Privacy Policy

"Business Tax Pro" refers to the operator of businesstaxpro.ca and the Business Tax Pro Client Portal at businesstaxpro.vercel.app. We are based in Ontario, Canada, and subject to PIPEDA and the Personal Information Protection Act (Ontario, where applicable).

Privacy Officer: Questions about this policy or your data can be sent to info@businesstaxpro.ca.

Account information

• Email address and full name (for sign-in and personalization)
• Hashed password (we never see or store your plaintext password — Supabase Auth handles this with bcrypt)

Business information you provide

• Corporate legal name, business number (BN), fiscal year-end, province
• Bank statement PDFs you upload (we extract transactions, then keep both)
• Employee records you add to payroll: name, SIN, address, banking info (if entered)
• Subcontractor records: business name, contact, HST/BN numbers
• Receipts, invoices, and expense entries

Technical information

• Audit log of actions you take in the portal (sign-in, upload, expense added, etc.) for security and compliance
• Server logs from our hosting provider (Vercel) — IP address, request URL, status code — retained 30 days

We follow the 10 fair information principles in Schedule 1 of PIPEDA:

1. Accountability. Our Privacy Officer is responsible for compliance. Reach them at info@businesstaxpro.ca.
2. Identifying Purposes. We collect personal information solely to deliver the bookkeeping and tax-prep features described on our marketing site. We do not sell, rent, or trade your data.
3. Consent. By creating an account, you consent to the collection and use described in this policy. You can withdraw consent at any time by deleting your account in Settings — Privacy.
4. Limiting Collection. We only collect what's needed to run the service. We never ask for documents we don't use (e.g. drivers' licences, birth certificates).
5. Limiting Use, Disclosure, and Retention. Your data is used only for the purposes above. We keep your records for as long as your account is open, so your books stay complete; you can delete any statement, or your whole account, at any time. See section 7.
6. Accuracy. You can edit your profile and corporation details anytime. Categorization mistakes can be fixed in the Transactions page.
7. Safeguards. We use encryption in transit (TLS 1.3), encryption at rest (Supabase managed Postgres on AWS), row-level security on every database table, magic-number file validation on uploads, signed-URL access to receipts, and 60-second TTLs on download URLs. See our security page for details.
8. Openness. This policy and our Terms of Service are linked from every page. Material changes will be announced via email and a notice in your account.
9. Individual Access. You can download all your personal data in JSON format from Settings — Privacy. You can also request a copy by emailing info@businesstaxpro.ca; we'll respond within 30 days as required.
10. Challenging Compliance. If you believe we've mishandled your data, email info@businesstaxpro.ca. If we can't resolve it, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

All personal data is stored with our service providers, who are bound by contractual data-processing agreements:

• Supabase (database + authentication + file storage) — region: Canada Central (Toronto)
• Vercel (web application hosting) — region: Washington DC, USA
• Anthropic (AI that reads statements and receipts and suggests categories) — region: USA; receives the content described in section 5
• Resend (account and service emails, e.g. invites, requests from your bookkeeper, security notices) — region: USA; receives your name, email address and the message content only

Because Vercel hosts the application in the US, your data transits a US-based server when you interact with Business Tax Pro. However, the database where it's stored at rest is in Canada. We've assessed the implications under PIPEDA s. 4.1.3 and concluded the cross-border processing is compatible with the law.

Business Tax Pro uses Anthropic’s Claude AI in three places. Here is exactly what each one receives:

• Reading a bank or credit-card statement. We first try to read your statement with our own reader, which runs on our servers and sends nothing anywhere. If it can’t prove the statement balances, we send the statement’s text to Claude to read the transactions. That text is the statement as printed, so it can include the account holder’s name and address, the account number, balances and every transaction. For a scanned statement, or when the text read still doesn’t balance, we also send the PDF itself (every page as printed) so it can be read a second time.
• Suggesting categories. For transactions our rules and your past choices don’t recognize, we send up to 120 characters of each description as printed (which can include a payee’s name or a reference number), whether it was money in or out, and whether the account is a bank account or a credit card. We don’t send amounts, dates or balances for this step.
• Scanning a receipt. When you attach a photo of a receipt to an expense, we send the image and the names of your expense categories so the form can be filled in for you.

We never send your SIN. Anthropic processes this content under its commercial terms and our data processing agreement: it is not used to train Anthropic’s models, and Anthropic keeps it only for the limited period those terms allow. See Anthropic’s commercial terms.

AI suggestions are checked before they reach your books: categories must come from a fixed list, money in can never be booked as an expense (or the reverse), uncertain suggestions go to your Review list, and statements are checked against the opening and closing balances the bank printed. A statement that doesn’t balance is flagged for review. You (or your bookkeeper) can change any category at any time.

Transfer outside Canada

The content described above is processed on servers in the United States. Anthropic, the provider of the AI model we use, operates in the U.S. While it is being processed, that information is subject to U.S. law, including lawful access requests by U.S. courts, law enforcement and national-security authorities. We remain accountable for it under PIPEDA and require comparable protection by contract, but we cannot exempt it from foreign legal process while it is in that jurisdiction.

Your account, transactions, uploaded files, payroll data and generated reports are stored in a Supabase project hosted in the Canada Central region. Content goes to Anthropic only when one of the three steps above runs.

If you would rather not have your statements or receipts processed this way, don’t upload them — you can log expenses manually (without a photo) or import your QuickBooks exports, which are not sent to AI. Questions about this transfer can go to info@businesstaxpro.ca.

We use one strictly necessary cookie (your Supabase session) so you stay signed in. We do not use analytics, marketing, or third-party tracking cookies on the application portal. The marketing site at businesstaxpro.ca may use anonymous Vercel Analytics for aggregate page-view counts; you can decline this via the cookie banner.

Your books are your business records. The CRA generally requires a business to keep its records for six years after the end of the tax year they relate to (Income Tax Act s. 230; Excise Tax Act s. 286), so we keep them for you rather than deleting them on a timer:

• Transactions, bank statement PDFs, receipts and reports: kept for as long as your account is open. You can delete any statement (with its transactions and files) at any time.
• When you delete your account: your subscription is cancelled, and your account, records and uploaded files are deleted permanently right away — there is no grace period. Download your data from Settings → Privacy first if you still need it for the CRA.
• Audit log: kept for security review for up to 24 months
• Session cookies: Until you sign out or 30 days of inactivity (whichever first)

Business Tax Pro is for Canadian small business owners and accountants. We do not knowingly collect data from anyone under the age of majority in their province. If you believe a minor has provided data, email info@businesstaxpro.ca and we'll delete it.

If we become aware of a privacy breach that creates a real risk of significant harm, we will:

• Notify you by email and in-app banner as soon as practicable
• Notify the Office of the Privacy Commissioner of Canada as required by PIPEDA s. 10.1
• Keep records of the breach for at least 24 months

Material changes will be highlighted at the top of this page and sent to you by email at least 30 days before they take effect. Continued use of Business Tax Pro after that date constitutes acceptance.

For privacy questions or to exercise your rights under PIPEDA:

Privacy Officer
Business Tax Pro
Email: info@businesstaxpro.ca