Privacy Policy

Last updated: March 27, 2026

PracticePay ("we", "our", or "us"), operated by Xandar Labs, is committed to protecting your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian privacy law.

1. Information We Collect

We collect information you provide directly when you create an account or use our services:

Account information: name, email address, and password (stored encrypted)
Business information: company name, address, and contact details for invoicing
Client data: names and contact details of your billing clients
Invoice data: billing records, service descriptions, and payment amounts
Calendar integration: appointment data imported from connected calendar tools (e.g., Jane)
Payment data: processed securely by Stripe — we do not store card numbers

2. How We Use Your Information

To provide, operate, and improve the PracticePay platform
To generate invoices and billing documents on your behalf
To send transactional emails (OTP verification, password resets, support responses)
To process payments securely via Stripe
To comply with legal obligations

3. Data Security

Sensitive data fields are encrypted using AES-128-CBC encryption. Passwords are hashed using bcrypt. All data transmission uses HTTPS/TLS. We do not sell your personal information to third parties.

4. Data Sharing

We share data only with trusted service providers who help us operate PracticePay:

Stripe — payment processing
Amazon Web Services (AWS) — cloud hosting and storage
Zoho Mail — transactional email delivery
Neon / PostgreSQL — production database hosting

All third-party processors are bound by confidentiality agreements and are prohibited from using your data for any other purpose.

5. Your Rights

Under PIPEDA, you have the right to:

Access the personal information we hold about you
Request correction of inaccurate data
Withdraw consent to certain uses of your data
Request deletion of your account and associated data

To exercise any of these rights, contact us at customersupport@xandarlabs.com.

6. Cookies

PracticePay uses session cookies strictly necessary for authentication and security. We do not use tracking or advertising cookies.

7. Data Retention

We retain your account data for as long as your account is active. Upon account deletion, your personal data is removed within 30 days, except where retention is required by law.

8. Contact Us

For privacy-related questions or requests:

Xandar Labs — PracticePay Privacy Office

Brampton, Ontario, Canada

customersupport@xandarlabs.com