Privacy Policy

Oatmilk is a service of AGI Ventures Canada, Inc. In this policy, "AGIV", "we", "us" and "our" mean AGI Ventures Canada, Inc. and its affiliates. "You" means anyone who uses Oatmilk: company owners and their team, accountants, contractors, people who sign documents, and visitors to this site.

This policy covers the Oatmilk website, app, terminal app, AI connector and everything else we offer under the Oatmilk name (the "Service"). It explains what information we collect, why, how we keep it safe, who we share it with, and the choices you have. Our Terms of Service are part of the same agreement. Please read this policy carefully.

We follow Canada's private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and the other privacy laws that apply to us.

• Personal Data means information about a living person who can be identified from it, alone or together with other information we have or are likely to get.
• Company Records means what you or your team put in or connect to Oatmilk for a company: transactions, receipts, invoices, agreements, contractor details, tax details and the files that come with them.
• Usage Data means information collected on its own when the Service is used, such as when a page was visited and for how long.
• Cookies are small files stored on your computer or phone.
• Device Information means information about the computer or phone used to reach the Service, such as its model, operating system and browser.
• Location Information means a rough idea of where you are, worked out from things like your IP address.
• Data Controller means the person or company that decides why and how Personal Data is used. For your account, we are the Data Controller.
• Service Providers (also called Data Processors) means companies that handle data for us, only to help us run the Service.
• Data Subject means the living person that Personal Data is about.

When your company uses Oatmilk, your company decides what goes into its Company Records and who can see them. For Personal Data inside those records, such as details about a contractor or a customer, your company is in charge of it and we handle it for your company, as these terms describe.

We collect different kinds of information to run the Service and make it better. We collect only what Oatmilk needs to do what you ask. We don't buy information about you from data brokers, and we don't use your information for advertising.

When Oatmilk runs on your own computer or server, such as the terminal app with a local AI model or a self-hosted install, your records stay there and we don't receive them. This policy then covers only what you send us yourself, such as a support email.

Your account

Your name, email address, sign-in details and the settings you choose.

Your company's records

What you or your team put in or connect: transactions, receipts, invoices, agreements, contractor details such as hours, payment details and tax numbers, and the files that come with them.

Email you send to Oatmilk

Messages forwarded to your company's Oatmilk addresses, and mail from inboxes you choose to connect. Oatmilk reads this mail only to find what belongs in your books, such as receipts and bills.

Ask AI chats

What you ask Ask AI and what it answers, so you and your team can read your chats again.

Usage Data

When you use the Service, your browser or device may send us information such as your IP address, browser type and version, the pages you visit, the time and date of your visit, how long you spend on pages, Device Information and error reports. We use it to keep the Service working, fast and safe.

Cookies

We use cookies and similar tools to run the Service:

• Session cookies keep you signed in.
• Preference cookies remember your settings, such as your theme.
• Security cookies help protect your account and stop misuse.

We don't use cookies to show you ads or to follow you across other websites. You can tell your browser to refuse cookies, but then you may not be able to sign in or use parts of the Service.

We use the information we collect to:

• provide and run the Service: sort charges, match receipts, file email, send the emails and documents you ask us to send, and answer your questions;
• tell you about changes to the Service and send notices about your account;
• let you use features you choose, such as Ask AI and connected services;
• help you when you ask for support;
• learn how the Service is used so we can make it better;
• find, stop and fix technical problems, misuse and fraud;
• carry out our agreements with you and enforce our rights, including billing;
• make combined or anonymous statistics that don't identify you;
• do anything else we tell you about when you give us the information, or that you agree to.

We may also send you news about Oatmilk. You can stop these emails at any time with the link in each email or by writing to us. Messages about your account and security are not optional while you have an account.

We never sell your information, and we never use your company's records for advertising.

Oatmilk uses AI models to read receipts and documents, sort charges, file email and answer questions. To do that, the part of your records a task needs is sent to the AI model provider that does the task. We send only what the task needs.

We don't use your company's records to train AI models. Google Workspace APIs are not used to develop, improve or train generalized AI or machine learning models.

Ask AI can only see and do what the person using it is allowed to. It asks before it changes anything important. AI can make mistakes, so check what it suggests.

• Your team sees what their role allows.
• Accountants you invite see only what you give them access to.
• Contractors see only their own hours, pay, agreements and profile.
• Signers see only the documents you send them to sign.

You choose who to invite and what they can see, and you can take access away at any time.

When you give us information to do something, such as sign up or upload a receipt, you agree that we can collect and use it for that purpose. If we want to use it for a different purpose, we will ask you first or give you a clear way to say no.

You can take back your consent at any time by writing to us at privacy@agiventures.ca. We will then stop collecting, using or sharing that information, unless the law requires us to keep it. Oatmilk may then not be able to do some things for you.

We keep Personal Data only as long as we need it for the reasons in this policy, and as long as the law requires, to settle disputes, or to enforce our agreements.

Tax law often requires businesses to keep records for years, so Oatmilk keeps your company's records while your company's account is open, until you or your company decide otherwise. When you ask us to delete information, we delete it, except what we must keep by law. Backups are cleared on their normal schedule.

