Privacy Policy

Last updated August 10, 2026.

1. Who this policy covers, and our commitment

Iron North Ledger ("we," "us," "our") is operated from Kitchener, Ontario, Canada. This policy explains what personal information we collect, why, how we protect it, and the rights you have over it under the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private-sector privacy law.

We serve users located in both Canada and the United States, and this policy — grounded in Canadian law — applies to all users regardless of where you are located. If you are a U.S. resident, see Section 8 for information specific to you.

2. What we collect

We collect:

• Account information you provide at signup or in account settings: email address, and optionally name, phone number, and mailing address.
• Trade and portfolio data you enter yourself: ticker symbols, quantities, prices, commissions, trade dates, portfolio country, account type, and currency. There is no automated brokerage import — every figure in the Service comes from data you typed in. This is financial data about your holdings and transactions, and we treat it as sensitive.
• Payment information, if/when you subscribe to a paid plan: handled by our payment processor, Stripe — we do not store your full card number ourselves (see Section 6).
• Technical information automatically collected in the ordinary course of serving the Service: your session cookie and CSRF (cross-site request forgery) protection cookie, both required for the Service to function and log you in securely, and standard web server logs (e.g. IP address, timestamp, requested page) used for security and troubleshooting. We do not use third-party advertising or analytics cookies.

3. Why we collect it, and our basis for doing so

We collect and use this information to: create and secure your account; perform the cost-basis and capital-gains computations that are the whole point of the Service; let you export tax-report-style summaries; send you account-related email (verification, password reset, security alerts); and maintain the security and integrity of the Service. We do not sell your personal information, and we do not use your trade or portfolio data for any purpose other than providing the Service to you.

Under PIPEDA, we rely on your meaningful consent as the basis for collecting and using this information — given by creating an account and entering data into the Service. You can withdraw that consent at any time by closing your account (see Section 8), subject to legal or contractual restrictions and reasonable notice.

4. How we protect your information

We use industry-standard safeguards appropriate to the sensitivity of this data, including: encrypted transport (HTTPS/TLS) for all traffic to the Service, including HTTP Strict Transport Security; passwords stored using one-way cryptographic hashing, never in plain text, and checked against a password-strength policy at signup; automatic lockout after repeated failed login attempts; and secure, HTTPS-only session cookies. Administrative access to the Service is limited to authorized staff, and our internal admin tools are deliberately built so that staff cannot grant themselves or others elevated account privileges through the web interface.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. See Section 9 for what happens if that protection ever fails.

5. Where your data is stored

Iron North Ledger's production data is stored on infrastructure located in Kitchener, Ontario, Canada, our main datacenter. This applies to all users' data regardless of where you are located, including U.S. residents — we do not currently transfer your personal information outside Canada, with the limited exception described in Section 6 for payment processing.

Production data is backed up regularly as part of our hosting provider's standard backup process. [Note: the backup retention schedule and backup storage location should be confirmed and stated precisely here before finalization — we believe backups are also Canadian-stored but that has not yet been independently confirmed at the infrastructure level.]

6. Third parties who process your information

We use a small number of service providers, and share only what each one needs to do its specific job:

• Stripe (payment processing) — if/when you subscribe to a paid plan, your payment card details are sent directly to and held by Stripe, not by us. Stripe is a well-known, PCI-compliant payment processor; see Stripe's own privacy policy for how it handles your payment data. Billing is not yet live as of this writing.
• Email delivery — account-related email (signup verification, password reset, security alerts) is sent through our own hosting provider's mail infrastructure, not a third-party email marketing service. We do not send marketing email.

We also use publicly available data from the Bank of Canada's exchange-rate API to show approximate currency conversions on the tax report — this is a one-way lookup of public exchange-rate data; no personal or account information about you is sent to the Bank of Canada or any exchange-rate provider.

We do not otherwise sell, rent, or share your personal information with third parties for their own marketing purposes.

7. Your rights under PIPEDA

Under PIPEDA, you have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information (you can update most account information yourself in account settings, and can ask us to correct anything you can't);
• Withdraw your consent to our collection and use of your information, subject to legal or contractual restrictions and reasonable notice, by closing your account;
• Ask questions or file a complaint about how we handle your personal information — first with us (Section 12), and if you're not satisfied with our response, with the Office of the Privacy Commissioner of Canada.

8. Notice to residents of the United States

Iron North Ledger is a Canadian company. This policy — including its legal basis (PIPEDA) and the Canadian data residency described in Section 5 — governs your personal information regardless of where you are located, including if you are a U.S. resident. If you are a U.S. resident:

• Your personal information is transferred to, and stored and processed in, Canada, as described in Section 5.
• Depending on which state you reside in, and Iron North Ledger's size and activities at any given time, one or more U.S. state privacy laws (such as California's CCPA/CPRA, or other state comprehensive privacy laws) may separately apply to you. [Counsel note: most such laws only apply to businesses above certain revenue or data-volume thresholds — whether any currently apply to Iron North Ledger, and what additional disclosures or rights (e.g. a right to opt out of "sale" or "sharing" of personal information, though we do not sell or share it for third-party marketing — see Section 6) this section should separately disclose, has not yet been confirmed and needs review before this section is considered complete.]
• We intend the practices described throughout this policy — no sale of personal information, data minimization, the security safeguards in Section 4 — to apply consistently to all users, not only Canadian residents.

9. Data retention and account deletion

We retain your account and trade/portfolio data for as long as your account is active, since historical trade data is needed to compute accurate cost basis going forward. If you close your account, [counsel/ business note: specify the actual retention period after closure — e.g. a fixed number of days before permanent deletion, and any exceptions for data we're legally required to keep longer, such as billing records].

10. Breach notification

If a breach of security safeguards involving your personal information creates a real risk of significant harm to you, we will notify you and report the breach to the Office of the Privacy Commissioner of Canada, as required under PIPEDA's mandatory breach reporting rules, without unreasonable delay.

11. Children's privacy

The Service is not directed at children, and we do not knowingly collect personal information from anyone below the age of majority in their province, state, or territory of residence.

12. Contact and our privacy officer

Questions, access requests, or complaints about how we handle your personal information can be sent to service@ironnorthledger.com, or via our contact page. [Note: PIPEDA requires an accountable individual be designated to oversee privacy compliance; this section still needs that person's name and role added before publication is finalized — a named accountable individual is a separate, still-open requirement from the inbox address above.]

13. Changes to this policy

We may update this policy from time to time. We will post the updated policy here with a new "Last updated" date, and for material changes we will make reasonable efforts to notify account holders (such as by email).