Privacy Policy
How Velveteen Technologies Inc. protects, encrypts, and handles your financial records, personal data, and bookkeeping ledgers on Clef.
Key Highlights & Plain-English Commitments
A straightforward summary for artists, musicians, and managers. This summary supplements the formal legal terms below.
01.100% Customer Data Ownership
You retain exclusive ownership of all uploaded bank statements, receipts, invoices, journal entries, and financial records. We do not own your financial data.
02.Zero Generative AI Model Training
We process transaction details via Anthropic Claude Haiku commercial APIs solely for bookkeeping categorization and reconciliation matching. Your financial data is never used to train foundation AI models.
03.We Never Sell Personal or Financial Data
We do not sell, rent, or trade your personal information, ledger records, or banking data to data brokers, ad networks, or third-party marketers.
04.Multi-Tenant Defense-in-Depth
Your workspace is protected by PostgreSQL Row Level Security (RLS) on client queries, strict membership validation on server routes, TLS 1.3 transit encryption, and AES-256 storage encryption.
Cookie and advertising choices
Essential cookies support site operation. Optional Meta advertising tracking, including browser Pixel events, attribution cookies and server-side Conversions API events, starts only after you select Accept. Missing consent and Reject block these events. You can reopen Cookie settings to change your choice; rejection stops future tracking and clears Meta identifiers stored by this site. Rejection cannot recall events already sent while you had accepted.
Introduction, Scope & Corporate Identity
This Privacy Policy ("Policy") describes how Velveteen Technologies Inc. ("Company", "we", "us", or "our"), a corporation organized under the laws of the Province of British Columbia, Canada (Incorporation No. BC1495562), collects, uses, stores, discloses, and protects information gathered through Clef (accessible at clef.to and related APIs, subdomains, and applications, collectively the "Service").
Clef provides specialized bookkeeping, financial organization, double-entry ledger management, and tax estimation software designed specifically for musicians, recording artists, producers, tour managers, and music creators.
By creating an account, accessing, or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described herein, please do not use the Service.
Information We Collect
In operating the Service, we collect personal and financial information across four principal categories:
2.1 Account & Identity Information
When you register or sign in (via passwordless magic links or Google OAuth), we collect your name, email address, profile photo (if provided by OAuth), and workspace identification details.
2.2 Bookkeeping, Transactional & Tax Data
To provide bookkeeping ledgers and tax prep schedules, you may upload or connect financial records, including:
- Bank statement records and uploaded CSVs (dates, descriptions, amounts, CAD/USD currencies).
- Chart of accounts, general ledger entries, and vendor/client names.
- Scanned receipts, invoices, and contracts uploaded as document attachments (stored in DigitalOcean Spaces).
- Tax profile data: business numbers (e.g. CRA BN9/RC0001), GST/HST tracking figures, shareholder loan transactions, and capital cost allowance (CCA) asset cost records.
2.3 Third-Party Integration Credentials
If you connect external services (such as Stripe, PayPal, Float, or banking feeds), we collect authorized OAuth tokens, API access credentials, and sync preferences. These credentials are encrypted at rest using AES-256.
2.4 Technical, Device & Telemetry Data
When you interact with the Service, our servers automatically log technical metadata, including IP addresses, browser types, operating systems, referring URLs, request timestamps, and essential authentication session cookies.
Statutory Framework & Legal Bases for Processing
3.1 Canadian Statutory Framework (BC PIPA & PIPEDA)
As a British Columbia corporation, our primary privacy compliance is governed by the Personal Information Protection Act of British Columbia (BC PIPA) and the Personal Information Protection and Electronic Documents Act of Canada (PIPEDA). Under Canadian law, we collect, use, and disclose personal information with consent (express or implied) or as authorized by statute for legitimate business purposes.
3.2 European Economic Area (EEA) & UK Users (GDPR)
For subscribers accessing the Service from the EEA or the United Kingdom, we process personal data under the following recognized legal bases under the General Data Protection Regulation (GDPR / UK GDPR):
- Performance of Contract: To provide the Clef software, manage workspace ledgers, and perform account operations under our Terms of Service.
