Privacy Policy

Scope & accountability

comma is responsible for personal information under its control. This policy covers information handled by comma; a bank, AI provider, or other service you choose also handles data under its own privacy terms. Questions, access requests, and privacy complaints can be sent to privacy@trycomma.app.

Information we collect

Depending on the features you use, we collect:

• Account and security data, including your name, email, password verifier, terms-acceptance timestamp, session IP address and user agent, and two-factor authentication settings.
• If you sign in with Google, the name, email address, profile picture and account identifier Google shares, used only to create your account and sign you in. comma does not keep Google's sign-in tokens.
• Company records you enter, including books, invoices, bills, payments, business contacts, company and tax identifiers, and audit history.
• If your verified account is enabled for the private preview, personal-finance and income-tax preparation records you choose to add or import, including bank accounts, transactions, categories, budgets, source documents, working papers, and adjustments.
• If a company connects a mailbox, the invoices comma imports from it (with each one's sender, subject and date), and the sender addresses comma learns for the company's payees.
• Messages you send us and limited operational data used for support, security, error diagnosis, and eligible page analytics.

Company records may contain personal information about customers, vendors, team members, or founders. The company entering that information is responsible for having authority to use it.

How we use information

We use information to authenticate you; operate the ledger, documents, reports, company bank feeds, and the search of connected mailboxes for missing invoices; operate personal banking and income-tax workbenches when the private preview is enabled for your account; deliver messages you request; run connectors you authorize; provide support; monitor reliability; prevent abuse; and meet applicable legal obligations. We do not sell or rent personal information. We do measure our own advertising, which involves advertising cookies and interest-based ads on our public website and sign-up pages. The “Cookies, analytics & advertising” section below sets out what that covers, where it applies, and how to opt out. We never use the contents of your books, documents, or bank data for advertising.

Cookies, analytics & advertising

comma uses essential cookies for sign-in, company selection, and security. On Vercel deployments, Vercel Analytics measures basic usage on ordinary website and application pages; comma drops analytics events for private personal-finance, public-document, and sensitive Schedule 50 print paths before they are sent.

We also use PostHog for product analytics and error monitoring, and Google Tag Manager for Google Analytics, Google Ads, Meta, and Reddit marketing measurement. PostHog error reports have default personal-data collection disabled and are scrubbed of email addresses, government identifiers (such as SINs and CRA business numbers), and bank-connection tokens before they leave your browser or our servers. These services use cookies, session identifiers, IP address, browser and device information, page views, clicks, interaction events, web vitals, exception and performance data, and UTM and advertising click identifiers to help us understand product use, diagnose errors, and measure advertising results. PostHog is hosted in the United States. We do not enable PostHog session replay until its route allowlist and input masking have been separately verified.

Where this applies. Advertising tags run only on our public website and the sign-up, sign-in, add-company, and billing pages. Pages showing your books: ledgers, reports, transactions, sales, and documents: never load advertising tags. Private personal-finance pages, public document links, and Schedule 50 print views load no measurement at all.

What is shared. A small set of milestone events, such as creating an account, adding a company, or starting a paid subscription, together with an internal account identifier and plan and subscription status. For server-side advertising conversion matching, we may send a one-way hashed form of a verified email address and an internal identifier; we do not send ledger amounts, account names, transaction descriptions, invoice-line text, document contents, customer or vendor names, MCP prompts, or tool payloads.

Quebec. If you visit from Quebec, profiling and advertising technology is deactivated by default. We will only enable it after an explicit activation choice; otherwise these providers are not permitted to build an advertising profile from your visit.

How to opt out. Advertising measurement operates on an opt-out basis. You can decline it at any time by blocking third-party cookies in your browser, using Google's Analytics opt-out add-on or Google My Ad Center, adjusting Meta ad preferences, or turning off personalised ads in your Reddit account settings. You can also write to us at privacy@trycomma.app and we will exclude you. Declining has no effect on your ability to use comma.

Retention. Product and marketing analytics events are retained for up to 84 months. If session replay is enabled after its separate review, recordings are retained for up to 30 days.

