Privacy Policy | Pluto Suite

1. Introduction

This Privacy Policy explains how Pluto Suite ("Pluto Suite," "we," "us," or "our"), operated by 17737734 Canada Inc., collects, uses, discloses, and protects information when you use our website, mobile app, web app, and related services (together, the "Services"). By using the Services, you agree to the collection and use of information as described in this policy.

2. Information we collect

We collect information you provide directly, information collected automatically as you use our Services, and information from third-party services you choose to connect.

Account and profile data: name, email address, and business details you provide when you sign up or update your profile, plus a phone number (used for sign-in codes), mailing address, and date of birth if you add them
Payroll data: if you use Payroll, employee details you enter, including Social Insurance Numbers and direct-deposit bank details, both stored encrypted (see Section 16)
Financial and transaction data: bank and credit card transactions, account balances, and activity pulled from institutions you connect through Plaid
Location data: GPS location used solely for automatic mileage and trip tracking (see Section 5 below for full details)
Receipts and documents: photos and extracted data from receipts you capture in the app, or forward to your business's receipt address by email or text message
Invoice and billing data: client details, invoice records, and payment history
Payment information: billing details such as card number and billing address, collected and processed by Stripe; Pluto Suite does not store full payment card data
Usage and diagnostic data: how you interact with the Services, device type, operating system version, app version, and crash or error reports

3. How we use your information

To provide the core Services: bookkeeping, mileage tracking, invoicing, receipt storage, and reporting
To generate tax-related reports, including T2125 summaries, GST/HST breakdowns, and mileage logs
To process payments for your subscription through Stripe
To send transactional emails and account notifications through SendGrid
To send marketing communications (with your consent, and with an opt-out in every email)
To monitor for errors and improve app reliability
To measure visits to plutosuite.com and which of our ads lead to signups, only if you accept cookies on plutosuite.com
To maintain the security and integrity of the Services
To comply with legal and regulatory obligations

4. Subprocessors: who handles your data

We do not sell your personal or financial information. We share data only with the following service providers, each of whom processes data on our behalf under their own security and confidentiality obligations, and with the services you choose to connect, listed after them:

Firebase (Google): user authentication and login, and push notifications to your phone. Firebase handles password management; your password is never stored by Pluto Suite directly.
Stripe: payment processing for subscriptions and, if you connect Stripe, card payments on your invoices. Stripe is PCI-compliant; Pluto Suite does not store full card numbers.
Plaid: secure bank and credit card connections. These connections are read-only; Pluto Suite can view your transactions but cannot initiate transfers or access your banking credentials.
Amazon Web Services (AWS/S3): the servers our app runs on, and file storage for receipt images and documents, logos, profile photos and database backups.
Neon: our primary database provider, used to store account, transaction, and bookkeeping data.
SendGrid: transactional and marketing email delivery, and receiving the receipts you forward to us by email.
Twilio: text messages: phone number verification, sign-in and account security codes, and receipt photos you text to us. Twilio receives your phone number and the message.
Google Cloud Vision (Google): reads the text on receipt images and PDFs you upload, so the merchant, date, amount and tax can be filled in.
Sentry: error monitoring and crash reports (see Section 9).
Cloudflare: carries traffic to our API, and hosts this website.
Vercel: hosts the web app at app.plutosuite.com.
OpenStreetMap: turns the start and end coordinates of your trips into street addresses (Nominatim), and supplies the map images that show a trip's route.
Google LLC (Google Analytics, Google Ads, Google Tag Manager): website analytics and ad measurement on plutosuite.com, only after you choose "Accept all" in the cookie banner. If you accepted cookies on plutosuite.com before signing up, our server tells Google Analytics two things, once each: that your visit led to a new account, and, if the business you signed up with starts paying within 90 days, the amount and currency of its first payment. Both are sent under the random Google Analytics ID from your visit. We do not send your name, email address, business details, bookkeeping data or the ad click ID, and we never report renewals. If you chose "Essential only", nothing is sent. If you accepted and later switched to "Essential only", the app forgets your visit the next time you follow a link from plutosuite.com to it. To stop it after you have signed up, email support@plutosuite.com and we will remove it by hand.
Meta Platforms (Facebook, Instagram): measuring which of our Facebook and Instagram ads lead to visits, signups and payments. On plutosuite.com, and only after you choose "Accept all" in the cookie banner, the site loads the Meta Pixel to measure visits from our ads. If you accepted cookies on plutosuite.com before signing up on the web, our server tells Meta two things, once each: that your visit led to a new account, and, if the business you signed up with starts paying within 90 days, the amount and currency of its first payment. These are sent with Meta's cookie and ad click IDs from your visit, your browser's name and version (its user agent) and, for the new account only, the IP address you signed up from. We never send Meta your name, email address, business details or any bookkeeping data, and we never report renewals.
Google Cloud Vision: reads the text on receipt images (OCR) so the merchant, amount, date, and tax can be filled in.
Twilio: sends SMS sign-in and verification codes, and receives receipts texted to your business.
Sentry: error monitoring and crash diagnostics (see Section 9).
Cloudflare: network delivery and security for our API and this website.
Vercel: hosting for the web app at app.plutosuite.com.
OpenStreetMap Nominatim: address lookup. Trip start and end coordinates are sent to it to find street addresses, and saved client and job site addresses are sent to find their location.

