What we hold, why we hold it, and what you can do about it.

1Who is responsible for your information

The organization responsible for your information is Bolrach Technologies Limited, a corporation incorporated under the Canada Business Corporations Act, corporation number 1609556-9, with its registered office in Edmonton, Alberta, Canada.

Our Privacy Officer is the person in charge of protecting your personal information. Write to privacy@taxpio.com, or raise a request through the TaxPio support desk from your account or the Support page. Either way the request is recorded and tracked until it is closed.

2What we collect

We collect the following categories of personal information.

• Identity information you give at registration: first, middle and last name, email address, sex, and date of birth. Name parts, sex and date of birth are collected because tax filings and identity verification require them.
• Account and security information: password hash, passkey credentials, recovery codes, sessions, sign-in events, and the security events raised by sensitive actions.
• Tax profile information: the country, entity type, business identifiers such as a business number, addresses, officers, shareholders and their government identifiers where a schedule requires them.
• Financial records you enter or import: transactions, bank and card statements, receipts, ledger accounts, classifications, and the figures used to prepare a return.
• Documents you upload, together with their content hashes and processing state.
• Technical information created by using the service: IP address, approximate region derived from it, browser and device characteristics, and request logs.
• Support and correspondence: the content of tickets you raise and our replies.

3Sensitive identifiers

Some schedules require government identifiers, such as a shareholder's social insurance number. Where TaxPio stores such an identifier it is encrypted at rest with a key that is separate from the database, bound cryptographically to the record it belongs to, and rendered in the interface only as its last four characters.

We do not ask for identity documents, and we do not perform document-based identity verification inside TaxPio.

4Why we use it, and on what basis

We use your information for the purposes below. Where the UK or EU General Data Protection Regulation applies, the legal basis is given in brackets. Where Canadian federal or provincial privacy law applies, the basis is your knowledge and consent, or an exception that the statute expressly permits.

• Providing the service you asked for: preparing returns, keeping records, and running your workspace (performance of a contract).
• Keeping accounts and records secure: authentication, fraud and abuse prevention, rate limiting, malware scanning of uploads, and audit trails (legitimate interests, and legal obligation where security incidents must be reported).
• Supporting you when you raise a request (performance of a contract).
• Meeting our own legal, tax, accounting and record-retention obligations (legal obligation).
• Improving reliability and correctness using aggregated, non-identifying operational metrics (legitimate interests).

5What we do not do

We do not sell personal information. We do not share it with advertising networks or data brokers, and TaxPio carries no third-party advertising or third-party analytics trackers.

We do not use your financial records to train machine-learning models. When AI suggestions are switched on, only the text recognised from a receipt or invoice is sent to our AI model provider, whose terms forbid training on it. AI may keep that text for up to 30 days to detect abuse, and then it is deleted. The image or file itself never leaves TaxPio, and nothing a model proposes takes effect until a person reviews and confirms it. Every confirmed classification is recorded against the person who reviewed it.

6Who we share it with

We share personal information only with the following recipients, and only to the extent needed.

• People you invite into your own tax profile, at the access level you assign them.
• Our identity provider, which authenticates sign-in and holds your credentials and passkeys.
• Our transactional email provider, to deliver account, security and support messages.
• Our AI model provider reads only the recognised text of a document you upload and sends back field suggestions for your review. How long that text is kept is set out under international transfers below.
• Our bank-data provider, Plaid, only when you choose to connect an account: you sign in inside the provider's own window, TaxPio never sees the credentials, and the provider returns the accounts, balances and transactions you authorised until you revoke that consent here.
• Our infrastructure and encrypted-backup providers, which store data at rest on our behalf and cannot read the encrypted backup set.
• Professional advisers, and law-enforcement or tax authorities, where we are legally required to disclose or where disclosure is necessary to establish or defend a legal claim.
• An acquirer, if the business is sold, subject to the acquirer honouring this notice.

7Where it is held, and international transfers

TaxPio's application and database servers are in Canada. Uploaded documents and the encrypted database backups are stored with Cloudflare R2 in its Eastern North America region, which can place them in the United States.

Three providers process information outside Canada. Cloudflare runs the network that serves the site and the storage described above. Our AI model provider, in the United States, receives only the recognised text of a document you choose to process. It does not train on that text, and AI may keep it for up to 30 days to detect abuse before it is deleted. Plaid, in the United States, is involved only when you connect a bank account.

Information held in another country falls under that country's laws, and its courts, police and national security agencies may be able to obtain it there. Our contracts with these providers require protection comparable to what this notice describes.

Where information leaves the UK or the EEA we rely on the UK International Data Transfer Addendum or the European Commission's standard contractual clauses, together with the technical measures described in this notice.

8How long we keep it

Retention is driven by tax and audit obligations, which are longer than most people expect.

• Tax records, prepared returns and their supporting documents: retained while your account is open and then for the period the relevant tax authority requires. In Canada that is six years from the end of the tax year the records relate to.
• Audit trail entries: retained for the same period as the records they describe, and never rewritten. The trail is append-only by database constraint.
• Account and security events: retained for two years.
• Encrypted database snapshots: retained on a rolling thirty-day window and then destroyed automatically.
• Support correspondence: retained for two years after the ticket is closed.
• Anything under a legal hold: retained until the hold is lifted, regardless of any deletion request, and you are told that a hold applies.

9Your rights

Subject to the retention rules above, you can exercise the following rights from inside your account or through the support desk. We respond within thirty days, and we tell you if we need to refuse a request and why.

• Access a copy of the personal information we hold about you, in a portable format.
• Correct information that is inaccurate or incomplete. Corrections to records already used in a prepared return are recorded as annotations rather than silent overwrites, so the history stays truthful.
• Delete your account and the information we are not required to retain.
• Withdraw an optional consent, without affecting processing that already happened.
• Object to, or ask us to restrict, processing based on legitimate interests.
• Complain to a supervisory authority: the Office of the Privacy Commissioner of Canada; in Quebec, the Commission d'accès à l'information; in Alberta or British Columbia, that province's Information and Privacy Commissioner. If you live outside Canada, your own data protection authority can also hear a complaint.

10How we protect it

Every tenant's records are isolated at the database level by forced row-level security, not merely by application logic. Sensitive identifiers are encrypted with per-record initialisation vectors and authenticated encryption. Sensitive actions require a second factor.

Backups are encrypted before they leave the host, stored with an immutability window that defeats ransomware deletion, and restored on a schedule to prove they work rather than assuming they do.

No system is perfectly secure. If a breach affects your personal information and is likely to create a real risk of significant harm, we will notify you and the relevant regulator as the applicable law requires.

11Cookies

TaxPio sets only the cookies needed to keep you signed in, to protect against cross-site request forgery, and to remember interface preferences. There are no advertising or cross-site tracking cookies. The Cookie Policy lists each one.

12Children

TaxPio is not intended for anyone under 18 and we do not knowingly collect information from children. If you believe a child has created an account, tell us through the support desk and we will remove it.

13Changes to this notice

We will post any change here with a new effective date, and we will email you before a material change takes effect. Superseded versions remain available on request.