Data Retention and Storage Policy

Last updated: October 27, 2026.

Effective date: October 27, 2026. Version: retention-v33-2026-10-27.

What changed (accepted at next sign-in): Firm accounts: free storage allowance per firm. After a month is exported, raw uploaded originals auto-delete after a set period (default 90 days; your firm can change this). Sorted books and reports stay. You can add paid storage or delete originals yourself.

Ai Book Sort (“Ai Book Sort”, “we”, “us” or “our”) is a name used by Bukso Technologies Corp., a Canadian federal corporation based in Calgary, Alberta, which operates the website aibooksort.com and the Ai Book Sort client portal (together, the “Service”). This Data Retention and Storage Policy (the “Policy”) explains how long we keep Customer Data, how it is stored and protected, and when and how it is deleted. It forms part of, and should be read with, our Privacy Policy, Terms of Service and Refund Policy. If this Policy and the Privacy Policy conflict on a retention period, this Policy governs.

1. Definitions

In this Policy:

1. “Customer” means a person or business that creates an account on, or submits documents to, the Service. “You” and “your” refer to the Customer.
2. “Customer Data” means all information you provide or we create for you through the Service. This includes Source Documents, Work Product, account workspace content and messages related to your jobs.
3. “Source Documents” means bank statements, credit card statements, receipts, CSV files, photographs and any other files you upload.
4. “Work Product” means the outputs we prepare from Source Documents. This includes extracted transaction lines, categorizations, import files (for example, QuickBooks Online or Xero CSV files), spreadsheets and check reports.
5. “Upload Date” means the date a Source Document is received by the Service. “Delivery Date” means the date Work Product for a job is first made available to you.
6. “Standard Retention Period” means the period that ends at your next sign-in after you first download the Work Product of a job, or twenty-four (24) hours after that download, whichever comes first, as described in Section 4.
7. “Bukso Membership” means the paid, automatically renewing membership (a Solo, Business, Pro or Firm plan, monthly or yearly) described in Section 5. “Extended Storage” means the longer retention members get under Section 5.
8. “Account Records” means your name, contact details, login and security records, consent records, and records of your purchases, payments, invoices and refunds.
9. “Backups” means encrypted copies of our systems kept only to restore service after a failure.
10. “De-identified Data” means data from which names, email addresses, account and card numbers, addresses and other direct identifiers have been removed or replaced, so that it cannot reasonably be linked to an individual.
11. “Applicable Privacy Law” means the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”), the Personal Information Protection Act (Alberta) (“PIPA”), and US federal and state privacy and data-security laws that apply to us.

2. Scope

This Policy applies to all Customer Data and Account Records processed through the Service, in any format, including on our systems and on the systems of our service providers. It does not apply to information we hold about our own business that is not about you, or to anonymous aggregate statistics.

3. What we store

1. Source Documents: the files you upload, and processed copies we make (for example, images rotated to the correct orientation and text produced by optical character recognition).
2. Work Product: draft and final transaction lines (date, description, amount, suggested category, confidence score), corrections (made by you, or by us after you report a mistake), delivered files and check reports.
3. Account Records: as defined above. Card details are collected and held by our payment processor (Stripe). We do not store full card numbers.
4. Security and operational logs: sign-ins, file access, administrative actions and audit records.

We do not connect to your bank accounts and do not hold bank credentials.

4. Standard retention: until your next sign-in or twenty-four (24) hours after download

1. Rule: unless Section 5, 6 or 9 applies, everything of a job, including entries in your books, is kept only until your next sign-in after you first download it, or twenty-four (24) hours after that download, whichever comes first: your uploaded files, the transaction lines, your answers, the reports and PDFs (Work Product) and any entries posted to your books in the portal from that job. They are then automatically and permanently deleted from our active systems (removed outright, not reversed; entries from your other jobs are not affected), and your next sign-in starts fresh. Downloading again does not restart the period. Before the download button we show this notice: “After you download, Bukso deletes these files and lines when you next sign in (or after 24 hours). Save your download. Want Bukso to keep them? Add storage.” Paid work is never deleted before you download it. Original uploaded files follow Section 4.1 and the keep-or-delete choice shown in the portal.
2. Backups: deleted Customer Data may remain in encrypted Backups until those Backups expire. Backups are kept for at most 30 days and are then deleted. While data stays in a Backup, it is kept isolated, is not used for any purpose and is restored only to recover from a system failure. Any restored data that was due for deletion is deleted again.
3. Reminder: before the download button we show the deletion notice in this Section. Because pay-as-you-go jobs are deleted within 24 hours of download, we do not send a separate reminder for them. Bukso Members get the email reminders described in Section 5 (30, 7 and 1 day before their records end). Not receiving a reminder does not extend the Standard Retention Period.

