Who we are
Cold Sun Enterprise Inc. publishes Helios, including Helios Field and Helios Ledger. We are in Quebec, Canada.
Our address is 35 rue de Maintenon, Blainville QC J7B 1M6, Canada.
The privacy officer is Erik Wiltjer, support@coldsunenterprise.com. Policy version 2026-10-21, effective 21 October 2026.
Data we collect
Account and sign-in data: name, work email, role, and the authentication result from Microsoft, Google, or a one-time email link.
Customer and operations data you enter in Helios: accounts, work orders, appointments, invoices, and files you upload.
Bank data through Plaid, when a finance user connects a bank in Helios Ledger: account balances and transactions. Helios stores the institution name, the account name, the last four digits, the currency, and the balances and transactions needed for the books. Helios does not ask you to type a bank password into Helios.
Payment data for Helios subscriptions is entered on Stripe. Helios stores the subscription status, not the full card number.
Why we use it
Bank balances and transactions are used for accounting and the bank feed in Helios Ledger: reconciliation, categorization, and the financial record of the workspace.
Sign-in data is used to confirm who you are and which workspace and role you may use.
We use subprocessors only to run Helios. We do not sell personal information, and we do not sell bank data.
Subprocessors
- Cloudflare hosts Helios and provides network security and application delivery.
- Plaid connects the bank and supplies balances and transactions.
- Microsoft provides Entra sign-in for administrators and optional Microsoft 365 mail.
- Stripe processes Helios subscription payments.
Each subprocessor receives only what that service needs. A bank login is not one of those fields.
Retention and deletion
Bank balances and transactions are kept while the bank connection is active.
When you disconnect the bank, or the Helios account is closed, Helios calls Plaid Item Remove for a stored Plaid item and deletes the stored bank balances and transactions within 30 days. The current product deletes that bank data as part of the disconnect request.
Posted accounting journals that an accountant has already recorded stay in the books. The imported bank feed itself is removed.
The consent record (who agreed, when, and which policy version) is kept so we can show what was agreed. It is not a copy of the bank transactions.
Your rights under PIPEDA and Quebec Law 25
You may ask to access the personal information we hold, to correct it, to withdraw consent, and to have bank-feed data deleted. Quebec Law 25 also gives you the right to data portability and to be informed of a decision made exclusively by automated processing.
Send requests to the privacy officer, Erik Wiltjer, support@coldsunenterprise.com. We respond within 30 days.
You may complain to the Commission d'accès à l'information du Québec and to the Office of the Privacy Commissioner of Canada.