Privacy Policy and Terms of Use

1. Scope and definitions

This Policy applies to information provided to us by or on behalf of a business that requests a review ("you", the "Client"), to the documents that business supplies, and to visitors to dekalos.com (the "Site").

A Document is a vendor billing record you supply: a merchant card processing statement, a commercial electricity bill, a parcel carrier invoice together with a rate agreement, or a software billing summary together with a user list. Extracted Figures are the numerical values read from a Document: the vendor, the billing period, volumes, each charge line with its label and amount, and totals. Identifying Detail is everything else a Document carries: the business name, merchant, account and terminal numbers, addresses, deposit and banking detail, and any person's name.

2. Information we collect

We collect only what the review needs:

• Documents, supplied by you by one of the three routes in section 3.
• Business context: your business type (for example, restaurant with cards present), the vendor, and the billing period.
• Contact information: an email address to reply to and, for monitoring clients, the address to which monthly reports are sent.
• Correspondence: emails you send us.

We do not collect portal logins, passwords, API keys or account credentials of any kind, and we decline them if offered. We do not collect payment card numbers. We do not collect information about your customers.

3. How a document is handled

Every Document is reduced to its Extracted Figures and then discarded. Identifying Detail is not retained. Any sequence of five or more digits inside a charge label — a terminal or merchant number printed within a fee description — is replaced with the text [redacted]. The Extracted Figures are filed under a client reference number assigned by us, which has no meaning outside our records. The three routes differ only in where the reduction happens:

4. What we retain, and for how long

On request we will delete every record above that relates to you, except where retention is required by law or to resolve a dispute, and we will confirm when it is done.

5. How information is used

Information is used only to:

• perform the review you requested and prepare your report;
• for monitoring clients, compare each month with the months before it and report the trend;
• verify a saving and issue an invoice where a success fee applies;
• respond to your correspondence and requests;
• maintain the fee ledger described in section 4, which improves the accuracy of every review.

We do not use your Documents or Extracted Figures for marketing, for profiling, to train any automated system, or for any purpose not listed above.

6. Disclosure and third parties

We do not sell, rent, trade or share your information with anyone. We do not contact your processor, utility, carrier, insurer or any other vendor, and we do not act for you in dealings with them. The only third parties that touch information in the ordinary course are the infrastructure providers below, each of which processes it on our behalf under its own published terms:

We may disclose information where required by law, by a court order, or to establish or defend a legal claim, and then only to the extent required.

7. Security

The principal safeguard is that little exists to protect: Documents are discarded, Identifying Detail is not retained, and what remains carries a reference number rather than a name. Beyond that:

• Processing takes place on DEKALOS equipment under our physical control, not on a shared server.
• Mailbox access uses a single-purpose application credential, stored with permissions that restrict it to the operator's account and excluded from any code repository or backup.
• Extracted Figures and reports are stored outside any version control or cloud synchronisation.
• The Site is served over HTTPS only, with a content security policy that blocks all scripts on every page except dekalos.com/prepare, where the policy forbids any network request.
• Every reduction of a Document is verified against the Document's own printed totals before the Document is deleted, so a misread is caught while the original still exists.

In the event of a breach affecting your information we will notify you without undue delay, describe what was affected, and report to the Office of the Privacy Commissioner of Canada where the law requires it.

8. This website

The Site sets no cookies, runs no analytics, carries no advertising and includes no tracking of any kind. It has no user accounts and no upload facility. The page at dekalos.com/prepare runs a script on your own computer to read a PDF you choose; the page is forbidden by its security policy from transmitting anything, which your browser enforces and which can be verified by inspecting the page's response headers.

9. Your rights and choices

You may at any time, by emailing contact@dekalos.com:

• ask what information we hold about you and receive a copy;
• ask for it to be corrected;
• ask for it to be deleted, subject to section 4;
• withdraw from monitoring, after which no further Documents are processed for you;
• ask a question or raise a concern about this Policy.

We respond within thirty days. You may also complain to the Office of the Privacy Commissioner of Canada. If you are in a jurisdiction that grants additional rights, we honour them on the same request.

10. Cross-border transfers

DEKALOS operates from Ontario, Canada. The providers in section 6 operate in the United States and elsewhere, and information handled by them may be stored or processed outside Canada, where it is subject to the laws of that place. We choose providers whose terms include contractual protection for the information they handle.

11. Changes to this policy

We may revise this Policy. The effective date at the top of the page changes when we do, and material changes are notified to current clients by email before they take effect. Continued use of the services after that date is acceptance of the revised Policy.

12. Contact

Questions, requests and complaints about privacy: contact@dekalos.com. We are the privacy officer for the purposes of Canada's Personal Information Protection and Electronic Documents Act.