Privacy Policy
Last Updated: September 28, 2026
This Privacy Policy explains how Clarus ("Clarus", "we", "us" or "our") collects, uses, communicates, retains and protects personal information when you use the Clarus website, application and related services (the "Services"). Clarus is a trade name under which the Services are operated by an individual residing in the Province of Québec, Canada (the "Operator"); it is not a corporation. We handle personal information in accordance with the Act respecting the protection of personal information in the private sector (Québec) and, where applicable, the Personal Information Protection and Electronic Documents Act (Canada). We have tried to write this Policy in clear and simple terms. If anything is unclear, contact us (see section 13).
1. Person in Charge of Personal Information
The person in charge of the protection of personal information for Clarus is the Operator of the Services. This person is responsible for applying this Policy and for handling requests for access, correction, deletion and portability, as well as privacy complaints. You can reach them through the Contact page of the Services, selecting the "Privacy / Personal Information" category.
2. Information We Collect
Account information: your name, email address, phone number (for verification), and authentication data. Passwords are stored in hashed form by our authentication provider; we never see them. If you sign in with Google, we receive your name and email address from Google. Business information: business name, address, locations, industry, tax registration numbers, suppliers, customers, permits and settings. Financial records and files you submit: expenses, sales, purchases, invoices, receipts, quotes and other documents you upload, including any personal information about other people that they contain (for example, names of customers, suppliers or employees). Conversations with Clara, our AI assistant, and any files you attach to them. Billing information: your plan and payment status. Card details are collected and processed directly by our payment processor (Stripe); we never see or store your full card number. Technical information: IP address, browser and device type, pages visited and performance measurements, collected in aggregate by our hosting provider's analytics, which do not use cookies to track you across websites. We also keep security and audit logs of actions taken in your account. Messages you send us through the contact form. We do not sell personal information, and we do not use technology to identify, locate or profile you.
3. Why We Use Your Information
We use personal information only for the following purposes: (a) creating, authenticating and securing your account, including multi-factor authentication; (b) providing the features of the Services, such as bookkeeping, document reading, tax estimates, reports and reminders; (c) powering Clara, which requires sending your question and the relevant business data to our AI provider to generate an answer; (d) processing subscription payments and sending service and billing emails; (e) answering your support requests; (f) detecting and preventing fraud, abuse and security incidents; and (g) complying with our legal obligations. We will ask for your consent before using your personal information for any other purpose, unless the law allows it without consent. We do not use your data to train artificial intelligence models, and we do not allow our AI provider to do so.
4. Consent
By creating an account and accepting this Policy, you consent to the collection, use and communication of your personal information for the purposes described in section 3. You may withdraw your consent at any time by contacting us, subject to legal and contractual restrictions. Withdrawing consent may prevent us from providing some or all of the Services. If you upload personal information about other people (such as your employees or customers), you are responsible for having the right to do so and for informing those people as required by law.
5. Artificial Intelligence and Automated Processing
Some features use artificial intelligence (Google Gemini) to read documents you upload, suggest categories and answer your questions. AI output can be inaccurate or incomplete. No decision about you is made exclusively by automated processing: AI results are presented as drafts or suggestions that you review, modify or reject before anything is saved.
6. Service Providers and Communication Outside Québec
We use the following service providers, who process personal information on our behalf: Supabase (database, authentication and file storage), Google (AI processing and document search), Stripe (payments), Resend (transactional emails), Vercel (website hosting and analytics), and our cloud hosting provider for the application server. These providers are bound by contractual confidentiality and security obligations and may use your information only to provide their services to us. Some of these providers store or process information outside Québec, including in other Canadian provinces and in the United States. Before communicating personal information outside Québec, we assess whether it will receive adequate protection. Information held outside Québec is subject to the laws of that jurisdiction and may be accessible to its authorities. People you invite to a business in Clarus can see that business's data according to the role you give them. We may also communicate personal information when required by law (for example, in response to a court order), or to a successor if the Services are transferred to another entity, including a corporation formed by the Operator. Any successor will be bound by this Policy.
7. Cookies
We use only cookies that are strictly necessary for the Services to work, such as keeping you signed in and remembering your language. We do not use advertising or cross-site tracking cookies.
8. Security
We protect personal information with security measures appropriate to its sensitivity, including encryption in transit, database access controls that isolate each business's data, optional multi-factor authentication, and audit logging. No system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential. If a confidentiality incident involving your personal information presents a risk of serious injury, we will notify you and the Commission d'accès à l'information du Québec as required by law.
9. Retention and Destruction
We keep personal information only as long as needed for the purposes described in this Policy or as required by law. Files attached to Clara conversations are automatically deleted after about four months. When you delete a business, its data is permanently deleted after a 7-day grace period. When you close your account, we delete or anonymize your personal information, except for billing records we must keep for tax purposes (generally six years). Copies in backups are purged on our providers' regular backup cycle. Clarus is not a record-keeping service for legal purposes. You are responsible for keeping your own copies of the books and records that tax authorities require you to keep; we recommend exporting your data regularly.
10. Your Rights
Subject to the law, you have the right to: access the personal information we hold about you; have it corrected if it is inaccurate, incomplete or equivocal; withdraw your consent; ask us to stop disseminating it or to delete it; receive the personal information you provided in a structured, commonly used technological format (portability); and be informed about how automated processing is used. To exercise a right, contact us (see section 13). We will answer within 30 days. These requests are free of charge. If you are not satisfied with our answer, you may file a complaint with the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca).
11. Minors
The Services are intended for businesses and are not directed at people under 18. We do not knowingly collect personal information from minors.
12. Changes to this Policy
We may update this Policy. If we make material changes, we will notify you by email or in the Services before they take effect and, where the law requires it, ask for your consent again. The date at the top of this page shows when it was last updated.
13. Contact Us
For any question, request or complaint about this Policy or your personal information, contact the person in charge of the protection of personal information through the Contact page of the Services, selecting the "Privacy / Personal Information" category.