Services you choose to connect send us data, and we send them only what is needed to make the connection work:

Plaid: your bank and credit card transactions, as described above.
Shopify: order totals, dates, payment status and tax from a store you connect, recorded as sales in your books. We do not request your customers' names, email addresses or shipping addresses.
Square: sales and payouts from a Square account you connect, recorded in your books.
QuickBooks Online (Intuit): your records from QuickBooks, when you import them to move your books to Pluto Suite.

We may also disclose your information if required to do so by law, regulation, valid legal process, or to protect the rights, safety, or property of Pluto Suite, its users, or the public.

5. Background location and trip tracking

Pluto Suite collects your device's GPS location for the purpose of automatic mileage and trip tracking. Here is specifically how it works:

Automatic trip detection: it is on by default, and it takes effect once you grant "Always" location permission. While it is on, the app uses low-accuracy background location to notice when you start driving, and asks your phone to wake the app when you move more than about 150 metres from where it last stopped. These positions are held briefly on your phone and are used only to decide whether a drive has begun. If one has, the positions from the minutes just before are included as the first points of that trip, so the start of the drive is not lost. If no drive is detected, they are discarded on the device and are not sent to us.
While a trip is recording: the app uses high-accuracy location to capture the route, and that stops the moment the trip ends. If you turn automatic detection off, or do not grant "Always" permission, location is collected only during a trip you start yourself.
Background access: to track trips automatically, the app requires "always on" or background location permission on your device. Without this, trip tracking requires you to open the app manually.
How to turn it off: you can disable automatic trip tracking at any time in the Pluto Suite app settings, or by revoking the location permission in your device settings (iOS: Settings → Privacy → Location Services; Android: Settings → Apps → Pluto Suite → Permissions).
What we do with it: location data is used to calculate trip distances, look up the street addresses where trips start and end, suggest Business for a trip that ends near a saved job site or client address, work out your business-use percentage and any CRA per-km amount, and generate your mileage log. It is not sold or used for advertising.

6. Where your data is stored

Pluto Suite is operated by a Canadian company and serves Canadian users. However, your data is stored in the United States: our servers and files on Amazon Web Services in the us-east-2 (Ohio) region, and our database with Neon in the us-east-1 (Virginia) region. Requests to our website, web app and API pass through Cloudflare and Vercel, whose networks may handle them in data centres outside the United States, including in Canada, on the way. As a result, your data is subject to the laws of the United States, including laws that may allow US government authorities to access your information in certain circumstances. By using the Services, you acknowledge this cross-border transfer and storage of your information.

7. Data retention and deletion

Purpose limitation: we collect personal information only for a clear, specific purpose, and we do not keep it longer than needed to serve that purpose. If we ever intend to use your information for a different, unrelated purpose, we stop, and we obtain your consent before doing so.
Active accounts: we retain your information for as long as your account is active.
After deletion: when you delete your account, your sign-in is removed and your personal details (name, email address, phone number, address and profile) are erased from our live database right away. If you never recorded anything in a business, the account is removed outright. If you did, those records (receipts, invoices, bills, transactions, trips and payroll) are part of that business's books, which the CRA requires a business to keep for six years, so they stay in the business with your name and contact details removed. Copies in our backups are removed within 7 days (point-in-time backups), 6 weeks (nightly backups) and about 13 months (monthly backups). This cannot be undone.
Legal holds: some information may be retained after account deletion where required by law, including records needed for fraud prevention, resolution of disputes, enforcement of our agreements, or tax and regulatory compliance, such as the business records the CRA requires to be kept for six years.
Server logs: logs on our servers rotate daily and are kept for a few days for security and diagnostic purposes. Error reports sent to our error-monitoring provider (Sentry) are kept for the period that provider retains them.
Inactive accounts: we do not currently delete accounts for inactivity. If that changes, we will email you before deleting anything.

