1. Introduction
Cram Inc. ("Cram", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect when you use our platform, how we use that information, and the rights you have in relation to it. By using Cram, you agree to the collection and use of information in accordance with this policy.
Cram Inc. is registered in Ontario, Canada and operates in compliance with applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.
2. Information We Collect
(a) Account Information
When you register for Cram, we collect information necessary to create and manage your account, including your name, email address, firm name, and phone number.
(b) Client Data
As part of using the Service, you may upload files, messages, and document requests on behalf of your clients. This data belongs to you and your clients. We process it solely to provide the Service as described in this policy.
(c) Usage Data
We automatically collect information about how you interact with Cram, including pages visited, features used, browser type, device type, and IP address. This information helps us understand how the platform is used and where we can improve.
(d) Payment Data
All payment processing is handled by Stripe. We never store full card numbers or sensitive payment credentials on our servers. We receive limited billing information from Stripe (such as the last four digits of your card, expiry date, and billing address) necessary to manage your subscription.
3. How We Use Your Information
We use the information we collect to:
- Provide, operate, and improve the Cram platform and its features
- Send transactional emails such as receipts, document request notifications, and account alerts
- Send product updates, release notes, and occasional marketing communications (you may opt out of these at any time)
- Detect, investigate, and prevent fraudulent or unauthorized activity
- Comply with our legal and regulatory obligations
4. How We Share Your Information
We do not sell your personal information to third parties. We share your information only with the sub-processors required to deliver the Service:
- Supabase — database and file storage infrastructure
- Stripe — payment processing and subscription management
- Resend — transactional email delivery
- Vercel — application hosting and edge delivery
All sub-processors are contractually bound through data processing agreements to protect your data and use it only as directed by us.
5. Data Retention
Account data is retained for 90 days following cancellation of your subscription, after which it is permanently deleted upon request. Client files and associated data are retained for as long as your account remains active. You may request earlier deletion at any time by contacting us at privacy@clientbook.ca.
6. Security
We take the security of your data seriously. Our security measures include:
- 256-bit AES encryption at rest for all stored data
- TLS 1.3 encryption in transit for all data moving between your browser and our servers
- Role-based access controls to restrict internal access to your data
- Audit logs for all significant account and data events
While we implement robust security practices, no method of transmission over the internet is 100% secure. We encourage you to use a strong, unique password and to enable any additional security features we offer.
7. Your Rights
You have the right to access, correct, export, or delete your personal information at any time. To exercise any of these rights, please contact us at privacy@clientbook.ca. We will respond to all requests within 30 days.
8. Children's Privacy
Cram is a professional platform intended for use by accounting firms and their clients. The Service is not intended for, and we do not knowingly collect personal information from, anyone under the age of 16. If you believe a minor has provided us with personal information, please contact us immediately.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email at least 14 days before the changes take effect. Your continued use of Cram after the effective date of any changes constitutes your acceptance of the updated policy.
10. Contact
If you have any questions about this Privacy Policy or how we handle your personal information, please contact us:
Cram Inc.
Ontario, Canada
privacy@clientbook.ca