Privacy Policy
QuickViewBooks (“QuickViewBooks”, “we”, “us”) provides bookkeeping and fractional CFO services from Montreal, Quebec. Our clients trust us with their financial records, and this policy sets out plainly what we collect, why, who else sees it, and what you can ask us to do about it.
This policy covers quickviewbooks.com, the client portal at quickviewbooks.com/app, and the bookkeeping and advisory services we provide.
Operated by 13539911 Canada Inc., 4704 Kent Avenue, Montreal, Quebec H3W 1H3
1. What we collect
Information you give us. Your name, business name, email address, telephone number, mailing address, and the details of the engagement you ask us to perform.
Your financial records. To do bookkeeping we necessarily handle the records you provide or authorize us to obtain: bank and credit card statements, invoices, receipts, payroll registers, general ledger data, tax filings, and similar documents. Where your business records contain personal information about your employees, contractors, tenants, or customers, we handle that information as part of the service, on your instructions.
Bank connection data. If you choose to connect a bank or credit card account, we use Plaid Inc. to establish that connection. You enter your banking credentials directly with your financial institution through Plaid.
We never see, receive, or store your online banking username or password. What we receive is the account name and type, a masked account number, the balance, and the transaction history for the accounts you select.
Connecting an account is optional. You can decline it and send us statements instead, and you can disconnect a connected account at any time by asking us.
Payment information. Invoice payments are processed by Stripe on Stripe's own hosted checkout. We do not receive or store your full card number.
Website and portal usage. Our web server keeps standard technical logs (IP address, browser type, pages requested, timestamps) for security and troubleshooting. The portal sets a session cookie so that you stay signed in. We do not use advertising cookies and we do not run third-party tracking or analytics that profile you across other websites.
2. Why we use it
We use the information above to:
- perform the bookkeeping, accounting, and advisory services you have engaged us to provide, including maintaining your books, reconciling accounts, and preparing financial statements and supporting schedules;
- give you access to your own books through the client portal;
- communicate with you about your engagement and answer your questions;
- issue and collect invoices;
- keep our systems secure and investigate misuse; and
- meet obligations that apply to us under Canadian and Quebec law.
We do not use your information for advertising, and we do not make decisions about you by automated means alone.
3. Consent
We collect and use your information with your consent, given in the engagement letter or by your use of our services, and in some cases as permitted or required by law. You may withdraw your consent at any time, subject to legal and contractual restrictions and reasonable notice — but note that withdrawing consent for information we need in order to keep your books will usually mean we can no longer provide the service.
5. Information stored outside Quebec
Some of the providers listed above store or process information outside Quebec, principally in the United States. Before entrusting personal information to a provider outside Quebec we assess whether the information will receive adequate protection, taking into account the sensitivity of the information, the purpose of its use, the protections the provider has in place, and the legal framework of the jurisdiction concerned. Our agreements with these providers require them to protect the information and to use it only to provide the service to us.
Information stored in another country may be accessible to the authorities of that country under its own laws.
6. How long we keep it
We keep client records for the duration of our engagement and afterwards for as long as we are required to, or reasonably need to, in order to meet legal, accounting, and tax obligations — generally at least six years from the end of the tax year to which the records relate.
When information is no longer needed for the purpose it was collected for and no retention obligation applies, we destroy it or return it to you.
Bank connection access is treated differently: when an engagement ends, or when you ask us to disconnect an account, we terminate the connection so that no further transactions can be retrieved. Transactions already imported remain in your books, because they are part of your accounting records.
7. Information Security Policy
Policy QVB-ISP-001 · Version 1.0 · Effective 8 October 2026. This policy supplements our Privacy Policy. It defines the security standards for QuickViewBooks websites, client applications, APIs, bank connections, business email, client documents and the people and service providers who handle them. Its purpose is to protect the confidentiality, integrity and availability of information and to identify, mitigate and monitor security risks.
The current application safeguards below describe existing controls. The operating procedures that follow are policy requirements. Publishing this policy does not by itself verify that every recurring review, training exercise or recovery test has been completed, or certify that our security program meets every partner requirement.
Current application safeguards
- Our hosted website uses HTTPS. Plaid access tokens are encrypted by the application using AES-256-GCM before database storage; the encryption key and Plaid API secret are handled on the server and are not returned to client browsers.
- Client access is restricted through authenticated application checks and database permissions and row-level policies. Authorized practice staff may access the clients their role permits; a client login is limited to its own records.
