Duebird Privacy Policy

1Our role and the business using Duebird

For account registration, subscription billing, website inquiries, service security and our legal administration, Finofo determines the purposes for handling the information. When a business customer submits records about its customers, employees, suppliers or signers, we generally process that Customer Content on its instructions to provide Duebird, subject to our own legal obligations. Our Terms of Use include a processing schedule for this work.

If you receive an invoice, reminder or contract through Duebird, the sending business is responsible for the transaction and its instructions about your information. Contact it about invoice amounts, payment status, contracts or corrections to its records. We also accept requests about our processing and will assist or route them while meeting our own legal duties. Finofo is not the seller of that business's goods or services.

2Information we handle and where it comes from

Account and business information. We receive names, business email addresses, job titles, phone numbers, organization names, business addresses, country, currency, tax details, workspace membership and role settings from account users and administrators. Where you use Google or Microsoft sign-in, we receive the identity information and identifiers authorized by that sign-in process. Credentials, authentication sessions and API tokens are handled to control access.

Customer Content. You or the business using Duebird may provide customer and supplier contact details, purchase orders, contracts, invoices, credit notes, products, prices, delivery or service records, payment references, remittance information, disputes, promises to pay, bank payment instructions, tax registrations and exemption documents. Content also includes relevant customer correspondence, post-sales account records, relationship context and contract renewal information used by AR teams, account managers and salespeople. Content may arrive as uploaded files, connected accounting records, authorized Gmail messages and attachments, inbound emails and attachments, chat instructions, photos or audio. It may identify employees, contractors, customers, vendors, recipients or other people mentioned in those materials. Do not submit unnecessary sensitive personal information.

AI processing and derived information. We process extracted text, OCR results, audio transcriptions, document classifications, summaries, search representations, proposed matches, draft records, billing calculations and payment-behaviour summaries generated from Customer Content. These can be personal information when they concern an identifiable person. We also retain relevant instructions, proposals, approvals, corrections and AI activity records for operation and traceability.

Electronic document information. When you view, accept, decline, delegate or sign a quote or contract, the service may record your name, email, title, choices, typed or drawn signature, consent, timestamps, IP address, browser information, document version or fingerprint, and a history of signing events. Some form progress may be saved before final submission. This supports the customer's document workflow and transaction evidence; it is not a guarantee that a person's legal identity was independently verified.

Subscription, support and technical information. We receive subscription and transaction records from the payment arrangements used for your purchase and information you provide in support requests. We also handle connection and activity logs, IP addresses, browser or device details, errors, authentication events and service usage information needed to operate, secure and troubleshoot Duebird. Payment collection for your Duebird subscription is separate from the payment information contained in your business's invoices.

Website information. On the public marketing website, we receive information you submit in contact or signup forms and basic request and security information. We use Google Analytics 4 there as described in Section 6. We do not place Google Analytics 4 tags inside customer workspaces or the public quote and contract signing pages.

3Why we use information

We use information to register and administer accounts, verify access and authority, provide support, manage subscriptions and process related billing; receive and organize evidence; prepare billing work and customer documents; help AR teams, account managers and salespeople manage receivables, post-sales coordination, customer relationships and contract renewals; summarize relevant customer correspondence and prepare email drafts for a person to review and send; operate authorized AI, tax, signing, email and accounting workflows; record decisions and maintain transaction history; prevent fraud, investigate misuse and safeguard the service; respond to requests, disputes and legal obligations; and measure the public marketing website as described below.

We use Customer Content to provide, secure and support the customer's service, rather than to build advertising profiles or market unrelated Finofo products to people listed in that content. A Finofo customer relationship or shared brand does not give us permission to use Duebird records for unrelated purposes. We may use non-content operational statistics to improve performance and reliability. If information is anonymized, it must no longer reasonably identify a person or customer, and we will not attempt to re-identify it.

We send service communications needed for accounts, security, billing and the business workflows that customers authorize. Our own optional marketing communications are separate and sent only as permitted by law; recipients may unsubscribe using the provided method or contact us. Opting out of marketing does not prevent necessary service or transaction communications.

