ScanTrix Privacy Policy

1. Who we are

ScanTrix is an AI-powered invoice scanning and accounts payable application operated by ScanTrix Technologies Inc., a Canadian federal corporation with its registered office in Ontario (“ScanTrix”, “we”, “us”, or “our”). ScanTrix is the organization responsible for the personal information described in this Privacy Policy.

The iOS app is published on the Apple App Store under the name Savetrix Accounting Services LLP (“Savetrix”) under licence from ScanTrix. Savetrix is the App Store publisher only. ScanTrix owns the app and operates the service.

This Privacy Policy applies to the ScanTrix mobile application, the ScanTrix web application, and our website at scantrix.ai (together, the “Service”). By using the Service, you agree to the practices described here. If you do not agree, please stop using the Service.

2. Information we collect

Information you provide

• Account details: name, email address, business name, and password when you register.
• Invoice images and documents you scan or upload, and the data extracted from them (vendor, amount, date, line items). Invoices may contain personal information about third parties, such as vendor contacts or employees.
• QuickBooks Online authorization tokens. We do not receive or store your QuickBooks username or password.
• Vendor and general ledger (GL) coding data that you assign or correct in the Service.
• Messages and feedback you send to support.

Information collected automatically

• Device and app information: device model, operating system version, app version, and device identifiers.
• Usage and processing data: features used, timestamps, confidence scores, and error logs.
• Analytics and crash data, which we use to maintain and improve the Service.

Information about others. If you upload invoices or connect accounting files that belong to your employer or your clients, you confirm that you have the authority to do so and that you will give any notices and obtain any consents required by law.

3. How we use information and AI processing

We use personal information to:

• Extract invoice data and classify GL codes using AI, and post or queue bills in your connected accounting software according to the settings you choose.
• Show invoices for human review when AI confidence is below your configured auto-post threshold.
• Store and retrieve invoice images, and link them to the related records in your accounting software.
• Operate, secure, support, and improve the Service, and send transactional notifications.
• Comply with legal obligations and enforce our Terms of Service.

AI processing.When you scan an invoice, the image and extracted data are sent to Anthropic’s Claude API to extract and classify the information. Invoice approvals and postings may therefore involve automated processing. You can review, correct, or reverse any result, and you can turn automatic posting off in your settings.

Improving our AI features.We may or may not use data submitted through the Service, including invoice data and your corrections, to develop, train, test, and improve ScanTrix’s AI-assisted features and vendor memory system. Where we do, we will use it only in de-identified or aggregated form where reasonably practicable. We are under no obligation to do so, and we do not sell your personal information. Any third-party AI provider’s use of your data is limited to what its agreement with us permits.

4. Sharing and service providers

We do not sell personal information. We share it only with service providers and other recipients that help us provide, secure, and support the Service, such as providers of AI processing, cloud hosting and infrastructure, workflow automation, analytics and crash reporting, payments and subscriptions, and the app store through which the iOS app is distributed, as well as the accounting, banking, and storage services you choose to connect, and our legal, accounting, and insurance advisers.

We may also disclose information where required by law, court order, or a governmental authority, or to protect the rights, property, or safety of ScanTrix, our users, or others. If ScanTrix is involved in a merger, acquisition, or sale of assets, personal information may be transferred, and we will give notice before it becomes subject to a different privacy policy.

How we manage service providers

ScanTrix runs a third-party risk management program so that the providers who handle your information protect it. Under this program:

• Before engagement. Before a provider handles personal information or customer data, we assess what data it will access and where it will be processed, review its security documentation (for example a SOC 2 or ISO 27001 report or equivalent), and confirm that our contract includes confidentiality, security, and data-protection terms.
• Risk-based oversight. We rank providers by the sensitivity of the data they handle. Providers that process invoice data or support our production systems receive the closest review.
• Ongoing review. We review these providers at least once a year, and sooner if a provider changes how it handles data, changes its terms, or has a security incident.
• Minimum access. We share only the information a provider needs to perform its service. Integrations request the minimum permissions required, and we revoke integration access when you disconnect an integration or close your account.
• AI providers. AI providers are engaged under written terms. We do not permit them to use your data to train their models, and their use of your data is limited to providing the service to ScanTrix.
• Incidents. We expect providers to notify us promptly of any security incident that affects ScanTrix data, and we handle it under our incident response procedure, including notifying you and regulators where the law requires.
• Provider list. We keep a register of the providers that handle customer data. You can request the current list by contacting the Privacy Officer at support@scantrix.ai.
• Ending a relationship. When we stop using a provider, we revoke its access and ask it to delete ScanTrix data, subject to legal retention requirements.

Your use of QuickBooks Online and other third-party services is governed by their own terms and privacy policies. ScanTrix is independent of and not affiliated with Intuit.

5. Storage, retention, and data residency

Where data is stored. ScanTrix stores Service data on Amazon Web Services (AWS). ScanTrix decides from time to time where data is stored and processed, and the AWS region may change. Data may be stored or processed in Canada, the United States, or other countries where our service providers operate. Our current AWS region is India. We will update this Privacy Policy if our storage location changes materially.

Invoice images and records.Invoice images you scan are uploaded to your connected accounting software and are stored there, under that software’s own terms and retention rules. If you choose to save invoice files to a drive connected through ScanTrix, they are saved in that drive. ScanTrix also keeps copies and related processing data on AWS for as long as needed to provide the Service.

How long we keep data. ScanTrix decides how long we keep invoice images and related documents. We will not keep them longer than six years, and we may delete them sooner. We keep account data while your account is active and for a reasonable period afterward, as needed for legal, tax, security, and dispute purposes. Vendor memory data (GL assignments and confidence history) is kept while your account is active so the Service can work accurately. You may ask us to delete your data at any time, subject to legal retention duties.

Your records. ScanTrix is not a records archive. You are responsible for keeping the books and records that the law requires of you, including by exporting or backing up your invoice files before any deletion.

6. Security and your rights

Security. We use measures appropriate to the sensitivity of the data, including encryption in transit, access controls that limit staff access on a need-to-know basis, and OAuth 2.0 for QuickBooks Online so we never store your QuickBooks password. No system is completely secure, and we cannot guarantee absolute security. If a breach creates a real risk of significant harm, we will notify affected users and the relevant privacy regulators as the law requires.

Your rights. Depending on where you live, you may have the right to access your personal information, correct it, delete it, withdraw consent, receive a portable copy, object to certain processing, and ask about automated decisions. Residents of Quebec, other Canadian provinces, and certain US states (including California) have rights under local law, and we will honour them as required. To make a request, contact the Privacy Officer below. We will respond within 30 days.

Consent. By using the Service you consent to the collection, use, and disclosure described here. You may withdraw consent at any time, but the Service may not work without it.

7. Privacy Officer, complaints, and contact

Privacy Officer: Saurabh Kalpasi
Email: support@scantrix.ai
Company: ScanTrix Technologies Inc., Ontario

Contact the Privacy Officer with any privacy question, access or deletion request, or complaint. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or your provincial or state privacy regulator.

Children. The Service is intended for accounting professionals and businesses. We do not knowingly collect personal information from anyone under 18, and we will delete it promptly if we learn we have.

Changes. We may update this Privacy Policy. For material changes we will update the effective date and give notice by email or in the app before they take effect.