Privacy

Privacy Policy

This policy explains what we collect, why we collect it, and what you can ask us to do about it. It applies to gwizweb.com and to the client and tenant portals we host. Our internal ERP hub has its own notice, at hub.gwizweb.com/privacy, written to the same standard.

Who is accountable. G Wiz Software Solutions Inc. is responsible for the personal information on this site. Our Privacy Officer is accountable for our compliance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), including for information we pass to the processors below, and can be reached at info@gwizweb.com.

What we collect

• Details you give us. Name, email address, company, role and anything you write in a form when you request an audit, a scope consultation, or support.
• Account information. Email address, name and role for people signed in to a portal.
• Payment information. Handled by Stripe. We receive a confirmation and the plan purchased. We never see or store your full card number.
• Technical information. IP address, browser type and pages requested, kept in server logs for security and troubleshooting.

Why we use it

• To answer your enquiry and prepare a quote.
• To provide, host and support the services you buy.
• To take payment and meet accounting and tax obligations.
• To keep the service secure and investigate misuse.

Where the law requires a legal basis, we rely on performing our contract with you, our legitimate interest in running and securing the service, your consent for optional cookies, and compliance with legal obligations.

Who we share it with

We use a small number of processors, each handling only what their function requires:

• Google Cloud — hosting, storage and databases, and Vertex AI for the scoping summaries described under Artificial intelligence.
• Stripe — payment processing.
• SendGrid — sending notification and transactional email.

We do not sell or share your personal information for behavioural advertising.

Cookies

Essential cookies keep you signed in and protect checkout; these cannot be switched off. Analytics and marketing cookies are optional and off until you turn them on. If your browser sends a Do Not Track or Global Privacy Control signal, we treat that as declining the optional categories and record that decision.

Change your cookie settings

How long we keep it

• Enquiries and consultation requests: 24 months from last contact.
• Customer and billing records: 7 years, to meet tax and accounting rules.
• AI-drafted scoping summaries: kept with the scoping request they summarise, for the same 24 months.
• Server logs: 30 days, deleted automatically.

Artificial intelligence

When you submit a scoping request after buying a plan, we ask Google’s Gemini model to draft a short summary of it for the person who will run your scoping call. It receives your target domain, the plan you bought, the names of files you uploaded and the business details you wrote — not your payment details, and not the files themselves. The draft is saved with your request and emailed to that reviewer; a person always reads your request before anything is said to you.

• No training. We use Gemini through Google Cloud Vertex AI, under Google Cloud’s terms, which do not permit Google to use our prompts or its answers to train or improve its models. We do not use the consumer or free Gemini services, whose terms allow that.
• Where it runs. In Google Cloud’s us-central1 region (Iowa, United States).
• No caching. Vertex AI’s response cache is switched off for our Google Cloud project.
• What Google may still keep. Google may log prompts for a limited period solely to detect abuse of its services, unless our account has been granted an exemption from that monitoring. We have not yet received that exemption, so we do not describe this as zero data retention.

Our internal ERP hub also has a Gemini assistant for our staff, which runs in Montréal, Canada; its handling is set out in the hub’s notice. Nothing else on this site is sent to an AI service.

QuickBooks Online integration

Our ERP application, Hollend Hub ERP QBO, connects to QuickBooks Online so a business’s operational records and its accounting ledger stay in step without anyone retyping them. This integration is described separately because it handles a customer’s accounting data, and the general description above is not precise enough for it.

What we are authorised to do

Connecting is an OAuth 2.0 authorisation the customer performs inside Intuit’s own consent screen. We request a single scope, com.intuit.quickbooks.accounting. We do not request payroll, payments or OpenID profile scopes, and we cannot read anything those scopes would cover.

What we read and write

• Customers and Vendors — to match an order or a supplier bill to the right party in the ledger.
• Invoices and Bills — created and updated so that what was sold and what was purchased reach accounting without re-entry.
• Items and Accounts — read so a line posts against the right product and account code.
• Company information — read on connection, to confirm which company file the authorisation belongs to.

We do not read bank feeds, transactions we did not create, payroll data or employee records. Operational fields that exist only in our system — delivery dates, installation status, internal acknowledgement numbers — are stripped from every payload before it reaches Intuit’s API, so the ledger keeps the shape an accountant expects.

How the authorisation is stored

Access and refresh tokens are held server-side, in Google Secret Manager and an access-controlled database. They are never placed in a browser, a cookie, a URL or a log line. A connection belongs to the company that authorised it and is not shared between customers.

How long we keep it

Records derived from QuickBooks Online — invoices, bills, and the customer and vendor records attached to them — are retained for seven years, the period tax and accounting rules require financial records to remain available. Authorisation tokens are not business records and are destroyed as soon as a connection is revoked.

How to disconnect

Either end can end the connection, and either is sufficient:

• In our application, Settings → QuickBooks → Disconnect, which deletes the stored tokens immediately.
• In QuickBooks Online under Apps → My Apps, or at accounts.intuit.com under Connected Apps.

Disconnecting stops all further reading and writing at once. It does not delete records already written to the ledger — those belong to the company’s accounting file and only the company can remove them — and it does not by itself erase the seven-year records above, which are deleted on the retention schedule or on a request made through the form below.

Intuit as a recipient

Where a customer connects QuickBooks Online, Intuit Inc. receives the data we write on that customer’s instruction and handles it under Intuit’s privacy statement. We do not sell QuickBooks data, do not use it for advertising, and do not use it to train any model.

Your rights

Depending on where you live, you may have the right to see the information we hold, correct it, delete it, take a copy elsewhere, object to certain uses, or withdraw consent. Residents of the EU and UK have these rights under the GDPR, residents of Canada under PIPEDA, and residents of California under the CCPA as amended by the CPRA, including the right not to be discriminated against for exercising them.

Use the request form below, or email info@gwizweb.com. We respond within 30 days.

Where your data is stored

Most of our infrastructure runs in Google Cloud's us-central1 region. The assessment and claim intake paths — the ones carrying claimant-identifying and clinical material, and the ones PIPEDA, PHIPA and SABS workflows touch — are stored in northamerica-northeast2 (Toronto). The platform as a whole is not Canadian-resident, and we do not claim it is: three of twelve stores are in Canada and the rest are in United States regions.

The store-by-store table, and what it would take to move a store to a Canadian region, are set out in Data residency & tenant isolation in our Governance & Architecture statement. That page is the authority on this and is re-checked against the live infrastructure rather than carried forward. Where a residency obligation applies to you, raise it before signing so it is scoped as part of the engagement.

If you are outside the region your data is stored in, it is transferred there and protected by the standard contractual clauses our providers operate under.

For Canadian residents. Information stored or processed in the United States is subject to the laws of that country, and courts, law-enforcement and national-security authorities there may be able to obtain access to it. Our processors are bound by contract to protect it and to use it only to provide their service to us.

Complaints and breaches

If you have a concern, please raise it with our Privacy Officer first. If we cannot resolve it, you may complain to the Office of the Privacy Commissioner of Canada (1-800-282-1376), or to your own data-protection authority if you live elsewhere. If a breach of our safeguards involving your personal information creates a real risk of significant harm, we will report it to the Privacy Commissioner and tell you as soon as feasible, as PIPEDA requires, and we keep a record of every such breach for at least 24 months.

Data Subject Rights (DSAR)

You can ask for a copy of your information, ask us to correct or delete it, or opt out of sale and sharing. We verify who you are before acting, and we reply within 30 days. Requests go to info@gwizweb.com.