- Legitimate Interests: To secure the platform, prevent multi-tenant data cross-contamination, detect fraud, and maintain system stability.
- Legal Compliance: To retain mandatory accounting audit trails and tax workpapers required by corporate statutes.
- Consent: Where you voluntarily enable optional third-party integrations (e.g. Stripe, PayPal) or request AI-assisted transaction matching.
3.3 California Residents (CCPA / CPRA Notice)
For California residents, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), requires specific disclosures. We collect the categories of personal information described in Section 2 solely for direct business purposes. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than performing the services requested.
How We Use Your Information
We use your information exclusively to deliver, maintain, and safeguard the bookkeeping platform:
- Generating accurate trial balances, balance sheets, profit & loss statements, and revenue breakdown reports.
- Calculating Canadian tax preparation schedules (GIFI codes, Schedule 1 book-to-tax adjustments, Schedule 8 CCA depreciation, and corporate T2 estimates).
- Matching bank statements to general ledger entries during bank reconciliation workflows.
- Dispatching secure magic-link authentication emails and essential security notices.
- Providing responsive customer support and troubleshooting user-reported ledger issues.
Artificial Intelligence & Machine Learning Policy
Clef provides optional AI-assisted features to save musicians hours of manual ledger bookkeeping:
5.1 AI Features & Data Fields Transferred
We utilize commercial API endpoints provided by Anthropic PBC (model claude-haiku-4-5-20251001) for three specific bookkeeping operations:
- Transaction Categorization: Sends transaction description, amount (in cents), and workspace chart-of-accounts labels to suggest category codes.
- Vendor Normalization: Sends raw payee/merchant strings to match and resolve known contacts or suggest new vendor records.
- Reconciliation AI Matching: Sends bank transaction row dates, descriptions, and amounts, alongside candidate book transaction dates, descriptions, vendor names, and amounts to recommend reconciliation pairings.
5.2 Zero Foundation Model Training Guarantee
Under Anthropic's commercial API terms, customer inputs and generated outputs are never used to train or fine-tune foundation machine learning models. Your financial ledger records are never incorporated into public or commercial generative AI models.
5.3 Provider Data Retention & Safety Exceptions
Under standard commercial API terms, inputs and completions are retained by Anthropic for a standard period of up to 30 days solely for security monitoring, abuse detection, and operational debugging, except where longer retention is necessary to investigate safety violations or comply with legal requirements, after which the data is deleted.
Authorized Subprocessors & Third-Party Service Providers
We rely on vetted infrastructure and service providers ("Subprocessors") to host and operate Clef. Each subprocessor is bound by data processing agreements requiring high-standard security, confidentiality, and data protection:
| Subprocessor | Role / Service | Location | Safeguard |
|---|---|---|---|
| Supabase Inc. | Managed PostgreSQL database, Auth & Row Level Security | United States (AWS) | AES-256 encryption at rest, SOC 2 Type II |
| DigitalOcean LLC | DigitalOcean Spaces (Receipt, invoice & document storage) | San Francisco, CA, USA (sfo3) | Encrypted S3-compatible storage, access keys isolated |
| Vercel Inc. | App Router web hosting, Edge network & serverless compute | United States / Global Edge | TLS 1.3 SSL termination, ISO 27001 |
| Anthropic PBC | Claude Haiku LLM inference (Categorization & reconciliation) | United States | Commercial API terms, zero model training |
| Resend Inc. | Transactional email delivery for magic links and alerts | United States | DKIM/SPF alignment, encrypted transit |
| Stripe Inc. | Payment processing & balance transaction import | United States / Canada | PCI-DSS Level 1 certified |
Security Architecture & Multi-Tenant Isolation
We employ a defense-in-depth security model to safeguard your financial and personal data:
- Database Row Level Security (RLS): For all client-authenticated user sessions, PostgreSQL database tables enforce Row Level Security tenant isolation policies. Users cannot query, modify, or view rows belonging to other workspaces.
