Privacy Policy

1. Who we are

Yutace (“Yutace,” “we,” “us”) provides software that reconciles bank and credit card statements against invoices and receipts for our business clients (“Customers”) and their authorized users. This policy explains what personal information we collect through the Yutace platform, why we collect it, who we share it with, and the choices and rights you have.

If you're an employee or contractor using Yutace on behalf of a Customer, that Customer controls your company's data and account access; we process it on their behalf as described below.

2. Information we collect

Account information: your name, email address, and how you signed in (email/password or Google sign-in through our authentication provider, Clerk). If you sign in with Google, we receive your name and email address from Google — we never see or store your Google password.

Company and business data: company names, codes, chart of accounts, credit card labels (last 4 digits only — we never collect full card numbers), roles, and who has access to which company, all entered by your organization's admins or accountants.

Documents you upload: bank and credit card statements, invoices, and receipts, along with the data our system extracts from them — transaction amounts, dates, merchant names, line items, and tax figures (GST/QST/HST/PST). These documents are the core input to the reconciliation process.

Usage and activity data: sign-ins, pages visited, reconciliations run, and corrections you make, together with your IP address and a timestamp — kept for security, troubleshooting, and an audit trail of who changed what.

Presence data: whether you're currently online and when you were last active, shown only to other approved users at your own company, so teams can see who's around.

Preferences: your chosen language and light/dark theme, stored in first-party cookies on your own device (see Section 6).

3. How we use your information

To provide the reconciliation service itself: matching your transactions to your documents, calculating tax treatment, and presenting the results for your review.

To authenticate you and enforce access control, so a user only ever sees the companies they've been granted access to.

To operate, secure, and improve the platform — including detecting misuse, debugging errors, and understanding which features are actually used.

To send you service-related communications: invitations, approval notices, and important account or security notices. We do not send marketing email today, and if that changes, it will be opt-in.

4. Who we share it with

We do not sell your personal information, and we do not share it with advertisers or data brokers.

We share information with a small number of service providers who process it on our behalf, strictly to run the platform:

• Clerk — handles sign-in and authentication (including Google sign-in).
• Anthropic (Claude API) — reads the content of the statements, invoices, and receipts you upload, in order to extract transaction/document data and decide which documents match which transactions. This is how the OCR and automated matching in Yutace actually works.
• Our hosting and infrastructure providers — run the website and the reconciliation backend where your data is stored and processed.

Each of these providers is contractually restricted to using your data only to provide their service to us, not for their own purposes.

5. Where your data is processed and how long we keep it

Your data may be processed and stored outside the province or country where you're located, including in the United States (for example, by Clerk and Anthropic). Where that happens, we rely on our providers' own safeguards for cross-border data transfers.

We keep your account, company, and reconciliation data for as long as your organization's account is active, so your reconciliation history stays available to you. If your organization closes its account, we delete or anonymize personal information within a reasonable period afterward, except where we're required to retain records for legal, tax, or accounting purposes.

6. Cookies

Yutace uses two first-party cookies, both purely functional: one remembers your light/dark theme choice, the other remembers your language (English/French). Neither is used for advertising, and we don't use third-party tracking or analytics cookies.

7. Security

We use encryption in transit (HTTPS) for all traffic to the platform, and access to each company's data is restricted to the users your organization has explicitly granted access to. No system is completely immune to risk, but we design access controls specifically to prevent one Customer's data from being visible to another.

8. Your rights

Because our business is based in Quebec, Canada, we handle personal information in accordance with Quebec's Act respecting the protection of personal information in the private sector (“Law 25”) and Canada's federal privacy law, PIPEDA. In plain terms, these laws give you the right to ask what personal information we hold about you, to ask us to correct it if it's wrong, and to ask us to delete it, subject to our legitimate need to keep certain records (like financial history) for legal or accounting reasons.

If you're an employee of one of our Customers, the fastest way to exercise these rights is usually through your own organization's admin, since they control your account. You're also welcome to contact us directly at the email below, and we'll route your request appropriately.

9. Children

Yutace is a business tool and is not directed at, or knowingly used by, children. We do not knowingly collect personal information from anyone under 16.

10. Changes to this policy

If we make material changes to this policy, we'll update the date below and, where appropriate, let Customers know. We encourage you to check back periodically.

11. Contact us

Questions about this policy or your personal information? Reach us at privacy@yutace.com.