The comma iPhone and iPad app

The app works on the same account and books as the web app. On your device it also uses:

• The camera and your photo library only when you capture or choose a receipt. The image is uploaded to your company's receipt inbox, where it is read exactly like a receipt uploaded on the web (see Service providers below); the app keeps no copy.
• Face ID or Touch ID, if you turn on the app lock. The check happens on your device; comma never receives biometric data.
• A push-notification token, stored so we can tell you about bank feeds, overdue invoices and items to review. It is removed when you sign out in the app or delete your account.
• Sign in with Apple, if you use it: we keep Apple's identifier for your account and a token used only to ask Apple to disconnect comma from your Apple ID when you delete your comma account.
• Diagnostics, sent to PostHog: crash and error reports (the crash stack, error codes and request identifiers), and three usage events — a receipt capture started, a receipt capture finished with its outcome, and a review undone. Each carries the app version, device model and operating system, an app-generated device identifier, and your comma user id. They never contain amounts, names, documents, or anything from the private personal-finance and founder areas; they are not collected in Quebec; and you can turn them off at Settings › Privacy › Share diagnostics. The app records no screen views, taps or sessions, and has no advertising or cross-app tracking.
• A home-screen widget that keeps the last cash figure it showed on your device; it is cleared when you sign out.

Bank data via Plaid

If bank connections are enabled and you connect an institution, Plaid Inc. provides account details, balances, and transactions that comma uses for bank feeds, reconciliation, and budgeting. Plaid describes its own handling in the Plaid End User Privacy Policy. comma encrypts Plaid access credentials at the application layer, and linking or repairing a bank connection requires recent two-factor authentication.

Company bank-feed data is scoped to that company. When the private preview is enabled, personal bank records are owned by your user account and kept separate from all company ledgers and memberships.

Connected mailboxes

A company's admin or accountant can connect a Gmail or Outlook mailbox so comma can find receipts and invoices. comma gets read-only access to that mailbox and uses it for one purpose: finding the receipt for a bank transaction that has none. Searching and reading are automated: they are done by AI, not by people. A search covers the few days around that transaction, and comma reads the sender, recipients, subject, date, a short preview and the attachment names of the messages it finds. Only a matching receipt is copied into comma: its attachment, or the email saved as a PDF when there is no attachment, with its sender, subject and date kept as a record of where it came from. It is stored as a receipt in that company's receipt inbox and read like any receipt you upload. comma never sends, deletes, moves or changes email, and message content is never written to logs, analytics or audit records.

Searches can be started by the company's admins and accountants, by comma's bookkeeping agent working in that company, and by an AI assistant one of them connects to comma, which receives the results under its own provider's terms. The AI models comma uses to read mail-derived documents run with zero data retention and are not trained on them. comma staff do not read mail-derived data unless you ask us to for a specific message, or it is necessary for security or to comply with the law. The keys that give comma access to a mailbox are stored encrypted, used only for the searches and imports described here, and never shown to anyone, including a connected assistant.

comma's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google Workspace APIs is not used to develop, improve, or train generalized or non-personalized AI and/or ML models. Mail-derived data is never used for advertising or to assess creditworthiness or make lending decisions.

Disconnecting a mailbox deletes comma's access to it; for Gmail, comma also asks Google to revoke it. Microsoft does not let an app revoke itself, so to remove comma from a Microsoft account entirely, use My Apps or account.live.com. Deleting your account disconnects every mailbox you connected.

Two kinds of mail-derived data outlive a disconnect, because they belong to the company's books rather than to the connection. Receipts already imported stay until someone deletes them; a record of each import (the sender, a subject of at most 200 characters, and the date) is kept even after its receipt is deleted, so the same email is never imported again. And the sender addresses comma learned for the company's payees stay, so a reconnected mailbox is searched as precisely as before. An admin or accountant can review, block or remove any learned sender on the Receipts page at any time, including after a mailbox is disconnected and while a company is read-only. Deleting the company removes all of it. To have any mail-derived data deleted sooner, including import records, email privacy@trycomma.app.