- Bank-connection requests validate the signed-in user and the client and connection involved. Incoming Plaid webhooks are checked for a valid signature, age and matching request-body hash before processing.
- Book changes and bank-feed actions produce audit records. Disconnecting a Plaid connection revokes it through Plaid and marks it disconnected in QVB. Previously imported accounting records are subject to the retention policy above.
- QVB does not receive or store your online banking username or password. Authentication takes place in the financial institution or Plaid connection flow.
1. Governance and accountability
David Slapochnik is the policy owner and the escalation contact for security and privacy matters. Our policy requires an inventory of systems, data, providers and authorized personnel; assigned owners for controls; a risk and exception register; and evidence of reviews and corrective actions. The owner must review the policy at least annually and after a material system change, incident or new partner requirement. Changes must be versioned, approved and communicated to affected personnel.
2. Risk assessment and continuous improvement
Our policy requires a documented risk assessment at least annually and before material changes to data use, hosting, bank products or integrations. Assessments must cover unauthorized access, data leakage, fraud, software vulnerabilities, service outages, supplier risk and physical access. Each finding must record its likelihood, impact, owner, mitigation, target date and remaining risk. Open high-risk findings must be reviewed at least monthly; other open findings at least quarterly. Closure requires evidence, and exceptions require a reason, compensating controls, expiry and owner approval.
3. Identity, access and multi-factor authentication
Our policy requires individual identities, least-privilege access, approval before granting access and prompt removal when a role or engagement ends or misuse is suspected. Privileged hosting, database, Plaid, email and document-management accounts must use multi-factor authentication wherever supported. Coverage and exceptions must be recorded; this is not a claim that every provider account has been checked. Multi-factor authentication for connecting financial accounts is a practice-wide setting: when it is on, anyone linking or repairing a bank or card through Plaid, or connecting Float, must first verify with an authenticator app (TOTP), and the server refuses the connection without that verification. The setting is currently off (decision of David Slapochnik, 8 October 2026). Signing in to the books never requires MFA; the financial institution's own authentication inside Plaid Link always applies. Sessions, recovery routes and service credentials must be reviewed for appropriate expiry, revocation and protection. Access reviews must occur at least quarterly. Automated assistants must use their own delegated identity and authorized scopes, with the same client boundaries, validation and audit requirements as human users.
4. Bank-data consent and permitted use
Bank connections are optional. Our policy permits collection only for the accounts, products and purposes the client authorizes, such as bookkeeping and reconciliation. New data products or a change of purpose require an appropriate consent review. Bank credentials must never be requested by email or entered into QVB forms. Bank information must not be sold, rented to marketers or used for unrelated purposes. Withdrawal of consent must stop future collection through the affected connection; it does not automatically erase accounting records we must retain. Connecting a bank does not authorize QVB to initiate payments or expand a person's access.
5. Data classification, encryption and secrets
Our policy classifies client financial records, personal information, bank tokens and credentials as confidential or restricted. It requires modern encryption in transit and at rest for systems and backups holding that data, with coverage verified for each provider and device. Secrets must be kept in approved protected storage, separated from public code, browser responses, routine logs and handoff messages. Access to encryption keys must be limited, and keys or credentials must be rotated after suspected exposure and when required by the provider or risk review. Client information must not be placed in public demos or source repositories.
6. Secure development, change control and vulnerabilities
Our policy requires review and proportionate testing before release, including input validation, authorization and cross-client denial checks for affected workflows. Development and demonstrations must use synthetic or appropriately anonymized data. Changes must have a traceable record, deployment verification and a recovery plan. Dependencies, vendor alerts and vulnerabilities must be reviewed regularly. An actively exploited issue or one exposing sensitive data requires immediate triage and containment; remediation deadlines for other findings must reflect severity and exposure and be tracked to closure. Independent penetration testing must be considered in the risk assessment and performed when required by a partner or identified risk. Automated checks are not represented as an independent penetration test.
7. Logging, monitoring and escalation
Our policy requires collection and review of relevant authentication, privileged access, permission changes, exports, bank-connection activity, application errors and security events. Logs must exclude passwords, full access tokens and unnecessary financial details, and access to them must be restricted. The responsible person must review security-relevant events at least weekly and investigate significant alerts promptly, recording findings and actions. Retention and alert coverage must be documented for each system. This policy does not claim a staffed 24-hour security operations centre or universal real-time alerting.
