Privacy Policy

1. Who we are and what this policy covers

VertAcc Solutions Inc. ("VertAcc", "we", "us") operates the VertAcc Platform: the accounting, payroll, legal-practice and document software at app.vertacc.com, the document editors at office.vertacc.com, and the related client portals, secure links, upload pages, signing pages, shared folders, collaboration spaces, forms and surveys, mobile and installed versions, and email we send in connection with them (together, the "Platform").

This policy explains what personal information the Platform handles, why, who can see it, where it is processed, how long it is kept, and the choices and rights you have. It applies to everyone whose information the Platform handles: account holders and their team members, VertAcc personnel, and people who never sign in at all — someone who signs a document, uploads a file through a link, receives an invoice, or answers a survey.

It does not cover:

• the vertacc.com marketing website, which has its own privacy policy;
• VertAcc Gov municipal services, which are provided on behalf of the municipality concerned and are described in section 17; or
• a business's own website, privacy practices or communications, even where they are hosted on or sent through the Platform (section 18).

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA") and, where they apply, provincial privacy laws — including Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and the Personal Information Protection Acts of Alberta and British Columbia — and, for customers outside Canada, the privacy law of the customer's own country to the extent it applies to us, including Guyana's Data Protection Act 2023 to the extent it is in force.

2. Two different roles — and why it matters

Privacy law asks who is accountable for a piece of personal information. On the Platform the answer depends on whose information it is.

(a) Where VertAcc is accountable. For information about the people who hold a VertAcc account or work with us — your name, work email, role, sign-in and security records, support conversations, feedback, and billing details — and for information we collect to run, secure and improve the Platform, VertAcc is the accountable organization.

(b) Where our customer is accountable and we act on its behalf. A business that subscribes to the Platform (a "Customer") puts information about other people into it: its employees (payroll records, Social Insurance Numbers, T4s, HR records), its customers, suppliers and contacts (names, addresses, invoices, correspondence), and — for a law firm — its own clients and the other people in their matters, including information protected by solicitor-client privilege. For that information (together with the Customer's own business records, "Customer Data"), the Customer is the organization accountable for it, and VertAcc processes it on the Customer's behalf and on its instructions.

In practice that means the Customer decides why that information is collected and is responsible for having the right to give it to us and for telling the people concerned what it needs to tell them. We are responsible for protecting it, using it only to provide the Platform and services to the Customer, and returning or deleting it as the Customer directs. If you are an individual whose information a Customer holds on the Platform — an employee, a client of a law firm, a customer of a business — please direct questions and requests to that business first. We will help it respond.

Canadian privacy law does not divide responsibility into a European-style "controller" and "processor". Both a Customer and VertAcc can owe duties in respect of the same information at the same time, and nothing in this policy or in any agreement reduces the protection a statute gives you.

3. What the Platform collects

3.1 Account and identity information

Name, work email address, role and permissions, the business you belong to, password (stored only as a one-way cryptographic hash — no one at VertAcc can read it), two-step sign-in settings and backup codes (stored hashed), interface preferences, and notification preferences.

3.2 Business and financial records

Chart of accounts, journal entries, bank and credit-card transactions, reconciliations, invoices, estimates, bills, expenses, credit notes, payments, recurring transactions, sales-tax registrations and filings, CRA authorization status, opening balances, budgets, reports, trust-account ledgers, and the documents placed in your Drive.

3.3 Sensitive identifiers

Where the services require them: employees' Social Insurance Numbers, bank account and transit numbers, and business and CRA program account numbers. These are encrypted at the application layer before they are stored, are excluded from ordinary record retrieval, and are decrypted only where a specific task needs them — for example to produce a statutory slip or a payment file.

3.4 Payroll and HR information

Employee names, contact details, addresses, dates of birth, Social Insurance Numbers, pay rates, hours, earnings, deductions, TD1 claim amounts, year-to-date totals, pay stubs, T4 and Record of Employment details, planned changes, onboarding and policy forms an employee completes, and workplace incident and complaint records a Customer chooses to keep. Incident and complaint records can contain information about a person's health or conduct, and we treat them as sensitive.

3.5 Legal-practice information (law-firm Customers)

Matters, parties and their roles, opposing counsel, key dates, tasks, conflict-check searches and results, time entries, rates, disbursements, trust transactions and requisitions, court forms, precedents, and the documents of a matter. This information is frequently protected by solicitor-client privilege, and in family-law matters it routinely includes information about children, finances, property and family circumstances. We treat all of it as highly sensitive. Our access to it is never a waiver of privilege, and we access it only as set out in section 6.

3.6 Documents and email

Files you upload, sync, create in the VertAcc Office editors, or receive; earlier versions of edited documents; and email sent to the VertAcc email address assigned to your business (mail.vertacc.com), including its attachments. Documents and email may contain any kind of information, including information about third parties, so we protect them as Customer Data whatever they contain.

3.7 AI interactions

The questions you ask the Platform's AI assistants, the records and documents they read to answer, their answers, actions they propose, your approvals and declines, ratings and feedback you give, and short facts the assistant saves about your business so it does not have to ask again (which you can view, change and delete). See section 5.

