invoice documents, extracted fields and audit records are retained for as long as your workspace is active, because they form your accounting record.

On written request we will delete or export your workspace data. Records we are required to keep for legal or accounting purposes are retained only for as long as that requirement lasts.

Where your data is stored

InletAP is operated from Toronto, Canada, and runs on Amazon Web Services in the US East (Ohio) region. Data belonging to Canadian customers is therefore stored and processed in the United States, and is subject to United States law, including lawful access requests.

We use a comparable level of protection through contractual and technical measures, and we remain accountable for the data under PIPEDA.

Service providers

We use third-party infrastructure and accounting integrations to deliver the service, including your chosen ledger integration such as QuickBooks Online. Data shared with a ledger is limited to what the export requires.

A current list of service providers is available on request to privacy@inlet-ap.com.

Your choices

Workspace administrators can add or remove users, change approval policies, and request an export or deletion of workspace data at any time.

Questions about this policy or a specific data request can be sent to privacy@inlet-ap.com.

US state privacy rights

If you live in California, Colorado, Connecticut, Virginia, Texas, Utah or another state with a comprehensive privacy law, you have the right to know what personal information we hold about you and why, to receive a copy of it, to have it corrected, to have it deleted, and to opt out of its sale or of sharing it for cross-context behavioral advertising. We will not deny you service, charge you a different price or give you a worse experience for exercising any of them.

We honor these requests wherever they come from, without first arguing about whether our revenue or volume crosses the threshold that makes a particular state law apply to us. Business contact information is treated like any other personal information, because California stopped exempting it in 2023.

For the invoice content inside a customer's workspace we act as a service provider — a processor — for that customer. We handle it on that customer's instructions and only to provide the service: we do not sell it, we do not share it for cross-context behavioral advertising, we do not use it for our own purposes, and we do not combine it with personal information from anywhere else. If your information reached us on someone else's invoice, we will pass your request to that customer and help them answer it, because they hold the relationship and we do not.

How to make a request

Write to privacy@inlet-ap.com, or by post to 1001494310 ONTARIO INC. d/b/a InletAP, 10 Macphail Ave, Toronto, ON, M4K 4A2, Canada, and tell us what you are asking for. To opt out of sale or sharing you do not need to write at all — use the Your Privacy Choices control, or send the Global Privacy Control signal from your browser.

We verify who you are before releasing or deleting anything, usually by confirming from the account email and with your workspace administrator, and we ask for no more identification than the request needs. An authorized agent may act for you with written permission we can check.

We answer within 45 days, which is the California deadline, and within 30 days for a request under Canadian law. Where the law allows it a complex request may take one further extension, and we will tell you in writing before we take it. Every refusal is given in writing with the reason, with how to appeal it to us and which regulator you may complain to — the attorney general of your state, or the Office of the Privacy Commissioner of Canada.