Privacy Policy

1. Who We Are

NexusPoint Labs is the product division of NexusPoint Consulting, a Canadian company based in Milton, Ontario. We build self-hosted AI tools including Ledger (expense tracking) and SpeakEasy (voice dictation).

This privacy policy applies to:

• nexuspointlabs.ca
• ledger.nexuspointlabs.ca
• speakeasy.nexuspointlabs.ca

2. Our Core Principle: Your Data Stays With Us

Unlike most SaaS products, our applications are self-hosted on our own infrastructure in Canada. We do not use third-party cloud providers for data storage. Your data is not shared with, sold to, or accessible by any third party.

When we say "self-hosted," we mean: your data lives on a server we physically control in Milton, Ontario — not on AWS, Google Cloud, or any other hyperscaler.

3. What Data We Collect

Account information: When you request access, we collect your name and email address. When your account is created, we store your username and a bcrypt-hashed password (we never see or store your password in plain text).

Ledger — financial data: If you use Ledger, we process: transaction data (vendor, amount, date, category), receipt images and PDFs, and the content of emails you forward to our receipt processing inbox. This data is used to automatically extract, categorize, and track your expenses for tax preparation.

SpeakEasy — voice data: If you use SpeakEasy, we process: audio recordings you make through the web interface, and the transcribed and AI-cleaned text output. Audio is processed for transcription and then retained in your session history unless you delete it.

Technical data: We collect basic server logs (IP address, request timestamps) for security and troubleshooting. We do not use analytics tools, tracking cookies, advertising pixels, or any third-party tracking technology.

4. How AI Processing Works

Our tools use AI to process your data:

• Ledger uses AI to read receipts (extracting vendor, amount, tax, date) and to auto-categorize transactions. Receipt images are sent to a cloud-based AI model for OCR (optical character recognition) processing. The AI provider processes the data transiently and does not store it after processing completes.
• SpeakEasy uses AI for two steps: (1) transcription of your audio using a local speech-to-text model, and (2) text cleanup using a cloud-based AI model that formats and polishes your dictation. Audio is processed locally; only the transcribed text is sent to the cloud model for cleanup.

We use Ollama Cloud as our AI processing provider. Their services process data ephemerally — meaning your data is not persisted, stored, or used for training after the processing request is complete.

5. What We Don't Do

• We do not sell your data to anyone
• We do not share your data with third parties for marketing
• We do not use your data to train AI models
• We do not use analytics, tracking cookies, or advertising pixels
• We do not share your data with advertising platforms
• We do not access or view your data unless you request support

6. Data Storage and Security

All data is stored on our self-hosted server in Milton, Ontario, Canada. Security measures include:

• HTTPS/TLS encryption for all data in transit (auto-provisioned via Let's Encrypt)
• Bcrypt password hashing (industry standard)
• Session-based authentication with signed cookies
• Per-user data isolation — each user can only access their own data
• No shared databases with other users
• Regular security updates applied to the host server

7. Your Rights Under PIPEDA

As a Canadian company subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access — request a copy of all personal data we hold about you
• Correction — request that we correct inaccurate information
• Deletion — request that we delete your account and all associated data
• Withdrawal — withdraw consent for data processing at any time
• Complaint — file a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, email support@nexuspointconsulting.ca. We will respond within 30 days.

8. Data Retention

We retain your data for as long as your account is active. When you request account deletion, we permanently remove:

• Your account and credentials
• All transaction data and receipts (Ledger)
• All dictation history (SpeakEasy)
• Any associated metadata

Deletion is permanent and cannot be undone. Server logs (IP addresses, timestamps) are retained for 90 days for security purposes, then automatically purged.

9. Children's Privacy

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us and we will delete it immediately.

10. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For significant changes, we will notify active users by email. We encourage you to review this page periodically.

11. Contact Us

If you have questions about this privacy policy or how we handle your data, please contact us: