Privacy policy

1. What data we handle

About the people who use the portal: name, e-mail, language, the customer they belong to and their role. We keep the password only as a one-way hash, and the second-factor secret encrypted.

About the customer's operations: containers, bills of lading, customs declarations, EDI documents, orders and invoices. These may include the names and contact details of people at its partners.

Technical: IP address, the date and action of each significant change (audit log), and server logs for security and support.

If someone asks for access or writes from the front page: their name, company, e-mail and message.

2. What we use it for

To provide the service the customer contracted, send the alerts it sets up, protect accounts, provide support, invoice and comply with the law. We do not sell personal data, use it for advertising, or share it for others to use for their own purposes.

3. QuickBooks Online

If the customer connects QuickBooks Online, Intuit gives us, with the customer's permission, access to the customer's company. With it we read customers, items, vendors, expense accounts and invoices. We create estimates from orders received by EDI, and vendor bills for duties and taxes. QuickBooks invoices for trading partners are sent as EDI documents.

We keep the access tokens encrypted, and only the links and records needed so the sync is not repeated. We do not use QuickBooks data for any other purpose. The customer can disconnect QuickBooks from the portal at any time: we revoke the access at Intuit and stop reading and writing.

4. Who we share it with

Only with the providers we need to run the service, each limited to that task:

Google Cloud: servers and backups, in Montreal, Canada. Cloudflare: the network that delivers and protects the site. Zoho: sending e-mail. ShipsGo: container tracking; it receives container and bill of lading numbers. Intuit: only if the customer connects QuickBooks. Our payment provider: when the customer pays its invoices by bank transfer. Also the EDI partners and systems the customer asks us to send its documents to.

Some of these providers may process data outside Canada, for example in the United States, where that country's laws apply. We may also disclose data when the law requires it.

5. How long we keep it

While the customer's account is active. When the account is closed, we delete it entirely 30 days later, with its documents and keys. Backups delete themselves after 7 days. Records the law requires us to keep, such as invoices, are kept for as long as it requires.

6. Security

Encryption in transit (HTTPS), keys and tokens encrypted at rest, two-factor authentication, role-based permissions, and separation of each customer's data in the database. No system is infallible: if an incident affects your data, we tell the customer and the authorities as the law requires.

7. Cookies

The portal uses a single cookie, the session cookie, needed to keep you signed in. We use no advertising or analytics cookies, and no third-party trackers.

8. Customers and their people

For its operational data, the customer decides what to upload, and we handle it on the customer's behalf and on its instructions. If you are an employee or partner of a customer, you can write to the customer or to us.

9. Your rights

You can ask us for access to your personal data, correct it, withdraw your consent where it is the basis for the processing, or ask how we use it. We answer within the legal time limits, normally 45 days. If you are not satisfied, you can contact the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.

10. Changes

If we change this policy, we post the new version here with its date and tell customers about important changes.

11. Contact

Privacy officer: Lexer Technologies Inc., Edmonton, Alberta, Canada. E-mail: [email protected].