2ABooks Privacy Policy

Effective date: 2026-07-22 · Version 1.0 · NailAce Beauty Canada Ltd.

This Privacy Policy explains how NailAce Beauty Canada Ltd. ("NailAce Beauty Canada", "we", "us", "our") collects, uses, discloses, stores and protects personal information when you use 2ABooks, an AI-assisted bookkeeping web application (the "Service"). This Canadian instance of 2ABooks is operated by NailAce Beauty Canada Ltd., including for our own bookkeeping as a real-world test of the Service.

We are committed to handling personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and the British Columbia Personal Information Protection Act (BC PIPA). Because we operate only in British Columbia, Quebec's Law 25 does not apply to this Service.

Please read Section 5 (Where your data is stored and processed) carefully. Your personal information is stored on servers located in South Korea and is processed by service providers in the United States. This is a cross-border transfer, and while your information is in a foreign country it may be accessible to that country's courts, law enforcement and national-security authorities.

1. Who we are (accountability)

NailAce Beauty Canada Ltd. is a British Columbia company (Company No. BC1593184, incorporated 2026-06-01).

• Registered/business address: 422 Richards St, Vancouver, BC [TBD: postal code]
• Email: info@nailacecanada.com
• Phone: +1 672 200 6146

We are accountable for the personal information under our control, including personal information that we transfer to third-party service providers (such as Supabase, Vercel, Google and Groq) for processing on our behalf. We remain responsible for that information and use contractual or other means intended to provide a comparable level of protection while it is being processed by those providers. [TBD: confirm signed data-processing / DPA terms with Supabase, Vercel, Google and Groq.]

A privacy-management program and staff privacy training are planned to be established at launch and are not yet in place.

1.1 Privacy Officer

We have designated a Privacy Officer who is accountable for our compliance with this Policy and applicable privacy law. You may contact the Privacy Officer for any privacy question, access request or complaint:

• Privacy Officer: [TBD: Privacy Officer name/title — a NailAce Beauty Canada Ltd. officer]
• Email: info@nailacecanada.com
• Mail: 422 Richards St, Vancouver, BC [TBD: postal code]

2. Personal information we collect and why (identifying purposes)

We identify the purposes for which we collect personal information at or before the time of collection. We collect only what is necessary for the purposes listed below.

Counterparty names. A counterparty in your records can be an individual, meaning your uploads may contain the personal information of third parties. You are responsible for having the authority to upload that information and to have it processed as described in this Policy (see Section 4.1).

3. How we limit collection

• We collect only the information listed in Section 2, by fair and lawful means.
• We do not store passwords — sign-in is passwordless (magic link).
• Your email address and any bank-account numbers are never sent to the AI providers (Google or Groq).
• We self-host our web font (Pretendard); no third-party font content-delivery network (CDN) is used, so no font-related data is transferred to a font CDN.

4. Consent

We ask for your knowledge and consent to collect, use and disclose your personal information. Because financial data is sensitive, we seek meaningful consent through a consent gate at sign-up.

4.1 Optional AI feature — separate express opt-in (cross-border)

The AI account-suggestion feature is optional and requires your separate, express opt-in because it transfers data to AI providers in the United States. If you enable it, we send the transaction description, counterparty, amount and account list (and, for a receipt, the image for OCR) to Google LLC (Gemini API) and Groq, Inc. (Groq API and receipt OCR) to suggest an account. Your email address and bank-account numbers are not sent.

If you decline the AI feature, 2ABooks remains fully usable. Transactions are classified locally by a rule-based classifier only (enforced in code), and no data is sent to the US AI providers.

See Section 5.3 for an important caveat about how these free-tier AI providers may use submitted data.

4.2 Withdrawing consent

You may withdraw consent at any time by contacting the Privacy Officer, subject to legal or contractual restrictions and reasonable notice. The optional cross-border AI consent can also be declined at any sign-in, or turned off in the app at any time. If you decline or withdraw AI consent, 2ABooks remains fully usable — transactions are classified locally by a rule-based classifier and no data is sent to the US AI providers. Withdrawing consent for essential processing may mean we can no longer provide the Service.

5. Where your data is stored and processed (cross-border)

5.1 Storage in South Korea

Your personal information — including transaction records and any counterparty names — is stored and processed in Supabase's ap-northeast-2 region (Seoul, South Korea). This means personal information collected in Canada is stored outside Canada, in South Korea.

5.2 Processing and hosting in the United States

Vercel Inc. (United States) provides our web hosting and serverless functions; requests to the Service transit United States infrastructure. If you enable the optional AI feature, Google LLC and Groq, Inc. (both United States) also process the data described in Section 4.1.

5.3 Free-tier AI providers — data may be used to improve their services

The AI feature uses the providers' free-tier APIs. Under each provider's policies, data submitted through the free tier may be used by that provider to improve its own services. For this reason, we do not claim that your data "is not used for AI training," and this is precisely why the AI feature is opt-in rather than on by default. If you do not want your data handled this way, do not enable the AI feature — the local rule-based classifier remains fully available.

