Privacy Policy
Squares8 Privacy Policy
Welcome to Squares8’s privacy policy. This policy will help you understand what data we collect, why we collect it and what your rights are in relation to it.
Last updated: June 2, 2025
Table of contents
- Owner and data controller Types of data collected
- How and where Data is processed Purposes of processing
- Detailed information on the processing of Personal Data
- Additional information on Data processing and collection
- Definitions and legal references
Owner and data controller
Squares8 inc. – PO Box 79033, Laval, Québec, H7L 5J1
Owner’s contact e-mail : info@squares8.com
Type of Data we collect
The types of Personal Data that this Application collects directly or through third parties include:
- Usage data
- Payment information
- First name
- Last name
- E-mail address
- E-mail address of User’s accountants
- Device data
- Expenditure data
Full details of each type of Personal Data collected are provided in the sections devoted to this Privacy Policy or by specific explanatory texts published prior to the collection of the Data.
Personal Data may be freely provided by the User, or, in the case of Usage Data, collected automatically when you use this Application.
Unless otherwise specified, all Data requested by this Application are mandatory and their absence may make it impossible for this Application to provide the Services. In the event that this Application specifies that certain Data are not mandatory, Users are free not to communicate them without any consequences for the availability or operation of the Service.
Should Users have any doubts as to which Personal Data is mandatory, they are invited to contact the Owner.
Any use of Cookies – or other tracking tools – by this Application is intended to provide the Service requested by the User, in addition to the other purposes described in this document and in the Cookie Policy.
Users are responsible for any third-party Personal Data obtained, published or communicated through this Application.
How and where Data is processed
The types of Personal Data that this Application collects directly or through third parties include:
- Usage data
- Payment information
- First name
- Last name
- E-mail address
- E-mail address of User’s accountants
- Device data
- Expenditure data
Full details of each type of Personal Data collected are provided in the sections devoted to this Privacy Policy or by specific explanatory texts published prior to the collection of the Data.
Personal Data may be freely provided by the User, or, in the case of Usage Data, collected automatically when you use this Application.
Unless otherwise specified, all Data requested by this Application are mandatory and their absence may make it impossible for this Application to provide the Services. In the event that this Application specifies that certain Data are not mandatory, Users are free not to communicate them without any consequences for the availability or operation of the Service.
Should Users have any doubts as to which Personal Data is mandatory, they are invited to contact the Owner.
Any use of Cookies – or other tracking tools – by this Application is intended to provide the Service requested by the User, in addition to the other purposes described in this document and in the Cookie Policy.
Users are responsible for any third-party Personal Data obtained, published or communicated through this Application.
How and where Data is processed
Processing methods
The Owner takes appropriate security measures to prevent unauthorized access, disclosure, modification or destruction of Data, including:
- SOC2 Type 2 infrastructure
- Data encryption (AES-256)
- TLS encrypted communication
- Role-based access control
- DDoS protection
- Database with line-level security (RLS)
- Limited access to server administration for customer data
The Owner employs all possible and reasonable measures to protect the User’s information, however the User acknowledges that transmitted information cannot be immune from security breaches, malicious mischief, cyberterrorism or potential failures. The Owner cannot be held responsible for any damage caused, with the exception of damage resulting from gross or wilful negligence on the part of the Owner.
Data processing is carried out using computers or IT tools, following procedures and organizational methods closely related to the purposes indicated. In addition to the Owner, Data may be accessible, in certain cases, to certain categories of persons in charge of the operation of this Application (administration, sales, marketing, legal department, system administration) or to external parties (such as third-party technical service providers, courier services, hosting providers, IT companies, communications agencies) designated, where applicable, as Subcontractors by the Owner. An updated list of these parties may be requested from the Owner at any time.
Place of processing
Data is processed at the Owner’s headquarters and at all other locations where the parties responsible for processing are located.
Depending on the User’s location, data transfers may involve the transfer of the User’s Data to a country other than his or her own. To find out more about where such transferred Data is processed, Users may consult the section containing details on the processing of Personal Data.
Retention period
Unless otherwise specified in this document, Personal Data is processed and kept for as long as required for the purpose for which it was collected and may be kept longer due to an applicable legal obligation or on the basis of the User’s consent.