4.1 Fresh start after you are away

If you upload without paying and are inactive for 24 hours, those uploads are deleted (nothing was charged). Bukso Members' unpaid uploads stay until you delete them. After 24 hours away, for paid jobs we delete the original uploaded files while keeping your sorted books. Jobs that are still being sorted or billed to your accounting firm are not touched. With Cloud storage, original files are kept until you delete the job or cancel storage (see Original files). Next time you sign in you will see: “Your old statements were discarded. Fresh upload ready.” There is no option to keep unpaid statements for 30 days.

You can delete a single file at any time, including on a paid job. Its lines are removed from your books by dated reversing entries (the history stays in the audit trail); your price and payment do not change.

4A. What is deleted vs what is kept

1. Deleted: the automatic deletion in Section 4, and any deletion you start yourself in the portal, apply only to:
   1. Source Documents (uploaded files, statements, receipts and photos); and
   2. Work Product made from them (extracted lines, categorizations, import files, spreadsheets, reports).
2. Kept as customer records: the following are not removed by automatic deletion or by deleting files:
   1. Account Information: your name, email address, phone number, postal code and company name;
   2. Transaction and payment records: your purchases, invoices, receipts we issue, payments, refunds, subscriptions and the tax charged.
3. How long they are kept: invoices, payments, refunds and the tax charged are our own business records: the Canada Revenue Agency requires us to keep them for at least six (6) years (Section 9.1), so they cannot be deleted earlier. For your other Account Information, you choose: one (1) year after your last paid order or membership ends, we ask you at sign-in (or by email) whether to keep it or delete it. If you choose delete, we delete it within thirty (30) days, except what must stay with the six-year records. We also remind you that your own business records usually need to be kept for six (6) years.
4. Your rights still apply: privacy law (PIPEDA and PIPA) allows us to keep personal information only for as long as reasonably needed for these purposes. Accordingly:
   1. we review the customer records we keep at least once a year;
   2. we delete or anonymize records we no longer need;
   3. you may close your account (Section 10) and ask us to delete your Account Information (Section 14). After closure, we keep only what we need for legal, tax, dispute or fraud-prevention purposes, and we stop using it for anything else, including marketing.

5. Bukso Membership: members keep up to 6 years

1. Who: customers with an active, paid Bukso Membership for a business (a plan: prices on the Pricing Page, Solo from $12 per month, plus applicable taxes). Joining needs your express consent to automatic renewal at checkout.
2. What is kept: while the membership is active, your transaction lines and report files are kept for up to six (6) years from upload and are not deleted under Section 4. Uploaded statements and other original files are kept too, until you delete the job or cancel storage (see Original files below).
3. Everyone else: without a membership with storage (pay-as-you-go), Section 4 applies: everything of a job is deleted at your next sign-in after you first download it, or twenty-four (24) hours after that download, whichever comes first. Members with storage keep their books (reports and History); the main Transactions list and dashboard show only current work that is not yet downloaded.
4. Original files: If you have Cloud storage, Bukso keeps your original files until you delete the job or cancel storage; without storage, originals are not kept. After you cancel storage, your originals are kept until your 30-day notice ends and are deleted the day after; we email you a reminder 30 days, 7 days and 1 day before, and on the last day.
5. Cancelling; non-payment: you can cancel anytime. The membership stays active until the end of the period you paid for. When it ends (or a renewal is not paid), we give you thirty (30) days’ notice by email and in the portal; your data is kept during the notice. If you do not join again by the end of the notice, Section 4 applies to your transaction lines and reports (including deletion from Backups as stated in Section 4 (Backups)). If you join again within the thirty (30) days, everything is kept.
6. No refund of deletion: permanently deleted data cannot be recovered.