8. Cookies

Our marketing website (plutosuite.com) uses a small number of cookies and similar technologies:

Essential storage: your cookie choice, kept in your browser's local storage so the banner is not shown again. This cannot be disabled. The campaign tags and any Google or Meta ad click ID in the link you arrived on are also kept in session storage for that tab, whatever you choose; the click ID is only passed on to the app if you choose "Accept all" (see the Cookie Policy).
Analytics and advertising cookies: Google Analytics, Google Ads and Meta Pixel cookies, used to measure visits and which of our ads work. They are only set after you choose "Accept all". Choose "Essential only", or change your choice later on the Cookie Policy page, and no Google Analytics, Google Ads or Meta Pixel code loads.

The Pluto Suite mobile and web apps use local storage for session tokens and app preferences, not traditional browser cookies. The apps do not set advertising or third-party tracking cookies. The phone app includes Meta's software kit for ad measurement, described in Section 4. For full details, see our Cookie Policy.

9. Error monitoring and analytics

We use Sentry for error monitoring and crash diagnostics. Sentry receives limited technical data (device type, OS version, app version, and error stack traces), plus the internal user and business IDs of the signed-in account, to help us identify and fix bugs. Sentry does not receive your financial data, receipts, or personal documents. On plutosuite.com, and only with your consent, we use Google Analytics, Google Ads and the Meta Pixel to measure visits and ad performance (see Sections 4 and 8). The web app contains no third-party analytics or advertising tools. The new-account and first-payment events described in Section 4 are sent from our server to Google Analytics and Meta, under the IDs from your plutosuite.com visit.

10. Marketing communications

If you opt in during signup or later in your account settings, we may send you product updates, tips, and promotional offers by email through SendGrid. Every marketing email includes an unsubscribe link that immediately removes you from the mailing list. You can also unsubscribe at any time by contacting support@plutosuite.com. Unsubscribing from marketing emails does not affect transactional messages about your account or billing.

11. Your rights and choices

Access: you can request a copy of the personal data we hold about you at any time, or download it yourself from Profile, Download my data, in the web app
Correction: you can update your account information directly in the app, or contact us to correct inaccurate data
Deletion: you can permanently delete your account from within the app settings; your personal information is erased or anonymized, and business records stay with the business as described in Section 7
Data export: Download my data (in Profile, in the web app) gives you your profile and the receipts and trips you recorded as a JSON file; a business's owner or accountant can also export its records as CSV. You can also request an export by contacting us
Opt-out of marketing: unsubscribe via any marketing email or contact support
Location permissions: revocable at any time in your device settings

Depending on your province, you may have additional rights under applicable privacy law, including PIPEDA and, for Quebec residents, the Act Respecting the Protection of Personal Information in the Private Sector (Law 25). Residents of Quebec have the right to be informed of automated decisions, the right to de-index certain information, and enhanced consent and transparency rights. To exercise any of these rights, contact us at support@plutosuite.com.

12. Anti-spam compliance (CASL)

Canada's Anti-Spam Legislation (CASL) governs commercial electronic messages. Here is how Pluto Suite complies:

Consent: we only send marketing emails to people who have given express opt-in consent (during signup or in account settings) or where we have an existing business relationship that permits implied consent under CASL. Transactional messages about your account, billing, invoices, and security are not marketing and are sent as a necessary part of the Services.
Identification: every commercial message clearly identifies Pluto Suite as the sender and includes our operating entity (17737734 Canada Inc.) and a valid contact address.
Unsubscribe: every marketing email contains a working unsubscribe link. Opt-out requests take effect immediately in our system and are always honoured well within the 10 business days CASL allows.
No purchased lists: we do not buy, rent, or send to third-party email lists, and we do not send commercial messages to addresses collected without consent.

13. Quebec Law 25

For users in Quebec, we align our practices with the Act respecting the protection of personal information in the private sector, as modernized by Law 25:

Privacy Officer: we have designated a person responsible for the protection of personal information. You can reach them at support@plutosuite.com (subject line "Privacy Officer").
Consent and transparency: we collect only the personal information needed to deliver the Services, explain why in this policy, and obtain consent for any use beyond that purpose.
Privacy by default: account privacy settings default to the most protective option; sharing (for example, inviting team members or an accountant) only happens when you choose to enable it.
Automated decisions: Pluto Suite does not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Features such as automatic transaction categorization and OCR are suggestions you review and can override; you can ask us for information about how they work.
De-indexing and portability: you may request de-indexing or correction of personal information and a portable copy of the data you provided, in a structured, commonly used technical format.
Breach reporting: if a confidentiality incident poses a risk of serious injury, we will notify affected users and the Commission d'accès à l'information (CAI) as required, and keep a register of incidents.