4AI processing and connected services

Duebird uses Google's AI models through Vertex AI. Relevant Customer Content and task context are sent for activities such as reading files and authorized customer correspondence, transcribing audio, classifying messages, finding related records, generating summaries and draft text, and suggesting billing changes. Email drafts may support receivables, post-sales coordination, customer relationship management and contract renewals. We do not use Customer Content to train or fine-tune models, and we do not permit our AI provider to use it for model training. We do not use other companies' AI models for Duebird's own AI processing. This statement does not imply that email or other infrastructure providers never use their own subprocessors.

No training does not mean no storage: Duebird and authorized provider systems may retain information for processing, operations and security under applicable agreements. We do not promise zero AI-provider retention. Users must review AI output before consequential actions. Draft billing work can be automated; sending, signing, approving and accounting posting require the relevant authorization. We do not independently use payment-behaviour summaries to decide a person's lending or credit eligibility.

When you enable a supported ERP connection, such as QuickBooks Online, Duebird exchanges the authorized customer, item, invoice, credit, payment, account, tax and related accounting records needed for the feature. Where Google or Microsoft sign-in is offered, the identity permissions requested are presented through that provider. Mailbox integration currently supports Gmail, including Google Workspace Gmail accounts; this policy does not describe an active Outlook or Microsoft 365 mailbox integration. The Gmail permission screen identifies the requested mail access. AI prepares drafts, and a person must review and click Send for every message. A connection to send email does not by itself mean Duebird imports your mailbox. Emails sent or forwarded to an organization-specific Duebird inbound address are a separate intake route.

A Gmail account can also be connected as a mailbox for an organization. An organization administrator connects a mailbox the team shares, such as an accounts receivable address; a person connects their own Gmail for one organization at a time, only where that organization allows it and after accepting a notice. Duebird then reads the mailbox's messages from 90 days before the connection onwards, stores the messages and attachments relevant to the organization's billing, receivables, post-sales account management, customer relationships and contract renewals, adds a 'duebird' label in Gmail to messages it files, and sends the messages you choose to send. In a person's own Gmail, Duebird first reads only message headers and brings in only conversations with one of the organization's customers; mail only among the organization's own domains, mail involving addresses the organization or the person excluded, and other mail is not stored. Mail brought in from a person's own Gmail is visible only to that person until they file a document from it or reply from a shared mailbox.

When a message is deleted in a connected Gmail mailbox, Duebird deletes its copy, and deletes the message itself unless it has become part of a business record such as a filed document, an invoice or a sent reply. Disconnecting a mailbox deletes, within a short time, the messages it brought in that are not part of such a record, together with their search index entries. Records that cite a message, such as invoices or documents filed from it, are kept under the organization's retention terms.

Incoming mail can be classified using sender, subject, message text and attachment metadata before a person admits an attachment for detailed processing. Do not assume that refusing an attachment at the admission step means no information from the incoming message was previously processed. Revoking a connection stops future authorized access. Content received through a connected Gmail mailbox is deleted as described above; content received by other routes, and records already posted to an external system, are not erased by revoking a connection.

Duebird's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Information received from Gmail is used only to provide the user-facing features described above: bringing relevant customer correspondence and documents into the organization's Duebird workspace, providing account context and summaries, preparing draft messages for receivables, post-sales coordination, customer relationship management and contract renewals, threading replies, labelling filed messages and sending messages a person chooses to send. It is transferred only as needed to provide those features with the user's consent, for security, to comply with law, or for a business transfer subject to the policy's required explicit prior user consent. Nobody at Finofo reads Gmail information except with the user's affirmative agreement to view specific messages or other data, as necessary for security, as necessary to comply with law, or where the data is aggregated for internal operations in accordance with applicable law. We do not use Gmail data for advertising, to train or fine-tune AI models, or to determine creditworthiness, and we do not sell it.