5A. Firm accounts

Firm accounts: storage is bundled with your firm package (billed per active client). Free storage allowance covers sorted books and reports for the firm. After a month is exported, raw uploaded originals auto-delete after a set period (default 90 days; your firm can change this). Sorted books and reports stay. You can add optional paid storage or delete originals yourself.

6. Renewals

1. Memberships renew automatically every month or every year until you cancel. Yearly members are emailed thirty (30) to forty (40) days before renewal; a receipt is emailed for every payment.

7. Former storage add-on

1. The separate storage add-on and the per-report price are discontinued and replaced by Bukso Membership.

8. Data export before deletion

At any time before deletion, you may download your Work Product, and where available your Source Documents, from the portal in the formats offered. You can also ask us for an export by contacting the Privacy Officer. Once data has been deleted, we cannot provide it.

8A. Payroll records

If you use Bukso payroll, your payroll records (employees, pay runs, pay stubs, SINs, ROE worksheets and remittances) stay in Bukso until you delete them. You decide. CRA requires employers to keep payroll records for 6 years from the end of the last tax year they relate to: you, the employer, must keep them 6 years. Bukso shows the keep-until date on each employee.

Before you delete an employee or their records, delete all payroll records, or close your account, Bukso warns you that CRA requires employers to keep payroll records for 6 years and makes you download a records zip first (with SINs masked; your T4 files carry the full SIN). Your payroll records are then deleted 30 days after you ask: we email you when you ask and again 7 days before, and you can cancel it any time until then. The payroll entries in your books stay, without employee names or SINs (they read "Payroll run" and the date). Bukso does not keep payroll records or SINs after you delete them, or after you close your account. You can download all payroll records as a zip file from the Payroll records page at any time.

8B. Timesheet photos and handwritten notes

Photos of timesheets you upload are payroll records, and statement pages with pen notes are statement originals. We keep the photo exactly as you uploaded it (encrypted), the straightened copy, what was read and every change you made. They are kept until you delete them, and then deleted 30 days after you ask, like other payroll records (Section 8A). Before you delete them we warn you that CRA requires employers to keep payroll records for 6 years and Alberta employment standards require 3 years, and you download a copy first. Keep your paper originals unless your accountant confirms your scans meet CRA's imaging rules.

9. Exceptions: legal obligations and legal holds

1. Business and tax records: we keep Account Records relating to payments, invoices, refunds and taxes (including GST/HST) for as long as we are required to. This is generally six (6) years from the end of the tax year they relate to, under the Income Tax Act (Canada) and the Excise Tax Act (Canada), or longer if the Canada Revenue Agency requires it. These are our own business records and do not include your Source Documents, except where a document is needed to support a specific transaction with you.
2. Legal holds: we may suspend deletion of specific Customer Data where we reasonably believe we must keep it. Examples are a court order, subpoena, regulatory request, actual or reasonably expected litigation, investigation of fraud or a security incident, or a dispute with you (including a chargeback). We keep that data only as long as the hold requires, and then delete it.
3. Consent records and security logs: we may keep consent records (including electronic-message consents under Canada’s anti-spam legislation) and security or audit logs for two (2) years, or as long as needed to show compliance.
4. De-identified Data: see Section 11.

10. Account closure

You may close your account at any time. When you do, we will (a) end any Extended Storage at the end of the period you have already paid for, unless you ask for earlier deletion, (b) delete Source Documents and Work Product within thirty (30) days, subject to Sections 4A and 9, and (c) purge Backups as described in Section 4 (Backups). Fees already paid are dealt with under our Refund Policy.

How to close your account: in the portal (Your data → Close my account) or in the app. If you have payroll records, download them first (CRA requires employers to keep payroll records for 6 years). Your account closes 30 days after you ask; we email you, and you can cancel any time before then. Your payroll records are deleted on that date, and your other data as described above.

10A. Your records, export, and if Bukso stops

Keep your own records. Tax law (in Canada, generally 6 years) requires you to keep your books and source documents. Unless you are a Bukso Member with storage, we delete your job at your next sign-in after your first download, or 24 hours after it, whichever comes first, and without storage we do not keep your uploaded files, so download and keep your files.

