Privacy Policy
At Xpns Cloud (operated by OpusD Technologies, "we", "us", or "our"), we are committed to safeguarding the privacy, security, and confidentiality of our users ("User", "you"). This Privacy Policy applies to the website and services hosted at https://xpnscloud.com.
Google API Services User Data Policy & Limited Use Disclosure
Xpns Cloud's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
1. Google Scopes Requested
Xpns Cloud requests the following Google API scopes:
openid,profile,email: Used strictly to authenticate your identity, create your secure private workspace, and deliver essential account notifications.https://www.googleapis.com/auth/gmail.readonly: Used on-demand when you explicitly initiate the "Sync Invoices from Google Workspace / Gmail" feature. This allows Xpns Cloud to search your inbox in read-only mode to find supplier invoices, software subscription receipts (e.g. Google Workspace, AWS, Adobe), and PDF attachments.
2. How We Access, Use, and Process Gmail Data
When you connect Gmail, Xpns Cloud uses targeted search queries matching financial criteria (such as receipt, invoice, order confirmation, tax invoice, or statement, and messages containing PDF or image attachments). We display the discovered receipts in an interactive review modal. You retain complete control to review, select, or uncheck receipts before any data is imported into your expense ledger.
Zero-Tampering & Read-Only Guarantee: Xpns Cloud cannot send emails, compose drafts, delete messages, modify tags, or alter your Gmail inbox in any way. Email messages that do not match financial expense criteria are completely ignored and are never read or stored.
3. Human Access Prohibition
No human reads your Gmail messages or email attachments. Xpns Cloud enforces strict internal access controls. Human personnel are prohibited from reading your email data unless:
- You provide explicit, affirmative permission for specific messages (for example, if you request customer support to troubleshoot a specific receipt import);
- It is strictly necessary for security purposes (such as investigating a security vulnerability, fraud, or abuse);
- It is required to comply with applicable Canadian or federal law; or
- The data is aggregated and anonymized for internal technical performance diagnostics.
4. No Advertising, No Data Selling & No Generalized AI Model Training
- No Advertising: Google user data and Gmail content are never used or transferred for serving advertisements, retargeting, interest-based advertising, or personalized marketing.
- No Selling of Data: We strictly do not sell, rent, monetize, or lease Google user data or financial records to data brokers, marketing networks, or third parties.
- No Generalized AI Model Training: Google user data (including Gmail message text, metadata, and invoice attachments) is never used to train, retrain, or fine-tune generalized commercial AI or machine learning models. Optical Character Recognition (OCR) is performed ephemerally for the sole purpose of extracting accounting numbers into your private ledger.
5. Revocation of Google Permissions
You can disconnect Xpns Cloud and revoke its access to your Google account at any time through:
- The Google Account Permissions page (https://myaccount.google.com/permissions); or
- The in-app Google Sync disconnect button in your Xpns Cloud Account Settings.
Upon revocation, all active OAuth access tokens in memory are immediately invalidated, and no further inbox queries will occur.
1. Information We Collect
We collect only the information required to provide, protect, and maintain your Canadian receipt scanning and tax organization services:
A. Account & Identity Information
- Google Authentication Profile: Full name, verified email address, profile picture URL, and unique account identifier provided through Google Sign-In.
- Business & Tax Profile Settings: Business entity name, entity structure (Sole Proprietorship, Incorporated Company, Rental Property, or Isolated Personal T1 Profile), province/territory of operation, and GST/HST registration status (Registrant vs. Tax-Exempt Profession).
B. Financial Documents & Expense Data
- Receipt & Invoice Documents: Photos, PDF documents, and email receipts you upload, forward to your dedicated intake email (
[email protected]), or import via read-only Gmail sync. - Extracted Tax & Accounting Data: Merchant/vendor names, transaction dates, total amounts, subtotals, tips, Canadian sales tax breakdowns (GST, HST, PST, QST), currency, line item descriptions, and assigned Canada Revenue Agency (CRA) tax codes across Form T2125 (e.g., Line 8320 Materials/COGS, Line 8811 Field/Clinic Supplies, Line 8810 Office Expenses, Line 8523 50% Meals, Line 9281 Motor Vehicle), T2 Schedule 125 GIFI, Form T776, and T1 Personal Credits.