Purposes of processing
User Data is collected to enable the Owner to provide its Service, fulfill its obligations, respond to law enforcement requests, protect its rights and interests (or those of its Users or third parties), detect any malicious or fraudulent activity, as well as the following:
- Manage User payments for subscriptions or any other expenses;
- Create and manage user accounts;
- Scan invoices and documents and extract relevant information;
- Enable easy consultation and retrieval of scanned documents at any time;
- Improve application performance and reliability;
- Answer questions and offer technical support to Users;
- Send reminders and warnings;
- Propose personalized offers or features;
- Access the photo album of the User’s device to upload invoices and documents.
Detailed information on the processing of Personal Data
Payment management
Unless otherwise specified, this Application processes all payments by credit card, bank transfer or other means, through external payment service providers. In general and unless otherwise stated, Users are requested to provide their payment details and personal information directly to said payment service providers.
This Application is not involved in the collection and processing of such information: instead it merely receives notification from said payment service providers, indicating whether the payment has been successfully completed.
Apple Pay
Company: Apple Inc.
Place of processing: United States
Personal data processed : Usage data +2
Google Pay
Company: Google LLC
Place of processing: United States
Personal data processed: e-mail address +5
Advertising
The Owner reserves the right to display advertising content on the Application at any time and without the User’s prior authorization. Communications are displayed in the form of banners and other advertisements on this Application.
This does not mean that all Personal Data is used for this purpose. Some advertisements may be displayed without reference to the User’s behavior, for example general advertisements that are not personalized.
Some of the services may be tailored to the User’s behavior without the use of trackers, using data provided directly by the User as part of using the Application. Services of this type generally allow the User to oppose such tracking by using the Application’s functionalities or by contacting the Owner.
Google Ad Manager
Company: Google LLC
Place of processing: United States
Personal data processed : Usage data +1
Additional information for users
Legal basis for processing
- The Owner may process Personal Data relating to Users if one of the following conditions applies:
- Users have given their consent for one or more specific purposes ;
- the provision of Data is necessary for the performance of an agreement with the User or for any pre-contractual obligation of the User;
- processing is necessary to comply with a legal obligation to which the Owner is subject;
- processing is connected with a task carried out in the public interest or in the exercise of public authority vested in the Owner;
- processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party.
In all cases, the Owner will be happy to help you clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a legal or contractual requirement, or a requirement necessary to enter into a contract.
Additional information on retention periods
Unless otherwise specified in this document, Personal Data is processed and kept for as long as required for the purpose for which it was collected and may be kept longer due to an applicable legal obligation or on the basis of the User’s consent. Consequently:
- Personal Data collected for purposes related to the performance of a contract between the Owner and the User shall be retained until the contract is fully performed.
- Personal Data collected for the purposes of the Owner’s legitimate interests shall be retained for as long as necessary to
achieve those purposes. Users can find specific information regarding the legitimate interests pursued by the Owner in the relevant sections of this document or by contacting the Owner. - User information is stored on servers located in Canada.
The Owner may be authorized to retain Personal Data for longer periods whenever the User has given consent to such processing, for as long as such consent is not withdrawn. In addition, the Owner may be obliged to keep Personal Data for a longer period whenever this is required to comply with a legal obligation or by order of an authority.
Once the retention period has expired, the Personal Data will be deleted. Consequently, the right of access, the right of erasure, the right of rectification and the right to data portability cannot be applied after the expiry of the retention period.
Users’ rights
- Withdraw consent at any time. Users have the right to withdraw their consent if they have already consented to the processing of their Personal Data.
- Object to the processing of their Data. Users have the right to object to the processing of their Data if the processing is carried out on a legal basis other than consent.
- Access to their Data. Users have the right to know whether their Data is being processed by the Owner, to obtain information on certain aspects of the processing and to obtain a copy of the Data being processed.
- Verify and obtain rectification. Users have the right to verify the accuracy of their Data and to request that it be updated or corrected.
- Limit the processing of their Data. Users have the right to restrict the processing of their Data. In this case, the Owner will only process their Data for storage purposes.
- Have their Personal Data deleted or erased. Users have the right to have their Data deleted by the Owner.
- Recover their Data and have it transferred to another controller. Users have the right to recover their Data in a structured, commonly used and machine-readable format and, if technically possible, to have it transferred to another data controller without hindrance of any kind.
- File a complaint. Users have the right to lodge a complaint with the Privacy Commissioner regarding data protection.