5.4 Foreign-jurisdiction access notice

While your personal information is located in South Korea (storage) and the United States (hosting, and the optional AI feature), it may be accessible to the courts, law enforcement and national-security authorities of those countries under their laws.

5.5 Accountability for transferred data

We remain accountable for your personal information in the hands of every service provider and use contractual or other means intended to ensure a level of protection comparable to what it would receive in Canada. [TBD: confirm signed processor terms with Supabase, Vercel, Google and Groq.]

5.6 Canadian data region (under evaluation)

We are evaluating the use of a Canadian data region for production. [TBD: whether a Canadian data region will be used for production.] Until confirmed, do not assume your data is stored in Canada.

6. How we use, disclose and retain your information

6.1 Service providers, recipients and retention

6.2 No sale of personal information

We do not sell your personal information. We use and disclose it only for the purposes identified in this Policy, or as permitted or required by law.

6.3 Retention

We retain personal information only as long as necessary to fulfil the identified purposes or to meet legal requirements, and then destroy or anonymize it. Where personal information has been used to make a decision about an individual, we retain it for at least one year as required by BC PIPA. [TBD: retention schedule per data type.] Receipt images are not stored on 2ABooks servers; when you use image OCR they are transmitted to Groq (USA) for text extraction only, and only the extracted fields are saved as a transaction.

7. Accuracy

We rely on you to keep your information accurate and up to date. You can view and edit your profile and your transaction records at any time within the app. AI account suggestions are drafts that you review and can correct before they are recorded (human-in-the-loop), which helps keep your ledger accurate.

8. Safeguards

We protect personal information with security measures appropriate to its sensitivity. The following are currently in place:

• An authentication session gate on all routes — unauthenticated requests are rejected (401) or redirected.
• Row-level security in the database to isolate each organization's data.
• The administrative service key is kept server-side only.
• Encryption in transit using HTTPS/TLS.
• Encryption at rest through Supabase's managed database encryption.
• Our web font is self-hosted, with no third-party CDN.

A formal privacy-management program and staff privacy training are planned at launch and not yet established.

9. Openness and transparency

This Policy is publicly available in plain language. It identifies our Privacy Officer, the foreign locations where your information is stored and processed (South Korea and the United States), and how to access your information or make a complaint.

10. Your right to access and correct your information

You have the right to request access to the personal information we hold about you and an account of how it has been used and disclosed, and to request correction of inaccurate information. To make a request, contact the Privacy Officer (Section 1.1).

• Response time: We will respond within 30 business days as required by BC PIPA, or notify you of any permitted extension.
• Cost: Access to your own personal information is generally provided at minimal or no cost; where a minimal fee applies for non-personal-employee requests as permitted by BC PIPA, we will give you an advance estimate. [TBD: any minimal access-fee basis, if applied.]
• Corrections: If we agree a correction is warranted, we will correct the record; if we do not, we will annotate the record with your requested correction.

11. How to raise a concern or complaint (challenging compliance)

Please contact our Privacy Officer first (Section 1.1) so we have an opportunity to address your concern. If you are not satisfied, you may contact the relevant regulator.

11.1 Privacy regulators

• Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) — BC PIPA. PO Box 9038 Stn Prov Govt, Victoria BC V8W 9A4 (physical: 4th Floor, 947 Fort Street, Victoria BC V8V 3K3) · Tel 250-387-5629 · Toll-free via Service BC 1-800-663-7867 (ask to be transferred to 250-387-5629) · info@oipc.bc.ca · www.oipc.bc.ca. The OIPC generally expects an organization to be given a chance to respond before it reviews a complaint.
• Office of the Privacy Commissioner of Canada (OPC) — PIPEDA. 30 Victoria Street, Gatineau, Quebec K1A 1H3 · Toll-free 1-800-282-1376 · Tel 819-994-5444 · TTY 819-994-6591 · www.priv.gc.ca.

11.2 Consumer matters

For consumer/distance-sales matters (relevant once paid billing begins — see the Terms of Service): Consumer Protection BC — #200-4946 Canada Way, Burnaby BC V5G 4H7 (mail: PO Box 9244, Victoria BC V8W 9J2) · Toll-free 1-888-564-9963 · info@consumerprotectionbc.ca · www.consumerprotectionbc.ca.

12. Privacy breaches

If a breach of security safeguards occurs, we will assess whether it creates a real risk of significant harm (PIPEDA) or could reasonably be expected to result in significant harm (BC PIPA). Where required, we will notify the OPC and/or the OIPC BC and affected individuals, and we will keep records of breaches as required by law.

13. Sign-in emails

Magic-link sign-in emails and account-related messages are transactional messages that you have requested in order to use the Service. They are sent to identify you and secure your account and are not marketing messages.

14. Children

2ABooks is a business tool intended for use by businesses and is not directed to children.

15. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new effective date and, where changes are material, take reasonable steps to notify you.