Who is responsible
Apogee Ventures operates this rectify workspace. Contact sortly@apogeeventures.ca for privacy questions, access or correction requests, and concerns. Use “Privacy” in the subject line.
Your accounting firm decides which client records to upload, who may access them, and the accounting work to perform. We provide the workspace and process those records to deliver and support that service. Start with your firm for questions about its client records or instructions; contact us directly about the service or if you need help reaching the responsible person.
Information we handle
The information depends on how you use the workspace. Upload only records your firm is authorized to process. Avoid unnecessary identification documents, credentials, payroll or medical information.
- Account and firm details, such as name, email address, role, access assignments and sign-in security information.
- Uploaded statements, spreadsheets, receipts and other evidence, including transaction details and personal information already contained in those records.
- Business answers, review notes, source corrections, accounting decisions, approvals and issued working-paper packages.
- Operational records needed for security and reliability, such as sign-in attempts, audit events, processing outcomes, request identifiers and service usage.
- Support correspondence and the limited information you choose to send us.
Why we use it
We use this information to authenticate users, enforce firm and preparation access, read supported documents, preserve source evidence, prepare reports, record decisions, provide downloads, maintain recovery copies and investigate support or security problems.
The application does not use advertising pixels or sell client records. Optional AI processing has separate controls described below. We do not treat ordinary sign-in as authorization for every optional use of client information.
Document reading and optional AI
Supported CSV and Excel exports are read on the rectify host. Uploads are transmitted to the hosted workspace; local processing does not mean the file stays on your device. Reading methods depend on the document type and the enabled feature. Unsupported, incomplete or ambiguous readings require review before import.
Optional external processing is subject to the firm’s processing policies, feature permissions and spending controls. Depending on the feature, transaction descriptions, business context, document content or other disclosed fields may be sent to OpenAI. Merchant research may also use merchant names and locations in web searches. Review the feature’s processing explanation and your firm’s settings before enabling it.
AI statement reading, where enabled and separately permitted, can send the complete bank or card PDF as page images, including names, account numbers, transactions and balances. Complete single-page PNG/JPEG statements require an explicit image-reading request and the firm’s statement-image permission; existing PDF reading defaults do not automatically send images. AI invoice reading can send receipt or invoice content. Do not enable these features unless your firm has authority for that processing. Saved readings remain part of the evidence trail. AI output is a draft and cannot supply final accounting or tax approval.
OpenAI applies its own processing and retention terms. A request not to store response history is not a zero-retention guarantee. Confirm provider terms and any required client authority before enabling external processing.
Service providers and processing locations
The workspace uses Cloudflare to route and protect public traffic. Cloudflare can process network and request metadata, and the public site may receive its performance-analytics beacon. Its analytics documentation describes cookie-free measurement; that does not mean the network service processes no personal information.
Resend is used for operational alert email. Support email is handled through the contact mailbox and its mail services. Public exchange-rate retrieval uses Bank of Canada dates and currencies; it does not require sending original statements or transaction amounts. OpenAI is used only for authorized optional AI features.
Service providers may process information outside Canada, where different laws and lawful-access rules can apply. We do not promise Canadian-only processing. Hosting location, provider arrangements and any firm-specific residency requirements must be confirmed before that firm supplies client records.
Cookies and browser storage
rectify uses an HttpOnly session cookie for authenticated access and a short-lived cookie during authenticator setup. Firm-account sessions normally expire after eight hours; separate platform-account sessions expire after four hours. Authenticator setup expires after ten minutes. Your browser can delete or block cookies, but sign-in then may not work.
On your own secure device, you can choose “Trust this browser for 7 days” when signing in with your password and a fresh authenticator code. This optional choice sets a separate HttpOnly cookie for that browser profile. During the fixed seven-day period, your password is still required, but you can leave the sign-in code blank. A recovery code cannot enable trust. Do not use this option on a shared or public device.
Browser trust survives ordinary sign-out. Its token changes after a trusted sign-in, but using it does not extend the original expiry. Clearing cookies, using another browser profile or opening a private window requires a code again. In Account security, confirm your identity and forget one or all trusted browsers to remove trust and close their associated sessions. Password, authenticator, recovery, account-access or firm-policy changes can also invalidate trust. Browser trust does not replace fresh identity verification required by sensitive controls.
Appearance and table-column preferences use local browser storage. Some in-progress review selections and explanations use session storage so navigation does not discard a draft; normal sign-out clears the application’s review drafts. Browser-held drafts are not a substitute for saving work. Use a private, secured device and sign out after use.
Sensitive storage-action references use this tab’s session storage and survive refresh and ordinary sign-out so you can check an interrupted action after signing in again. They contain only the account and firm scope, request reference and action label, not credentials or proposed policy contents. The application resumes these checks only for the same account and firm. It removes a reference when completion or rejection is confirmed; otherwise it remains until the tab’s session storage is cleared, normally on tab closure.
We do not currently use marketing cookies. The public edge can add the Cloudflare measurement described above. If tracking or marketing practices change, we will update the disclosures and provide any choices required for that use.
Help and introduction progress
Guided-introduction progress is stored on the service for your account, firm and introduction version, separately from accounting records. Operator orientation is stored separately. This progress is retained with account records. Help search runs in the open browser panel, is not saved as search history, and clears when the panel closes.
Ask Help is a conversational interface to maintained product instructions, with AI off. For approval and next-step questions, it can request the saved checks you are authorized to view for your open preparation. Your question and conversation are not sent with that request.
Ask Help keeps up to 24 recent messages in this tab’s memory. Closing the popup keeps the conversation; use Clear conversation to remove it. Reloading or closing the tab clears it, and changing account, role or preparation resets it. Help does not save questions or answers as server-side conversation history. Keep client details and credentials out of search and questions.
Generative Help AI is not connected in this release. Help does not send search text, questions or conversations to an external AI provider. Document-processing AI controls are separate and do not authorize external help chat.
Retention, deletion and offboarding
Originals, corrections, audit history, approvals and issued packages support the accounting evidence trail. Firm administrators can adopt retention periods for eligible draft and scanner copies, with recovery windows and preservation holds. Unknown retention periods do not authorize cleanup.
Deleting a preparation removes it from active work and blocks ordinary access; an administrator can restore it. It does not permanently erase the original evidence, audit trail or issued packages. Committed source records and historical deliveries are retained by the current workflow. There is no universal automatic deletion date.
Firm-specific retention, permitted records and offboarding instructions must be agreed before client use. Ask your firm about its schedule, or contact us to discuss an export or deletion request. Legal and accounting obligations, preservation holds and retained recovery copies may affect what can be removed and when. We explain applicable limitations rather than promise immediate erasure.
Safeguards and your choices
The hosted connection uses HTTPS. The application uses password hashing, staff authenticator verification, access checks, revision controls and an audit trail. Backup archives are encrypted and recovery is tested. These measures reduce risk; they do not establish end-to-end encryption or a certification.
You can ask about access, correction, permitted use, retention or a privacy concern at the contact address above. We may verify your identity and authority before disclosing or changing records. Do not email source files, passwords, authenticator codes or setup keys; ask for an approved secure route if evidence is needed.
This notice describes the current service. We will update the dated notice when practices change and address any additional notice or consent required for a new purpose.