5Who receives information

The business and its authorized users. Customer Content is made available according to workspace and organization permissions and workflow settings. Administrators control membership and roles. Customers may choose to send documents or messages to recipients, obtain signatures or write records to an accounting system. Those recipients and connected systems then handle their copies under the applicable relationship and law.

Service providers and authorized personnel. We use Google Cloud for application infrastructure, database and file hosting in the United States and Canada; Google Vertex AI for AI processing; Resend for email delivery and enabled inbound email; and Google Analytics 4 for measurement on the public marketing website. Subscription payment providers and connected identity, mailbox or ERP services receive information relevant to the transactions or connections you authorize. Finofo employees and contractors may process information only for authorized work under confidentiality and access restrictions, including the Google API restrictions in Section 4 and the location restrictions in Section 7. Finofo requires appropriate contractual protections from processors and remains accountable for the obligations it delegates.

Professional and legal recipients. We may share necessary information with professional advisers subject to confidentiality, and disclose information where legally required or reasonably necessary to protect rights, investigate fraud or security threats, or address a dispute, consistent with applicable law. We assess requests and limit disclosure to what is appropriate rather than providing unrestricted access.

Business changes. Information may be reviewed for a financing, reorganization, sale or merger under confidentiality and legal safeguards, and transferred only lawfully. Any successor receiving information must use it consistently with the protections and purposes that apply to it. We will provide required notices and obtain required consent. Information received from Google APIs remains subject to the Google API Services User Data Policy, including its Limited Use requirements and any required explicit prior user consent for a business transfer. Information disclosed for an abandoned transaction must be returned or deleted as required.

We do not sell Customer Content or disclose it for targeted advertising. Our website measurement is described in Section 6; we do not use customer invoice, email, contract or signing content as website analytics event data.

6Website cookies and Google Analytics 4

We use cookies or similar storage needed for website and service functions such as authentication, session security and remembering choices. The public marketing website also uses Google Analytics 4 to measure traffic, page views, engagement and campaign or referral sources. Depending on consent and browser settings, measurement can involve cookies, online identifiers, browser or device details and event information. Google receives information when its measurement technology communicates with its systems and processes that information under the applicable Google terms and privacy disclosures.

Google Analytics 4 is used for website measurement, not Google Ads remarketing or advertising audiences. We do not enable Google Signals, advertising personalization, advertising account linking or user-provided-data collection for this measurement. We do not send names, email addresses, form contents, customer documents or financial records as analytics events. Analytics tags are excluded from authenticated workspaces and document acceptance or signing pages. Google's explanation of how it uses information from sites that use its services is available at https://policies.google.com/technologies/partner-sites .

Where consent is required, nonessential analytics will not run before the relevant consent. You can reject or withdraw analytics consent through the website's privacy or cookie controls and adjust browser cookie settings. Rejecting nonessential measurement does not prevent use of the core service. Withdrawal affects future processing and does not erase every record already lawfully processed. We honour legally required opt-out preference signals where applicable to the processing. Essential security and session functions may continue. Browser controls, extensions and settings can also limit tracking.

7Processing locations and international access

Our Google Cloud application hosting uses facilities in the United States and Canada. That is not a Canada-only residency guarantee and does not mean every service-provider activity occurs exclusively in those two countries. Google AI, email delivery, website measurement, provider security and support processing may involve other locations under the relevant provider agreements and configurations. Resend uses US service providers for email infrastructure. Connected services and message recipients may process information in their own locations.

Finofo restricts its own employees' and contractors' access to production Customer Content to Canada and the United States; production access from India or other countries is not authorized. This personnel restriction is distinct from processing by contracted infrastructure providers and their authorized subprocessors. We use appropriate contractual and organizational protections for international processing, including any safeguards required by applicable law. Information processed abroad can be subject to lawful access by courts or public authorities in those jurisdictions.

For information about our policies and practices concerning providers outside Canada, the purposes of their processing and how to exercise your choices, contact the Privacy Officer at [email protected] or the mailing address in Section 12. Customer-specific residency requirements must be expressly agreed before the affected data is submitted.

