ClientFile

Privacy Policy

Who we are

ClientFile is a client-file system for financial advisors (“agents”). This policy explains what information ClientFile holds, where it is kept, who can reach it, and the choices agents have. It is written for agents and for their clients.

Who is responsible for what

  • The agent decides. An agent’s client records belong to the agent’s practice. The agent chooses what to put into ClientFile and which optional features to use.

  • ClientFile holds and processes that information for the agent. We don’t use it for any other purpose.

  • If you are an agent’s client and want to see, correct or remove your information, please ask your advisor. We help advisors answer such requests.

ClientFile is operated by Walt Thiessen, contact walt@loatoday.net.

What ClientFile holds

  • About agents: name, email address, practice details, and a password that is stored only in a form that can’t be turned back into the password.

  • Client records the agent enters or imports: names, contact details, family and financial information, policies and accounts, notes, documents, and emails the agent forwards to their ClientFile address.

  • Support tickets the agent sends us, with any attachments.

ClientFile uses one cookie, to keep an agent signed in. There is no advertising, no tracking across websites, and we never sell information.

Where it is kept

  • Server: ClientFile runs on Vexxhost, a Canadian-owned company, in its Montreal data centre. The disk holding the information is encrypted. Because the running service has to read records to work, that encryption protects the disk itself, not the running service.

  • Operator access: ClientFile’s operator is in the United States and has technical access in order to maintain the service, so US legal process can reach the operator. We access client records only when maintaining the service or when the agent asks us to help.

Services that handle information in transit or on request

  • Email (Mailgun, a US company). Emails the agent forwards to ClientFile pass through Mailgun on the way in. Mailgun also sends ClientFile’s notices, such as replies to support tickets.

  • AI features (only when the agent chooses). Some features send content to an outside AI service. Each one is off until the agent has read what it sends, and where, and chosen to use it.

    • Anthropic (US) drafts letters, translates emails, reads scanned forms and sorts uploads. ClientFile asks Anthropic to process this in the United States. Anthropic does not use it to train its models, and keeps it for up to 30 days (up to 2 years if its safety systems flag it).
    • OpenAI (US) transcribes voice notes.
    • Where possible, names recorded in the client file are replaced with placeholders before sending.

Backups

  • We keep no backups of agents’ records. The agent keeps their own.
  • Download: an agent can download a complete backup from Settings at any time.
  • Automatic backups (if the agent turns them on): each night ClientFile saves a backup to the agent’s own Google Drive (see the next section).
    • The agent can lock these backups with a passphrase only they know. Then neither Google nor ClientFile can open them, and if the passphrase is lost, no one can.
    • Google is a US company.

Google user data (automatic backups)

When an agent connects Google Drive for automatic backups, ClientFile asks Google for:

  • Access only to files ClientFile itself creates in the agent’s Drive (the drive.file permission). It’s used to save the nightly backups into a folder named “ClientFile backups” and to remove backups older than the 7 daily and 4 weekly it keeps. ClientFile cannot see any other file in the agent’s Drive.

  • The agent’s Google email address, shown in Settings so the agent can see which account the backups go to.

ClientFile uses this access only to store and tidy the agent’s own backups. It does not read the agent’s other files, does not share Google data with anyone, does not use it for advertising, and does not use it to train or improve AI models.

ClientFile keeps the sign-in Google provides, encrypted, so that backups can run at night. The agent can withdraw it at any time with “Disconnect” in Settings, or from their Google Account permissions page. Backups already saved in their Drive stay there and remain the agent’s.

ClientFile’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Keeping and deleting information

  • An agent can edit or delete records in ClientFile at any time.

  • If an agent closes their ClientFile account, we delete their records from our server within [30] days.

  • An agent can download a final backup first.

Changes to this policy

When this policy changes, the date at the top changes. When a change affects where records are kept or who can reach them, ClientFile also tells agents inside the app before it takes effect.

Contact

Questions about this policy or about your information: walt@loatoday.net