Privacy Policy

1. Scope and responsibility

This Privacy Policy explains how TaxDesk ("we", "us" and "our") handles personal information through our website, public resources, application and support. It covers account holders, website visitors and people whose information is included in a workspace. Personal information means information about an identifiable individual; business documents can contain personal information even when they concern a corporation.

For account administration, billing, security and website operations, we determine how personal information is used. For records uploaded by a business or advisor, we process information to provide the workspace service. The workspace customer remains responsible for its authority to collect, upload and share those records and for its own privacy obligations. This does not remove our responsibilities under applicable privacy law.

2. Information we collect

Account and workspace information includes names, email addresses, authentication identifiers, organization membership, roles and preferences. Billing information includes subscription status, billing contact details and payment transaction references; payment details are processed by Stripe.

Workspace content includes business numbers, company details, ownership records, filing history, financial information, uploaded documents, extracted data, questions and AI-assisted responses. Documents may contain sensitive personal information about owners, employees, clients or other people. Upload only information you are authorized to provide and that is necessary for your work. Do not upload CRA passwords or other account secrets.

When you contact us or request access, we collect the information you provide, such as your email, business details and message. Technical and usage information may include IP addresses, browser and device details, visited pages, timestamps, feature interactions, diagnostics and security or audit events. We receive some information from authentication, payment and other service providers.

3. Why we use information

We use information to authenticate users; manage workspaces and permissions; organize records and deadlines; process documents; answer workspace questions; operate authorized integrations; administer subscriptions; provide support; send service notices; investigate abuse; and maintain and improve service reliability.

We also use website and product usage information to understand which resources and features are useful. Product updates or marketing emails, where sent, are subject to applicable consent requirements and provide a way to unsubscribe. Essential account, billing, security and service messages may still be sent.

We do not sell or rent personal information. We do not use this policy as permission to use confidential workspace documents for unrelated advertising.

4. Consent and your choices

We obtain consent where required and rely on exceptions only where applicable law permits them. The form of consent depends on the information, purpose and sensitivity. Uploading another person’s information requires appropriate authority; accepting these terms does not establish that authority for you.

You can withdraw consent for optional uses, unsubscribe from marketing, manage browser cookies, or disconnect an assistant. Withdrawal does not undo processing already lawfully completed, and some processing is necessary to provide an account or feature. Contact us to discuss the consequences of withdrawing consent. This policy is a notice of our practices, not a substitute for consent where separate consent is required.

5. Who can see workspace information

Information is available to people granted access to the workspace according to their permissions. Workspace administrators manage membership and access; a workspace may be controlled by your employer, business or advisor. Ask the administrator about its practices before putting personal information in a shared workspace.

Authorized service providers process information needed to perform their functions. Support or security work may require access to relevant records. We may disclose information where legally required or permitted, to address fraud or security incidents, or to establish, exercise or defend legal rights. A merger, acquisition or transfer of our business may involve information subject to applicable safeguards, legal requirements and notices.

6. Service providers and processing locations

Our service providers include Cloudflare for application hosting, document storage, security and AI infrastructure; Neon for databases; Clerk for authentication; Stripe for payments; Loops for email; PostHog for product analytics; and Google Analytics, Vercel Analytics and Vercel Speed Insights for website analytics and performance. The public website is hosted on Vercel.

AI processing can involve Cloudflare AI services and AI Gateway, OpenRouter, Google AI and underlying model providers. A gateway or routing service can pass requests to another provider, so it is not necessarily the only recipient. The provider and model used depend on the feature and service configuration. Contact us for information about the processing relevant to a particular feature before submitting sensitive content.

Providers may process or store information outside Canada, including in the United States and other countries. Information processed abroad may be accessible to courts, law enforcement or government authorities under local laws. We remain responsible for information transferred for processing and use contractual and other appropriate safeguards; Canadian-only storage is not promised.