8Retention deletion and customer records

Customer Content is kept while needed to provide the active service, subject to lawful instructions and retention requirements. An authorized customer has 30 days after subscription expiry or termination to request an export through [email protected]. We arrange a reasonably usable export; a general self-service bulk export feature is not promised. We delete the affected content from active production systems within the following 30 days and expire remaining backup copies within 90 days after active deletion. In the ordinary case, that is up to 60 days after expiry for active deletion and up to 150 days after expiry for backup expiry.

A valid earlier request can accelerate deletion where lawful. A document's delete control may be blocked while it supports other records; contact the administrator or us for review. Deleting a user or revoking a connection does not necessarily erase organizational records. Backups are isolated from ordinary use, and deletion restrictions are reapplied after recovery.

We may retain limited subscription, tax, accounting, consent, security, dispute or legal records where needed for legal duties, an active claim or a documented and proportionate operational purpose. We do not use that exception to retain the whole workspace indefinitely. We restrict access and further use, periodically review the need and delete or anonymize when it ends. Marketing contacts are kept until no longer needed for the relationship or you opt out, subject to limited suppression records needed to respect your choice. Website measurement follows the configured analytics retention period and valid deletion or choice mechanisms; contact us for the current setting.

Records already sent to a business's customers, signers, accounting provider or other recipients are not erased from their systems by closing Duebird. The business remains responsible for its own statutory retention and copies. A customer cannot instruct us to delete records we must lawfully preserve, and we will explain a restriction where permitted. Provider deletion processes and lawful retention may affect copies under their control; we require corresponding protection and appropriate deletion instructions rather than promising that every external copy disappears immediately.

9Safeguards and incidents

We use safeguards designed to be appropriate to the nature and sensitivity of the information, including access restrictions, role-based account permissions, protected service communications and contractual confidentiality requirements. We review access and respond to suspected incidents. These statements do not claim a particular audit certification, perfect security, a guaranteed recovery time or the absence of all risk.

Customers must manage their users, roles, devices, API tokens, mailbox and accounting permissions and the information they choose to share. If a personal information breach occurs, we investigate, take reasonable steps to contain it, notify affected customers and other parties as required, and meet applicable regulator and individual-notification duties. Report a concern to [email protected] without including unnecessary sensitive information in the first email.

10Your requests choices and complaints

Subject to applicable law and exceptions, you may request access, information about use or disclosure, correction, deletion or withdrawal of consent for optional processing. Some US state laws also provide portability, opt-out, sensitive-information or appeal rights. These depend on the law and circumstances; not every state statute applies to Finofo or to business contact information.

Send requests to [email protected] and describe the relationship or account involved. We may take proportionate steps to verify identity and authority, including the authority of an agent, and will respond within the applicable legal period. We will explain an applicable refusal or extension and any available review or appeal route. We do not penalize a person for exercising a protected privacy right. Withdrawal may affect features that require the information, but optional analytics or marketing choices do not require abandoning the core service.

If the information is in a customer's business records, we may refer the request to that business and assist it, while meeting our own obligations. We cannot simply alter an invoice or signed contract on the request of someone whose authority is unverified. Contact our Privacy Officer first with a complaint if you wish; you may also approach the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada or another competent authority without first obtaining our permission.

11Children and policy changes

Duebird is a business service intended for adult users, not a service directed to children. We do not knowingly seek children's personal information for accounts or marketing. Customers must not use it to submit children's information without a separate lawful and supported arrangement. If you believe a child has supplied information inappropriately, contact us so we can assess and address it.

We may update this policy as our practices or legal duties change. We will update its effective date and give appropriate notice of material changes, including direct notice where required. A new purpose or disclosure that requires fresh consent will not be authorized merely by posting an update or treating continued use as acceptance. The version effective when information was handled remains relevant to the lawfulness of that processing.

12Contact

Privacy Officer, Finofo Inc.

Email: [email protected]

Mailing address: 700 2nd Street SW, Suite 2320, Calgary, Alberta T2P 2W2, Canada

For legal and contractual notices, contact [email protected].