- Tamper-Evident Audit Hashes: SHA-256 digital document fingerprints and timestamps created to satisfy Canada Revenue Agency Information Circular IC78-10R5 electronic record-keeping standards.
C. Technical & Security Information
- Device & Session Security: Browser type, operating system, and IP address (logged strictly for rate limiting, bot defense, and session security).
- Offline Device Vault: Secure browser-based offline storage on your phone or computer so you can snap receipts in basements or dead zones and automatically sync when your connection returns.
2. How We Use Your Information
We process your data strictly for legitimate operational, accounting, and legal purposes:
- Authentication & Entity Isolation: Authenticating you via Google Sign-In and keeping your business entities and personal T1 receipts strictly separated.
- Receipt Scanning & Tax Schedule Mapping: Performing automated Optical Character Recognition (OCR) and mapping extracted data to CRA Form T2125, T2 Schedule 125 (GIFI), Form T776, and T1 schedules.
- Legal & Regulatory Compliance: Ensuring electronic books and records comply with Canadian federal taxation standards (CRA IC78-10R5) and the Personal Information Protection and Electronic Documents Act (PIPEDA).
- Security & Abuse Prevention: Enforcing fair-use rate limits on trial and scanning endpoints and preventing automated bot abuse.
3. Zero-Sale & Zero-Ad-Tracker Guarantee
Xpns Cloud does not sell, trade, or monetize your personal information or financial documents.
- No third-party advertising pixels, tracking cookies, or marketing SDKs are loaded on our platform.
- When using cloud vision models to read receipt images, images are processed ephemerally under enterprise privacy terms and are never used to train public AI models.
4. Data Retention & CRA IC78-10R5 6-Year Standard
Under the Income Tax Act (Canada) and Canada Revenue Agency Information Circular IC78-10R5, businesses and self-employed individuals must keep adequate books and records, including electronic receipts, for a minimum statutory period of six (6) years from the end of the tax year to which they relate.
Xpns Cloud retains your receipts and audit trails for this statutory period while your account remains active. Even if your 14-day free trial ends without upgrading to a paid plan, your account never locks your data hostage—you retain permanent read-and-export access to download your CSV spreadsheets and PDF audit dossiers.
5. User Rights, Revocation & Account Deletion
You have full autonomy over your data under PIPEDA:
- Revoking Google OAuth Access: You can disconnect Xpns Cloud from your Google Account at any time by visiting Google Account Permissions (myaccount.google.com/permissions).
- Data Access & Portability: You may export all receipts, line items, and audit hashes in CSV or PDF format directly from your workspace at any time.
- Complete Data Erasure: To request complete deletion of your account and all stored documents, email our Privacy Team at [email protected]. We permanently delete your records within thirty (30) days.
6. Security Safeguards & Canadian Data Residency
We maintain bank-grade administrative, technical, and physical safeguards:
- Transport Security: All data in transit is encrypted using Transport Layer Security (TLS 1.3) with HTTP Strict Transport Security (HSTS).
- Storage Encryption: All stored receipts and financial records are encrypted at rest using AES-256 within Canadian data centres in Montreal and Toronto.
7. Canadian Privacy Legislation (PIPEDA)
This policy complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial legislation, including Alberta's PIPA, British Columbia's PIPA, and Quebec's Law 25.
8. Contact Our Privacy Officer
If you have any questions regarding this Privacy Policy, our Google API Services Limited Use compliance, or your personal data, please contact:
OpusD Technologies • Xpns Cloud Privacy Team
Entity: OpusD Technologies
Website: https://xpnscloud.com
User Inquiries & Support: [email protected]
Privacy Officer: [email protected]
Location: Ontario, Canada