7. AI features and connected assistants

AI features may send document content, extracted text, relevant workspace records, questions and context to processing providers to classify documents, extract information, research or generate responses. Outputs can be inaccurate or incomplete and require human review. Avoid submitting information that is unnecessary for the task.

Provider retention and use of inputs depend on the provider, model, contract and configuration. This policy does not promise that all AI requests have zero retention or that every model provider excludes all inputs from training. Ask us about the applicable arrangements if these restrictions are a requirement for your organization.

Connecting an external assistant, such as Claude or another MCP-compatible client, authorizes access within the permissions you grant. Relevant records or document content can leave TaxDesk and enter that provider’s systems. The assistant provider’s terms and privacy policy govern its handling of that information. Review its settings and your authority to disclose data before connecting.

Revoking a connection prevents future authorized access through that connection but does not recall data already shared or remove copies held by the assistant. Request deletion from that provider separately where necessary. Actions affecting workspace records must be reviewed and authorized through the applicable workflow.

8. Cookies and website analytics

Cookies, local storage and similar technologies support authentication, preferences, security and analytics. The public website uses Google Analytics and, when configured, PostHog, as well as Vercel analytics and performance tools. These tools receive browsing, device and interaction information.

Our website PostHog configuration disables automatic interaction capture and session recording and removes query strings from page URLs sent to PostHog. These controls do not describe every analytics provider’s collection. Browser cookie restrictions and privacy tools can limit some collection, but may also affect sign-in or preferences. Contact us about analytics choices or to withdraw consent for optional processing.

9. Security and incidents

We use technical and organizational safeguards appropriate to the sensitivity of the information, including encrypted connections, access controls and workspace permissions. No service, network or storage system can be guaranteed completely secure. Protect your credentials, review workspace membership and notify us promptly if you suspect unauthorized access.

If a security incident affects personal information, we investigate and take appropriate containment and remediation steps. We notify affected individuals, customers and regulators, and maintain incident records, where required by applicable law. Do not send passwords or sensitive documents in an initial incident report.

10. Retention, cancellation and deletion

We retain personal information only as needed for the purposes described here and applicable legal requirements. Workspace records are kept to provide the service while the workspace is maintained. Cancelling a paid subscription, leaving a workspace and deleting an account are different actions; cancellation alone does not request deletion of all workspace data.

Contact us to request an export, account closure or deletion and to confirm the scope and expected timing. Shared workspace records may belong to or be controlled by the workspace customer. We verify authority before deleting records that affect other users and assess personal-information requests under applicable law.

Some information may need to be retained for billing, legal obligations, fraud prevention, disputes or security. Deleted information may remain in backups or provider systems until their retention cycles expire. We will explain applicable exceptions and available timing when handling a request. Do not rely on TaxDesk as your only copy of records you must keep for tax or legal purposes.

11. Access, corrections and complaints

Subject to applicable law, you may request access to personal information we hold about you, information about its use and disclosure, corrections, withdrawal of consent, or deletion. Deletion is subject to legal and other permitted retention requirements; it is not an unconditional right to erase every business record.

Email hello@taxdesk.ca with “Privacy request” in the subject. We may verify your identity and authority using information proportionate to the request. Do not include sensitive identity documents unless we arrange a secure way to receive them. We respond within the period required by applicable law; under PIPEDA, access requests generally require a response within 30 days, subject to permitted extensions. We explain a refusal or extension where required.

If you have a concern, contact us so we can investigate. You may also complain to the Office of the Privacy Commissioner of Canada or the provincial privacy regulator with jurisdiction. Your rights are not limited by this policy.

12. Policy changes and contact

We may update this policy as our service or legal obligations change. We identify the revision date and provide appropriate notice of material changes. Where a new purpose or disclosure requires additional consent, we obtain it before relying on that change; continued use alone does not replace legally required consent.

For questions, privacy requests or complaints, contact our privacy contact at hello@taxdesk.ca. The service is designed for business users and is not directed at children.