AI connectors

You can connect Claude, ChatGPT, or another assistant that supports the Model Context Protocol (MCP) to comma. The assistant then acts as you: every call is checked against your live role in the company it names, and the provider you chose receives the information comma returns for the actions you ask it to take, under its own privacy terms. Personal and income-tax connector tools are an allowlisted private preview: accounts without the entitlement cannot discover or invoke them.

What comma stores. The assistant's client registration — its name and redirect addresses, or, for an assistant that identifies itself with a published metadata document, that document's address and the metadata it publishes; the access and refresh tokens it holds, stored as keyed hashes (when a refresh token is exchanged, the new pair is also kept encrypted for a short reuse window, so a retried exchange gets the same tokens, and that copy is erased by the daily cleanup); the connection grant that links it to your account; audit log entries for its actions, recorded under your name and marked as AI; and the records it creates or changes in your books, which are kept like any other record in the company.

What comma receives. Only what the assistant sends in a tool call — for example the invoice details you asked it to create, or a receipt you asked it to upload. comma never receives your chat history, the assistant's memory, or other files in your conversation.

Telemetry. For each tool call, PostHog receives the tool's name, how long it took, whether it failed and a coarse error category, and your user and company identifiers. It never receives the inputs the assistant sent or the results comma returned.

Retention. Expired access tokens are deleted daily. Refresh tokens are deleted 35 days after they expire or are revoked. A connection that was started but never authorized is deleted after 24 hours, as is a client registration that never led to a connection. The record of a revoked connection is kept for 90 days so a connection's history can be investigated, without any usable token.

Revoke a connection at any time from Settings › Connections; the assistant's next request is refused. The connector guide's security section describes the authorization flow, token lifetimes, and limits in more detail.

Service providers & disclosures

Providers process information for specific operational purposes: Vercel for hosting and web analytics; Supabase for database hosting; Resend for transactional email; Plaid for bank connectivity; Google and Microsoft for mailboxes you connect; Stripe for subscription billing; PostHog for product analytics, error monitoring, and its Stripe warehouse ingestion; and Google Analytics, Google Ads, Meta, and Reddit for marketing measurement as described above. A receipt you upload, on the web or from the app, is sent through the Vercel AI Gateway to a model provider that reads its date, merchant, totals and taxes back to comma; the model never sees your chart of accounts or bank data. A receipt imported from a connected mailbox is read the same way. comma's bookkeeping agent also uses a model through the same gateway, with zero data retention and no training on your data, when it matches receipts, proposes categories for bank transactions, or searches a connected mailbox. Otherwise an AI provider receives information only when you connect one. These providers may process information outside Canada, including in the United States, where it can be subject to local law. We may also disclose information when required by a valid legal process or when reasonably needed to protect users, the service, or the public.

Safeguards

comma uses encrypted connections, tenant- and user-scoped access controls, live permission checks, two-factor gates for sensitive bank actions, encrypted provider credentials, audit logging, and telemetry scrubbing. No online service can promise absolute security; report a suspected privacy or security issue to privacy@trycomma.app.

Retention & deletion

We keep account and company data while the corresponding account or company remains active. Removing private-preview access hides and pauses those workbenches but does not itself delete their records. Deleting a company removes its books from the live application. Deleting your account removes your profile, sessions, connector tokens, and user-owned records after active personal Plaid connections have been revoked; the deletion fails if remote revocation cannot be confirmed.

Disconnecting a mailbox removes comma's credentials for it immediately; the imported receipts, import records and learned senders described under Connected mailboxes stay with the company until removed. Disconnecting a bank removes credentials and provider identifiers but can retain normalized posted history. A separate confirmed action permanently deletes disconnected personal history. Expired connector tokens are purged daily. Limited copies may remain in security logs or encrypted provider backups until their normal retention cycles expire; they are not available through the app.

Access, correction & complaints

Subject to applicable law, you may ask whether we hold your personal information, how it has been used or disclosed, and request access or correction. We may need to verify your identity. Where PIPEDA applies, we respond to access requests within 30 calendar days unless a permitted extension is required and explained. Send requests or complaints to privacy@trycomma.app. You may also contact the Office of the Privacy Commissioner of Canada.

Changes

We will update the date above when this policy changes and provide reasonable notice of material changes through the service or by email. Questions can be sent to privacy@trycomma.app.