We keep Usage Data for a shorter time, unless we need it to keep the Service safe or working, or the law requires us to keep it longer.

Your company's books, files and receipts are stored in Canada. Some of the companies that help us run Oatmilk work in other countries, such as the United States, so information can be processed and kept there. For example, Oatmilk's servers run in the United States, and Ask AI chats, which can quote your records, are kept there. Privacy laws there may differ from yours, and information there may be reachable by that country's authorities under its laws.

If you are outside Canada, your information is sent to Canada, and to the other countries above, and handled there. By using the Service, you agree to that transfer. We take reasonable steps to make sure your information is handled safely and as this policy says wherever it goes, and we only send it to companies that protect it properly.

We share information only as this policy describes:

• People you choose. Your team, accountants, contractors and signers, as described in "Who can see what".
• Service providers. Companies that help us run Oatmilk: hosting, database and file storage, sign-in, email delivery, payment processing and AI model providers. They may use your information only to provide their service to us, and must protect it.
• Services you connect. When you connect a bank, Wise, Stripe, an inbox, or an AI app such as Claude or ChatGPT, information moves between Oatmilk and that service as you set it up. Their own privacy policies apply on their side.
• Our affiliates. Companies that are part of AGIV, under this policy.
• When the law requires it. If a court or government lawfully asks, or to protect people from harm or financial loss, to look into suspected illegal activity, or to set up, use or defend our legal rights.
• If our business changes hands. If we merge with, are bought by, or sell assets to another company, your information may move to that company, and this policy still protects it.
• With your consent. In any other case, only if you agree.

Your information is encrypted when it travels over the internet. Access inside AGIV is limited to people who need it to run and support Oatmilk. We use safety measures that fit the kind of information we hold and the risks of handling it.

No way of sending or storing information over the internet is 100% safe, so we can't promise perfect security. If a breach puts your information at real risk, we will tell you and the regulators the law requires us to tell.

Under PIPEDA you can:

• ask what Personal Data we hold about you, how we use it and who we've shared it with;
• ask us to fix information that is wrong or not complete;
• take back your consent, as described in "Consent";
• complain to us, and if you aren't happy with our answer, to the Office of the Privacy Commissioner of Canada.

If you work with a company that uses Oatmilk, that company decides what is kept about your work for them. Ask them first; we will help them answer.

If you live in the European Union or the European Economic Area, the General Data Protection Regulation (GDPR) gives you more rights. You can ask us to:

• show you, update or delete the Personal Data we hold about you;
• fix information that is wrong or not complete;
• stop using your Personal Data, or use it only in limited ways;
• give you a copy of your Personal Data in a common, machine-readable format;
• take back your consent where we rely on it.

You can also object to how we use your Personal Data, and complain to your local data protection authority. Read the law at eur-lex.europa.eu.

CalOPPA requires websites that collect personal information from California residents to post a privacy policy. Under CalOPPA we agree that:

• you can visit our site without telling us who you are;
• the link to this policy says "Privacy" and is easy to find on our home page;
• we will post any change to this policy on this page;
• you can change your personal information by writing to us at privacy@agiventures.ca.

Do Not Track

Do Not Track is a setting in your browser that tells websites you don't want to be tracked. We don't track you across other websites or show you ads, whether Do Not Track is on or off. You can turn Do Not Track on or off in your browser's settings.

If you live in California, the California Consumer Privacy Act (CCPA) lets you ask us:

• What we have about you. The kinds of personal information we collected, where it came from, why we collected it, the kinds of companies we shared it with, and the pieces of personal information we hold. You can ask up to twice in 12 months, and the answer may cover the last 12 months.
• To delete it. We will delete the personal information we hold about you, and tell our service providers to do the same, except what the law lets or requires us to keep. Some features may stop working without it.
• Not to sell or share it. We don't sell or rent your personal information to anyone, for any purpose.

We will never treat you differently for using these rights.

We may use service providers to see how the Service is used, such as which pages are visited and which load slowly. We use what we learn to make the Service better, not to show you ads.

We use service providers such as GitHub to build, check and release the Service's software. They don't receive your company's records.

If you pay us for the Service, a payment processor handles your payment. We don't collect or store your full card number; you give it straight to the payment processor, whose own privacy policy applies. Payment processors we use follow the Payment Card Industry Data Security Standard (PCI-DSS).

The Service may link to websites we don't run. If you click one, you'll go to that site. We aren't responsible for its content, privacy policy or practices, so please read its privacy policy.

The Service is for businesses and is not meant for children under 13. We don't knowingly collect Personal Data from children under 13. If you learn that a child has given us Personal Data, please tell us and we will delete it.

We may update this policy from time to time. When we do, we will post the new policy on this page and change the "Last updated" date at the top. If a change matters, we will tell you by email or in Oatmilk before it takes effect. Please check this page from time to time.

If you have a question about this policy or want to use your rights, write to us at privacy@agiventures.ca. We may ask you to prove who you are before we answer.