14. Data Processing Agreement (processor terms)

When you use Pluto Suite to keep books for your own clients (for example, as a bookkeeper or accountant) or to process personal information about your employees and customers, you are the controller of that data and Pluto Suite acts as your processor. In that role we commit to the following processor terms, which together form our Data Processing Agreement (DPA):

Instructions: we process personal information only to provide the Services and on your documented instructions, not for our own independent purposes.
Confidentiality: personnel with access to personal information are bound by confidentiality obligations.
Security: we maintain the technical and organizational measures described in our Security page, including encryption in transit (TLS) and at rest (AES-256).
Subprocessors: we use the subprocessors listed in Section 4 and remain responsible for their compliance. We will inform you of material changes to that list.
Assistance: we help you respond to data-subject requests and, where applicable, with breach notification and privacy impact assessments.
Deletion and return: on termination, personal information is deleted or returned as described in Section 7, except where retention is required by law.

A countersigned copy of our standard DPA is available for business and accountant customers on request at support@plutosuite.com.

15. Subscription auto-renewal and consumer protection

Pluto Suite Pro is a subscription that renews automatically so your access is not interrupted. We follow Canadian consumer-protection rules, including Quebec's Consumer Protection Act provisions on automatic renewal:

Clear disclosure before you pay: the price, billing cycle (monthly or annual), any introductory offer, and the fact that the plan auto-renews are shown at checkout before you confirm, there are no negative-option or pre-checked add-ons.
Renewal terms: after any introductory offer (for example, 50% off the first three months on monthly billing), the plan renews at the standard rate disclosed at signup. We email a receipt for every charge.
Cancel any time: the Owner can downgrade to Free from Billing at any time; this stops future renewals, as set out under Refunds below. Your data is never deleted on cancellation.
Refunds: the Owner of the business can downgrade to Free from Billing at any time. If you downgrade within 24 hours of your most recent subscription charge, the subscription ends immediately and that charge is refunded in full. After 24 hours, Pro continues until the end of the period you have already paid for (a month or a year) and then does not renew, and the rest of that period is not refunded. Downgrading during the 7-day free trial ends the trial immediately with no charge. If you believe you were charged in error, contact support@plutosuite.com. This does not limit any refund rights you have under consumer-protection law that cannot be waived.
No hidden lock-in: there are no cancellation fees. A monthly plan can be cancelled at any time. An annual plan is paid for the year up front and can also be cancelled at any time; Pro then continues to the end of the year you paid for, and is not refunded for the unused months except as described above.

16. Social Insurance Number (SIN) handling

Pluto Suite only collects a Social Insurance Number when you enter one: an employee's SIN in Payroll, or a contractor's SIN as the tax number on a vendor (a sole-proprietor contractor's number for the T5018 is their SIN). Because a SIN is especially sensitive, we treat it with extra care:

Purpose limitation: a SIN is used solely to prepare the government filings that require it: T4 and T4A slips (CRA), RL-1 slips (Revenu Québec), Records of Employment (Service Canada), and T5018 statements of contract payments (CRA). It is never used as an account identifier, a login, or for marketing.
Encryption: SINs are encrypted at rest using AES-256-GCM and are transmitted only over encrypted (TLS) connections.
Access control: an employee's SIN can be entered or changed by Managers and above in Payroll, and after that the app shows only its last three digits. A contractor's tax number can only be seen or changed by Accountants and above. The files that contain a full SIN can only be downloaded by Accountants and above, and never by an external accountant.
Disclosure: a SIN is only included in the XML files you generate and submit yourself: T4 and T4A (CRA), RL-1 (Revenu Québec), Record of Employment (Service Canada) and T5018 (CRA). We do not sell it or share it with any third party for any other purpose.
Retention: a SIN is kept with your business's payroll or vendor records, which the CRA requires a business to keep for six years, until someone in your business with access removes it. It is not removed automatically, including when an employee closes their own Pluto Suite account.

17. Children's privacy

Pluto Suite is intended for business owners and individuals aged 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, please contact us and we will delete it.

18. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page with an updated "Last updated" date. For material changes, we will also notify you by email or via an in-app notice.

19. Contact

Questions about this Privacy Policy, your data, or to request a copy of your data, contact us at support@plutosuite.com.