Privacy Policy

1. Introduction

Your privacy is critical to OPTAXEL, LLC ("we", "us", or "our"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the OPTAX platform.

We are committed to protecting the financial and personal data of Canadian businesses and their owners.

2. Information We Collect

We collect information necessary to prepare tax returns and provide financial insights:

• Account Data: Name, email address, password, and phone number.
• Business Data: Corporation name, Business Number (BN), address, and incorporation details.
• Financial Data: Transaction history, bank statements, expenses, and revenue records.
• Usage Data: Log data, device information, consent records, and interaction with our AI assistant.
• Feedback and Support Data: Feedback messages, ratings, issue category, page path, selected company context, limited metadata, and browser/device signal when you submit product feedback or an assistant issue report.

3. How We Use Your Data

• To format and prepare T2 Corporate Income Tax Returns.
• To calculate GST/HST obligations.
• To categorize transactions using AI algorithms.
• To communicate with you regarding filing deadlines and account updates.
• To triage customer feedback, investigate support issues, maintain status/readback notes, and improve product quality.
• To improve product quality using aggregated operational metrics. We do not use your uploaded tax, banking, document, or chat data to train public AI models.

4. Third-Party Integrations

Plaid (Banking Connections)

We use Plaid Inc. ("Plaid") to connect your bank accounts. By using this integration, you authorize Plaid and us to access and transmit the account and transaction data you choose to share for the company you select in OPTAX. We use this data to import, categorize, reconcile, and prepare tax reports; we do not use Plaid bank data for unrelated marketing or model training. Please review Plaid's Privacy Policy.

OPTAX records a banking consent receipt when you complete Plaid Link, including the consent version, company, institution, selected account scope, timestamp, and privacy-preserving request evidence where available. You can disconnect a bank account in the app; future syncs stop after disconnection or when renewed authorization is required.

AI Service Providers (OpenAI, Google)

We use large language models provided by OpenAI, Google (Gemini), and other partners to process documents and power our chatbot. OPTAX does not use uploaded tax, banking, document, or chat content to train public AI models. Provider retention, training exclusion, regional processing, and zero-retention controls depend on the active provider route, agreements, and account settings at the time of processing.

Stripe (Payment Processing)

We use Stripe, Inc. ("Stripe") to process subscription payments and manage billing. When you make a payment, your payment card information is transmitted directly to Stripe and is never stored on our servers. Stripe may collect and use your payment data in accordance with their privacy policy. Please review Stripe's Privacy Policy.

Google (Analytics & Hosting)

We use Google Cloud Platform for hosting and may use Google Analytics to understand how users interact with our service. Analytics data is aggregated and does not identify individual users.

5. Data Storage & Security

Data Residency: We prioritize storing Canadian tax data within trusted cloud infrastructure regions (e.g., GCP North America).

Security Safeguards: We use secure transport, access controls, and privacy-aware safeguards for sensitive tax and financial information. Bank credentials are never stored on our servers; they are handled securely by Plaid.

6. Data Retention

Our data retention policy varies by subscription tier to balance storage costs with Canada Revenue Agency (CRA) record-keeping requirements:

• Paid Subscribers (Lite, Professional): We retain tax records and related financial records for up to seven (7) years where needed for CRA record-keeping and audit support.
• Customer Feedback and Support Records: Feedback and support inbox records may be retained for up to seven (7) years where they become operational, legal, security, billing, audit, or tax-support evidence. We review these records before deletion because users may include personal, business, or tax information in free-text messages.
• Visitors / Pre-Trial Accounts: Users without an active paid subscription have restricted product access. Any uploaded documents or incomplete setup artifacts may be retained for a limited operational period and then deleted or frozen unless the user purchases a paid plan.

Regardless of your subscription tier, you may request deletion of your account and associated data at any time, subject to legal, tax, billing, security, and audit-retention obligations. Where legal requirements mandate retention (e.g., CRA audit periods), we will retain the minimum data necessary to comply.

7. Canadian Privacy Safeguards

We use PIPEDA's 10 Fair Information Principles as our operating framework:

• Accountability: Our Privacy Officer is responsible for our privacy program.
• Identifying Purposes: We collect data only for tax preparation and financial insights.
• Consent: We obtain meaningful consent before collecting personal information.
• Limiting Collection: We collect only information necessary for our services.
• Limiting Use, Disclosure, and Retention: Your data is used only for stated purposes.
• Accuracy: You can update your information at any time in your account settings.
• Safeguards: We use secure transport, access controls, and internal security reviews.
• Openness: This policy explains all our data practices.
• Individual Access: You can request an export of your personal information by contacting our Privacy Officer, subject to legal, tax, billing, security, and audit-retention limits.
• Challenging Practices: Contact our Privacy Officer with any concerns.

8. Your Rights

Under PIPEDA, you have the right to:

• Access: Request a copy of all personal data we hold about you.
• Correction: Update or correct inaccurate information.
• Deletion: Request deletion of your account and associated data, subject to legal, tax, billing, security, and audit-retention requirements.
• Portability: Request export of your data in a machine-readable format (JSON), subject to the same retention and confidentiality limits.
• Withdraw Consent: Request or manage withdrawal of consent for optional processing, subject to legal, tax, billing, security, provider, and audit-retention obligations.

To exercise these rights, visit your Account Settings or contact privacy@optax.ai.

9. Contact Us

If you have questions about this Privacy Policy, please contact our Privacy Officer:

OPTAXEL, LLC
Email: privacy@optax.ai
Address: 131 Continental Dr, Suite 305, Newark, Delaware 19713