8. Incident response and notification
Suspected incidents must be escalated promptly to David Slapochnik at david@quickviewbooks.com or 514-565-2565. Do not email bank passwords, tokens or full client documents. The response procedure requires recording the report, assessing scope and severity, preserving evidence, containing the affected system, revoking compromised access, correcting the cause and verifying recovery. A security breach or unauthorized use affecting Plaid accounts or end-user data must be reported promptly to security@plaid.com, as required by Plaid's Developer Policy. We will notify affected people and applicable authorities where the law requires, including the Commission d'accès à l'information du Québec for confidentiality incidents presenting a risk of serious injury. The owner must maintain an incident register, record notification decisions and complete a lessons-learned review. Incident-response exercises are required at least annually.
9. Backups, continuity and recovery
Our policy requires a documented backup and recovery plan for critical records and services, including database records and separately stored documents. The plan must identify owners, backup frequency, encryption, retention, provider dependencies and acceptable recovery time and data loss. Backup coverage must be checked, and restoration must be tested at least annually and after material infrastructure changes. A provider's backup feature alone does not establish that all QVB records are recoverable. Recovery targets and completed restoration tests must be evidenced before they are represented as guarantees or completed work.
10. Service providers and external access
Our policy requires a security and privacy review before a provider receives confidential data and at least annually for critical providers. Reviews must consider purpose, access, location, contractual safeguards, security documentation, incident obligations, deletion and service continuity. Provider certifications apply to the provider and are not QVB certifications. External bank, Google, payment and signing authorizations remain separate from QVB login and must not be bypassed. Third-party testing must stay within authorized scope; no testing of Plaid infrastructure is permitted without Plaid's written authorization.
11. People, devices and physical protection
Our policy requires confidentiality commitments and security instruction before personnel receive client-data access, with refresher training at least annually on phishing, secure handling, incident reporting and bank-data consent. Devices used for confidential work must have supported software, updates, screen locking, appropriate encryption and endpoint protection. Paper records and removable media must be protected from unauthorized access and disposed of securely. Personnel must use approved storage and sharing routes and verify recipients before releasing information.
12. Retention, disposal and assurance
The retention rules in section 6 apply. Our policy requires collecting only necessary information, checking the lawful basis for keeping it, restricting retained records and securely returning or deleting information when the purpose and applicable obligations end. Backup expiry, legal holds and a provider's independent retention must be considered when processing deletion requests. The owner must retain review records, test results, incident records, access decisions and approved exceptions. QVB does not claim SOC 2 certification, ISO 27001 certification, a completed independent security audit or a fully verified continuously operating security program on the basis of this page. Partner questionnaire answers must reflect actual current evidence and any remaining gaps.
Reference: Plaid Developer Policy. Questions about this policy: david@quickviewbooks.com.
8. Your rights
Subject to the limits the law allows, you may:
- Access the personal information we hold about you, and be told how it is used and who it has been disclosed to;
- Correct information that is inaccurate, incomplete, or ambiguous;
- Withdraw consent to our collection or use of your information;
- Request deletion of information we no longer have a lawful reason to keep;
- Receive a copy of the computerized personal information you gave us, in a structured, commonly used technological format, or have it transmitted to another organization; and
- Complain if you believe we have mishandled your information.
We will respond to a request within 30 days. There is no charge for a reasonable request; if a request requires us to produce transcriptions, reproductions, or transmissions at a real cost, we will tell you the amount before proceeding.
To exercise any of these rights, contact our Privacy Officer below.
9. Privacy Officer
The person responsible for the protection of personal information at QuickViewBooks is:
David Slapochnik
QuickViewBooks
4704 Kent Avenue, Montreal, Quebec H3W 1H3
privacy@quickviewbooks.com
514-565-2565
10. Complaints
If you are not satisfied with how we have handled your information or your request, please raise it with our Privacy Officer first — most matters are resolved quickly that way.
You also have the right to complain to:
Commission d'accès à l'information du Québec
cai.gouv.qc.ca — 1-888-528-7741
Office of the Privacy Commissioner of Canada
priv.gc.ca — 1-800-282-1376
11. Changes to this policy
We may update this policy as our services or the law change. The “last updated” date at the top shows when it was last revised. If a change materially affects how we handle your information, we will tell you directly rather than relying on you to notice the new version.
12. Contact
QuickViewBooks
info@quickviewbooks.com · 514-565-2565 · quickviewbooks.com