Export. While your account is open you can download your transactions and reports at any time (PDF, Excel and CSV). If we close your account (other than for fraud or an attack), you get at least 30 days to download first, unless the law requires otherwise.

If Bukso stops or is sold. We give at least 60 days' notice by email and in the portal, keep downloads open, stop renewals and refund unused prepaid membership time pro rata. A buyer must keep our Terms and Privacy Policy for your data, or you may close your account and get the same refund (Terms 8.10).

Emergency security shutdown. If we confirm an attacker has actually got into our systems or customer data, we may take the Service offline at once to protect your data, tell you what happened as soon as we safely can, notify the privacy commissioners and affected people as the law requires, reopen downloads as soon as it is safe, and add lost paid membership time back (Terms 17.4).

11. Use of de-identified pairs to improve our AI

We may keep de-identified pairs of a merchant's printed description and the category you confirmed (for example "FACEBK *ADS → Advertising") to improve our own AI. They never include your name, email, account numbers, dates or amounts or images of your documents, never leave our systems and are never shared with or sold to anyone. Pairs that look like a payment to or from a person (e-Transfer, cheque, wire, payroll) are dropped, and long numbers, email addresses, phone numbers and postal or ZIP codes are stripped. They may be kept after your Customer Data is deleted. You may turn this off at any time under Email & data preferences or by contacting the Privacy Officer; it applies to future pairs, and where practicable we also delete existing pairs linked to your jobs. Your documents are never sent to an outside AI company.

12. Security of stored data

We use administrative, technical and physical safeguards suited to the sensitivity of financial information, as required by PIPEDA Principle 4.7 and PIPA section 34. These include:

1. encryption of data in transit (TLS);
2. encryption of stored files and of sensitive database fields;
3. login protection with optional two-step verification;
4. staff access to your file only when you ask us for help or report a mistake, recorded in audit logs;
5. separation of each Customer’s data from other Customers’ data;
6. reputable hosting providers.

No system is perfectly secure, and we do not guarantee absolute security.

13. Cross-border processing

Customer Data may be stored or processed outside your province, state or country by our service providers. These currently include:

• Render, for application hosting and storage in the United States;
• Computing for our own AI (Bukso AI), on computers we control in Canada (and in future servers rented only for our use, in Canada or the United States). Customer Data is never sent to an outside AI company;
• Stripe, for payment processing in the United States and Canada;
• Zoho Mail, for email in Canada.

Data processed in another country is subject to that country’s laws. Courts, law-enforcement and national-security authorities there may be able to access it. We use contracts and other means to give a comparable level of protection. You may contact the Privacy Officer for more information about our service providers outside Canada, including the information PIPA section 13.1 requires.

14. Your rights: access, correction and deletion

1. You may ask to access, correct or delete your personal information, or ask how it has been used and shared. We will respond within the time required by law: thirty (30) days under PIPEDA and forty-five (45) days under PIPA, subject to permitted extensions. Requests may be refused or limited only as the law allows. Section 9 is an example of such a limit.
2. US residents may have additional rights under the laws of their state of residence. Where those laws apply, we will honour such requests. We do not sell or share personal information for cross-context behavioural advertising.
3. We will verify your identity before acting on a request.
4. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, or the regulator where you live.

15. Breach notification

If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will:

1. notify you, and report to the Office of the Privacy Commissioner of Canada, as soon as feasible, as PIPEDA requires;
2. notify the Information and Privacy Commissioner of Alberta without unreasonable delay where PIPA section 34.1 applies;
3. give any notice required by US state breach-notification laws.

We will keep a record of every breach of security safeguards for at least twenty-four (24) months, as PIPEDA requires.

16. Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy with a new effective date. When we change it, we show a short “What changed” list and ask you to review and accept the change at your next sign-in, before it applies to you or to your existing data.

17. Contact

Privacy Officer, Bukso Technologies Corp., PO Box 95072, RPO Saddleridge, Calgary, AB T3J 0E3, Canada. Email: support@aibooksort.com (subject “Privacy request”)

Schedule A — Plan prices referenced

These prices are for reference only and are set in our Pricing page. The Pricing page governs if they differ.