Information on the right to object to processing
Where Personal Data is processed in the public interest, in the exercise of an official authority vested in the Owner or for the purposes of the legitimate interests pursued by the Owner, Users may object to such processing by providing a reason linked to their particular situation that should justify such objection.
Users should be aware, however, that if their Personal Data is processed for direct marketing purposes, they may object to such processing at any time, free of charge and without any justification. If the User objects to the processing for prospecting purposes, the Personal Data will no longer be processed for these purposes. To find out whether the Owner processes Personal Data for direct marketing purposes, Users may refer to the relevant sections of this document
How to exercise these rights
Any request to exercise the User’s rights may be addressed to the Owner at the contact details indicated in this document. Such requests may be exercised free of charge and will receive a reply from the Owner, providing Users with the information required by law, as soon as possible and always within one month. Any rectification or deletion of Personal Data or any limitation of processing will be communicated by the Owner to each recipient to whom the Personal Data has been communicated, where applicable, unless this proves impossible or involves a disproportionate effort. At Users’ request, the Owner will inform them of these recipients.
Further information on data processing and collection
Legal action
The User’s Personal Data may be used for legal purposes by the Owner in court or in steps that may lead to legal action resulting from improper use of this Application or related Services.
The User is aware that the Owner may be required to disclose Personal Data at the request of public authorities.
Additional information concerning the User’s Personal Data
In addition to the information contained in this Privacy Policy, this Application may provide the User with additional information and contextual information regarding particular Services or the collection and processing of Personal Data.
System logs and maintenance
For operation and maintenance purposes, this Application and any third-party services may collect files that record interactions with this Application (system logs) or use other Personal Data (such as IP address) for this purpose.
Information not included in this policy
Further information regarding the collection or processing of Personal Data may be requested from the Owner at any time. Please refer to the contact details at the beginning of this document.
Changes to this Privacy Policy
The Owner reserves the right to make changes to this Privacy Policy, at any time, by informing its Users on this page and possibly in this Application or – insofar as technically and legally possible – by sending a notification to Users via the contact details available to the Owner. It is strongly recommended to consult this page frequently, referring to the date of the last modification indicated at the bottom.
If the changes influence the processing activities carried out on the basis of the User’s consent, the Owner must obtain a new consent from the User where necessary.
Definitions and legal references
Personal data (or Data)
Any information which, directly, indirectly or in combination with other information – including a personal identification number – allows the identification or identifiability of a natural person.
Usage data
Information collected automatically by this Application (or by third-party services employed by this Application), which may include the IP addresses or domain names of the computers used by Users who use this Application, URI (Uniform Resource Identifier) addresses, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server’s response (favorable result, error, etc.), the country of origin, the date and time of the request, the number of requests received, the number of requests received and the number of requests received.), the country of origin, the characteristics of the browser and operating system used by the User, various details relating to the time per visit (e.g. time spent on each page in the Application) and details relating to the path followed in the Application with special reference to the sequence of pages visited, and other parameters relating to the User’s operating system or computer environment.
User
The person using this Application who, unless otherwise indicated, corresponds to the Data Subject.
Data Subject
The natural person to whom the Personal Data refers.
Subcontractor
The natural or legal person, public authority, institution or other body that processes Personal Data on behalf of the Data Controller, as described in this Privacy Policy.
Data Controller (or Owner)
The natural or legal person, public authority, institution or any other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data, including the security measures concerning the operation and use of this Application. Unless otherwise stated, the Data Controller is the Owner of this Application.
This Application
The means by which the User’s Personal Data is collected and processed.
Service
The service provided by this Application as described in the relevant terms and conditions (if any) and on this website/application.
Legal information
This privacy policy relates solely to this Application, unless otherwise stated herein.
How can we help you?
What you can do
Your data
- Ask us to find out what information we hold about you, and to give you access to it.
- Ask us to rectify any information we hold about you
- Ask us to exercise your right to be forgotten (delete the information we hold about you)
- Request the transfer of your data to another service
In the event of a problem
While we strive to create a positive user experience, we understand that problems may occasionally arise between us and our users. If this is the case, please do not hesitate to contact us.
Contact us
Squares8 inc. – PO Box 79033, Laval, Quebec, H7L 5J1
Owner’s contact e-mail: info@squares8.com