Hengo is the AI-powered, all-in-one bookkeeping and tax compliance platform built for businesses across Canada, the United States, and Costa Rica. From automated transaction parsing and smart expense categorization to tax-ready reports fully aligned with GST/QST, IRS, and Costa Rican regulations — Hengo handles the numbers so you can focus on growing your business. One platform. Three countries. Zero headaches.

Privacy Policy — Hengo Accounting Software

1. Overview

Hengo ("we", "us", "our") operates a multi-currency accounting and bookkeeping platform for businesses in Canada, the United States, and Costa Rica. This privacy policy explains how we collect, use, store, and protect your personal and financial data when you use our platform.

We are committed to protecting your privacy and complying with applicable data protection laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, the California Consumer Privacy Act (CCPA) in the United States, and the General Data Protection Regulation (GDPR) in the European Union.

2. Data we collect

Account data: Name, email address, password (hashed), and role when you register.

Workspace data: Business name, country, province, tax registration numbers, currency, and entity type that you enter when creating a workspace.

Financial data: Transactions, invoices, bills, journal entries, contacts, and documents that you or your integrations import into the platform.

Usage data: IP address, browser type, pages visited, and feature usage patterns collected automatically when you use the platform.

Integration data: Bank connection tokens, exchange API keys, and other credentials you authorize through our integrations. These are encrypted at the field level.

3. How we use your data

We use your data to:

Provide the accounting and bookkeeping services you signed up for
Calculate and track taxes (GST, HST, QST, US sales tax, IVA) based on your jurisdiction
Generate financial reports and tax-ready documents
Process payments through Stripe for your subscription
Send you service notifications, security alerts, and support communications
Detect and prevent fraud, abuse, and unauthorized access
Improve our platform through aggregated and anonymized analytics

We do not sell your personal or financial data to third parties. We do not use your financial data to train AI models — your data is yours alone.

4. Data storage and residency

Your data is stored in the region you select when creating a workspace (Canada, United States, or Costa Rica). Data residency is enforced at the infrastructure level and cannot be changed without a formal data migration request.

All data is encrypted at rest using AES-256 and in transit using TLS 1.3. Sensitive fields are encrypted with an additional field-level encryption layer. See our security page for technical details.

5. Data sharing

We share your data only in the following circumstances:

Platform infrastructure: We use third-party cloud infrastructure providers to host and process all workspace data, user sessions, and usage telemetry. These providers operate under data processing agreements and are contractually restricted from using your data for any purpose other than providing the infrastructure for Hengo.
Payment and banking integrations: Stripe (subscription payments) and Plaid (bank connections) process payment and banking data under separate data processing agreements.
Legal compliance: When required by law, court order, or government regulation (e.g., CRA, IRS, or Hacienda requests with proper legal authority).
Business transfers: In the event of a merger, acquisition, or asset sale, data may be transferred to the acquiring entity with notice to you.
Your authorization: When you explicitly authorize sharing through an integration (e.g., connecting your bank account via Plaid).

6. Your rights

Depending on your jurisdiction, you have the right to:

Access: Request a copy of your personal data
Rectification: Correct inaccurate or incomplete data
Erasure: Request deletion of your data (subject to legal retention requirements)
Portability: Export your data in a structured, machine-readable format
Objection: Object to certain processing of your data
Withdrawal of consent: Withdraw consent for processing at any time

To exercise these rights, contact us at privacy@hengo.ai. We respond to all requests within 30 days.

7. Data retention

We retain your data for as long as your account is active. If you cancel your subscription, your data remains accessible for 30 days, after which it is permanently deleted. Tax-related records may be retained longer as required by law (e.g., CRA requires retention for 6 years from the end of the tax year).

8. Security

We protect your data with bank-grade encryption, SOC 2 controls, two-factor authentication, immutable audit trails, and continuous security monitoring. See our security page for details.

9. Contact

If you have questions about this privacy policy or wish to exercise your data protection rights, contact us at privacy@hengo.ai or see our contact page.