Privacy Policy
Effective November 1, 2026
This policy explains how Befikr handles personal information. By creating a workspace or using the service, you consent to the handling described here.
1. Two roles
Account information. We decide how account and billing information about our customers and their team members is used, and this policy applies to it.
Client information. Advisors and firms put information about their own clients into Befikr. For that information, the advisor or firm is responsible for collecting it lawfully and answering requests about it, and we handle it on their behalf and on their instructions. If you are a client of an advisor, contact that advisor first.
2. What we collect
- Account details: name, email, company, country, province or state, role, and profile details you choose to add.
- Billing details: plan, invoices and limited card details such as brand and last four digits. Full card numbers are handled by our payment processor.
- Client information you enter or upload: this can include contact details, dates of birth, financial and insurance details, identity documents, health-related details and notes.
- Connected accounts: if you connect Google or Microsoft, the mail and calendar data needed for those features.
- Technical and security records: IP address, browser details, sign-in events, activity logs and error logs.
- Acceptance records: which version of these documents you accepted, when, and from what IP address and browser.
3. How we use it
- to provide, secure, support and improve the service;
- to sign you in, including emailing one-time codes;
- to bill you and send service messages;
- to prevent fraud and abuse, and to investigate problems;
- to comply with the law and to enforce our terms.
We do not sell personal information.
4. Who we share it with
We use service providers who handle information for us, under obligations to protect it:
- hosting and infrastructure providers;
- an email delivery provider;
- a payment processor (Stripe);
- an AI provider (Anthropic), which receives the content you send to AI features such as notes, summaries, document reading and the Mia assistant;
- Google or Microsoft, if you connect those accounts.
We may also disclose information where the law requires it, to protect rights and safety, or as part of a sale or reorganization of our business.
5. Where information is stored
Some providers operate outside your province or outside Canada, including in the United States. Information sent to them is subject to the laws of those places and may be accessible to authorities there.
6. Support access
Our authorized staff can sign in to a workspace as its owner to give support, for up to 60 minutes at a time. A reason is required, and each session is recorded in the audit log and the workspace's activity feed.
7. Cookies
We use only the cookies needed to run the service, such as your sign-in session and security tokens. Your browser also stores small preferences such as light or dark theme. We do not use advertising cookies.
8. Keeping information
- We keep account and client information while the workspace is active.
- A deleted workspace is kept for at least 90 days so it can be restored, and may then be permanently erased.
- When a workspace is erased, its database records are removed, but its uploaded files are moved to a restricted archive and kept until we delete them.
- We keep billing records, audit logs and acceptance records for as long as we need them for legal, tax, security and dispute purposes. They can outlast a deleted workspace.
9. Security
We use safeguards including one-time sign-in codes, optional two-step verification, access controls that separate each workspace, encrypted connections and activity logging. No system is completely secure, and we cannot guarantee that information will never be accessed without permission. If a breach creates a real risk of significant harm, we will notify those affected and the regulators as the law requires.
10. Your rights
Subject to legal limits, you may ask to access or correct your personal information, ask questions about how it is handled, or withdraw consent. Withdrawing consent may mean we cannot keep providing the service. You may also complain to the Office of the Privacy Commissioner of Canada or your provincial regulator. Requests about client information go to the advisor or firm responsible for it.
11. Children
The service is for businesses and is not meant for children. Children's information may appear only as entered by an advisor for their client.
12. Changes
We may update this policy. For a material change we will give notice by email or in the service before it takes effect. The date at the top shows the current version.
13. Contact
Our Privacy Officer can be reached at privacy@befikr.ca.