Effective date: 1 October 2026
Scope and service provider
This policy explains how personal information is handled when you visit the Wexcy website, create an account, or use the platform. The service is provided by KANCY SYSTEMS TECHNOLOGY LTD. In this policy, “Wexcy,” “we,” and “us” refer to that service provider.
Registered address: Care of: GRANTTAX ACCOUNTING, 8-1521 TRINITY DR, MISSISSAUGA, ON L5T 1P6, Canada.
If you visit a website or store run by an organization using Wexcy, read that organization's privacy notice to understand how it handles information about its visitors and customers.
Your account and organization records
Information associated with your Wexcy account is distinct from the records an organization enters to run its business. The organization decides what those records contain, who can access them, and the purposes for which it uses them. A person can own one organization and work in another with different permissions.
When we process an organization's customer or employee information to deliver a service it requests, we do so under its instructions, the terms governing that service, and applicable law. The organization remains responsible for collecting that information lawfully and providing any required notices and obtaining any required permissions. This does not remove Wexcy's own legal responsibilities for its processing.
Account information and Google sign-in
We use registration information, including your email address and account identifiers, to create your account, recognize you when you sign in, and provide appropriate access to your organizations. You need to provide the information required for your chosen sign-in method to use the account.
When you choose Google sign-in, we receive your Google account identifier, email address, and basic profile information made available through sign-in, such as your name. We store your email address and the identifier of your account with the sign-in provider to link that identity to Wexcy. Your sign-in name and provider may also appear in operational sign-in logs. Google sign-in is used for authentication, not to access your Gmail messages or Google Drive files.
You can manage the permission granted to Wexcy through your Google account settings. Revoking permission with Google or removing the connection in Wexcy is not the same as deleting your Wexcy account or organization records. Keep an alternative sign-in method before removing a method you depend on to access your account.
Information you provide while using Wexcy
The information you enter into Wexcy depends on the functions you use. It can include organization details, website content, products and services, customer and supplier records, orders, messages, documents, and team information.
Enter only information you need for your work and have the right to use. Content you publish on a website or store may be available to the public according to the publishing choices you make.
Operational records are distinct from the content you enter. They can include account identifiers and records of events such as sign-in and account deletion. These records support service operation and the investigation of faults or security incidents.
Purposes of processing
We use account information to manage registration, sign-in, and access to organizations. We process content and records supplied by users to carry out the platform functions they request within their permissions. We also use the information needed to send account messages, respond to requests, and operate and protect the service.
Where applicable law requires a legal basis, processing necessary to provide your account and requested service is based on performing the agreement with you. Service security and the investigation of faults or misuse are based on our legitimate interests in protecting the service and its users, subject to your rights and the necessity of that processing. Processing required by law is based on the relevant legal obligation. Organization records processed on the organization's behalf are subject to its lawful instructions and the terms governing that processing.
If a particular use relies on your consent, you can withdraw that consent through the method explained when it is requested or by contacting sales@wexcy.com. Withdrawal does not affect the lawfulness of earlier processing and may stop the use that depends on it. Accepting the Terms of Service does not, by itself, provide consent for every use of personal information.
Access to information and sharing
Members' access to an organization's records depends on their assigned roles and permissions. Information may reach an external party when the organization uses a connection or service that requires sharing, or publishes content for its customers.
We use Microsoft to host the platform and store its data. We do not send users' data to an external AI service provider. Technical service providers involved in delivering account messages receive the information needed to deliver those messages, such as the recipient's address and message content.
Choosing Google sign-in also involves Google's authentication service and its own privacy terms. This is distinct from Wexcy giving Google access to your private organization records.
We may disclose information to meet a legal obligation or a binding request, to the extent required by law. This clause does not permit unrestricted disclosure of your records.
Storage, security, and international transfers
Platform data is stored in Germany with Microsoft. Storage location is distinct from the location from which support or administration may access information. Any international access or transfer must comply with applicable data-protection requirements and the safeguards they require. Contact sales@wexcy.com for information about relevant processing locations and safeguards.
Access to accounts and organizations relies on sign-in methods and permissions. Keep your sign-in method secure and review team members' permissions when their responsibilities change. No electronic system can eliminate every risk of unauthorized access or loss.
Retention and deletion
Our retention policy distinguishes account information, organization records, operational logs, and backups. We retain account information for as long as needed to provide the service and manage sign-in. We review the need to retain information when an account closes or a valid deletion request is received, rather than retaining it indefinitely without a purpose.
The 7-day deletion target is being implemented; its operational application has not yet been verified. For straightforward deletion requests, our target is to remove the information eligible for deletion from active systems within 7 days after verifying the requester's identity and authority and determining the request's scope. This is an operational target, not a legal waiting period or permission to delay deletion required earlier. Where European GDPR applies, we respond to rights requests without undue delay and normally within one calendar month of receipt, with any permitted extension explained within that month.
The backup-policy target being implemented is a retention limit of 90 days from creation of each backup, with shorter periods where recovery needs permit. Backup settings have not yet been verified against this target. Information removed from active systems may remain in an earlier backup. The policy procedures being implemented include restricting such information from ordinary use and reapplying deletion if a backup is restored; their operational application has not yet been verified. The backup period does not postpone the handling of a deletion request or create a general exception to the right to erasure.
The policy target being implemented for necessary operational and security logs is a standard retention period of no more than 90 days from the logged event, with shorter settings where appropriate. Application of this target to all logs has not yet been verified. Specific records may be retained longer only for a documented incident, legal obligation, or legal claim, for as long as that reason requires. This does not justify retaining the entire account.
Leaving an organization does not delete your account. Deleting an account does not automatically erase organization records that still have a lawful purpose, subject to applicable law and the organization's instructions. That distinction does not remove your rights over personal information in those records. We explain any information retained in response to a request and the reason for retaining it.
Send deletion requests to sales@wexcy.com. Review the account-data options available in your settings and keep the information you need before closing an account. If you manage an organization, arrange for its administration and access before deleting an account on which it depends.
Your rights and privacy requests
Depending on applicable law, you may have the right to access or correct your personal information, request its deletion or a copy, or restrict certain processing. You may also have the right to receive qualifying information in a portable format.
You may also have the right to object to certain processing, including processing based on legitimate interests. Send an objection or other privacy request to sales@wexcy.com. We may ask for proportionate information to verify your identity or authority before carrying out a request, to protect your information and the information of others.
If your request concerns information held by an organization using Wexcy, contact that organization. Responding may require referring to it according to its role and responsibilities. You may complain to the relevant data-protection authority where the law provides that right. Responses, exceptions, and time limits are governed by applicable law.
Policy updates and contact
We may update this policy when the service, our processing practices, or legal requirements change. We publish the updated version with its effective date and provide appropriate notice of material changes as required by applicable law. A policy update does not replace separate consent where new processing requires it.
For privacy questions and requests, contact KANCY SYSTEMS TECHNOLOGY LTD. through sales@wexcy.com.