- Server-Side Workspace Membership Validation: Backend routes and administrative operations that utilize elevated service credentials strictly authenticate the user's session and verify that the user is an authorized member of the requested
workspace_idbefore executing any tenant-scoped database queries. - Encryption in Transit & at Rest: All web traffic is encrypted using TLS 1.3 with HTTPS enforcement and HSTS. All database volumes, backups, and document attachments in DigitalOcean Spaces are encrypted at rest with AES-256.
- Zero Service-Role Secrets in Client Bundles: Client-side code never receives database administrative keys or third-party secret tokens.
Data Retention, Portability & Deletion
Accounting and bookkeeping data is subject to unique statutory retention requirements:
- Active Retention for Statutory Bookkeeping: As long as your account remains active, Clef retains your financial records, journal entries, and uploaded receipts so that you can produce multi-year financial statements and satisfy tax record-keeping requirements (such as the Canada Revenue Agency's standard 6-year retention guidance).
- Data Export Requests: You may request an export of your complete transaction history, general ledger, and financial records by contacting support@clef.to.
- Account Closure & Deletion Procedure: To close your account and request data deletion, contact privacy@clef.to. Upon verified request, your workspace is immediately deactivated from active access, and your data is permanently purged from production databases within 30 days.
- Disaster Recovery Backups: Automated database snapshots maintained by our cloud infrastructure providers rotate out and are overwritten according to their managed platform backup schedules.
Your Privacy Rights & Choices
Your statutory privacy rights depend on your jurisdiction of residence:
9.1 Canadian Residents (BC PIPA & PIPEDA)
You have the right to request access to the personal information we hold about you, to challenge its accuracy and request correction, and to withdraw your consent to ongoing processing (subject to legal or contractual restrictions).
9.2 California Residents (CCPA / CPRA)
Under the CCPA, California consumers have the right to: (1) Know what personal information is collected, disclosed, or shared; (2) Request deletion of their personal information; (3) Request correction of inaccurate personal information; (4) Non-discrimination for exercising privacy rights; and (5) Opt out of the sale or sharing of personal information (note: Clef does not sell or share your personal information).
9.3 European Economic Area & UK Residents (GDPR)
Under the GDPR, individuals have the rights of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object to processing based on legitimate interests.
To exercise any of these rights, please email our Privacy Officer at privacy@clef.to. We verify your identity prior to fulfilling requests and respond within statutory deadlines (typically 30 days).
If you believe our processing violates your privacy rights under Canadian law, you have the right to lodge a complaint with the Office of the Information and Privacy Commissioner for British Columbia (OIPC) (www.oipc.bc.ca) or the Office of the Privacy Commissioner of Canada (OPC) (www.priv.gc.ca).
Cross-Border Data Transfers
Velveteen Technologies Inc. is based in British Columbia, Canada. Our primary cloud hosting (Vercel), managed database (Supabase AWS North America), and file storage (DigitalOcean Spaces US) are located in the United States and Canada.
For transfers of personal data from the EEA, UK, or Canada to the United States, we rely on standard contractual clauses (SCCs) and commercial data processing agreements entered into with our cloud infrastructure providers to ensure that your data receives a level of protection substantially equivalent to applicable domestic standards.
Children's Privacy
Clef is commercial financial software intended exclusively for professional artists, musicians, and businesses. The Service is not directed to individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from minors. If you believe a minor has registered an account, contact us immediately at privacy@clef.to for account termination and data purge.
Contact Information & Privacy Officer
If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our designated Privacy Officer:
Modifications & Version History
We may update this Privacy Policy from time to time to reflect changes in our legal obligations, software features, or subprocessor relationships.
If we make material changes that reduce your privacy rights, we will provide at least 14 days advance notice by emailing your registered account address or posting a prominent notification banner within the application dashboard prior to the changes taking effect.
Your continued use of Clef following the effective date of an updated Policy indicates your acceptance of the revised terms.
Corporate Identification & Privacy Officer
Clef is owned, maintained, and operated by Velveteen Technologies Inc., a corporation organized under the laws of the Province of British Columbia, Canada.
Version History & Changelog
- v1.0 (2026-09-28):Initial formal publication and launch release for Clef bookkeeping service. Prior versions: None. For archived copies or change histories, contact legal@clef.to.