3.8 Electronic signatures

For each signing request: the document, the signers' names and email addresses, the order of signing, each signer's signature (typed or drawn), the time of each step (sent, opened, viewed, signed, declined), the IP address and browser used, and the signer's consent to sign electronically. This evidence is kept with the signed document and its certificate so the signature can be proved later.

3.9 People you share with, and people who answer you

When a Customer sends someone a secure link — to upload documents, view or sign a document, collaborate on a file, open a shared folder, pay an invoice, accept an estimate, complete an intake or HR form, or answer a survey — we collect what that person enters or uploads, the time and the IP address and browser used, and their email address and name where the Customer supplied them or the person typed them in. We process this information on the Customer's behalf (section 2(b)), except for security records, which we keep for our own protection of the Platform.

3.10 Forms and surveys (Analytics)

Answers to forms and surveys run through the Platform (which can include contact details and, where a form asks for them, identification numbers — answers to fields marked sensitive are encrypted before they are stored), files respondents upload, and — only if the respondent chooses to share it, by pressing a button or placing a pin on a map — a location. A respondent's browser asks their permission before any device location is shared. Public forms are protected by a bot check (section 13).

3.11 Connected accounts (only if you connect them)

• Google Drive — only the files you select; we request Google's narrowest file permission, which does not give us your whole Drive.
• Microsoft OneDrive and Dropbox — read access to the folders you choose, so their files can be copied into your Drive.
• Google Calendar and Microsoft Outlook calendar — read-only access to events, so they appear in your VertAcc calendar.
• LEAP (law-firm practice software) — if a firm authorizes it, the LEAP sign-in name and password it gives us, used only to sign in to LEAP on the firm's behalf and retrieve the reports the firm has chosen (section 6.3).
• Stripe — if a Customer connects a Stripe account to accept payments, the account's identifiers and the status of payments made through it.

For each connection we store an access token (encrypted) and the identifiers of what you selected. We never alter or delete anything in a connected account, and you can disconnect at any time.

3.12 Support, feedback and communications

Messages to our team, support chats (including with the Platform's support assistant), feedback and bug reports, and the account and business details attached so we can follow up.

3.13 Usage, device and security information

IP address, browser and device type, sign-in times, session activity used to sign you out after inactivity, availability status shown to your team in Messages, the pages and features used, error and performance records, security events, and an audit log of significant actions — who did what, and when.

3.14 Payment information

Subscription payments to VertAcc, and payments a Customer's own clients make through the Platform, are processed by Stripe. Card numbers are entered on Stripe's systems and never reach or are stored by VertAcc. We receive the payment's status, amount, date, the last four digits and brand of the card, and the payer's name and email.

What we do not do. We do not collect biometric information, and we do not track your activity on other websites. There is no advertising, no advertising cookie and no third-party advertising tracker in the Platform.

4. How we use information

We use personal information only to:

• provide, operate, maintain and support the Platform and the services in a Customer's agreement;
• carry out the bookkeeping, payroll, tax, filing, document, legal-practice and reporting work the Platform or our team does for a Customer, on its instructions;
• power the AI features described in section 5;
• authenticate users, enforce permissions, keep the audit log, and detect, prevent and investigate security incidents, fraud, abuse and misuse;
• send the email and notifications the Platform exists to send — invitations, documents, invoices, reminders, deadlines, security messages (section 14);
• process payments, bill Customers, collect amounts owing and keep our own accounting records;
• improve the Platform, using feedback people give us and de-identified or aggregated information from which no Customer or individual can reasonably be identified;
• comply with law, respond to lawful requests, and establish, exercise or defend legal claims; and
• for any other purpose you consent to, or that is required or permitted by law.

We do not sell personal information. We do not rent it, trade it, or disclose it for anyone else's marketing. We do not use Customer Data to advertise to anyone. We do not use Customer Data to train artificial-intelligence models, and we do not allow our AI providers to (section 5.3).

If we want to use personal information for a new purpose that a reasonable person would not expect from this policy, we will ask for consent first unless the law permits otherwise.

5. Artificial intelligence — stated plainly

5.1 What it does. The Platform uses AI to answer questions about your records, categorize transactions, read and index documents, extract figures from statements and receipts, draft correspondence and documents, prepare charts and reports, help with support questions, and — for VertAcc staff — assist our team with work on Customer accounts.

5.2 Some of it runs automatically. When a document is added to a Drive — uploaded, synced, emailed in, or created — the Platform automatically reads it with AI to index it, summarize it and recognize what kind of document it is. Email arriving at a business's VertAcc address can be read the same way. This is how documents become searchable and usable without anyone having to ask.

5.3 Who processes it, and where. To do this, the relevant parts of your records and documents are sent to an AI provider for processing and the result is returned to the Platform. Our providers are listed in section 7:

• Anthropic PBC (United States) provides the AI for every Customer-facing feature — the assistant, document reading, extraction, drafting and support. It processes this information to return a response to us. Under our agreement with it, it may not use it to train its models, may not use it for its own purposes, and may retain it only for a limited period for security, abuse-monitoring and legal-compliance purposes.
• Internal VertAcc tools that help our team operate and monitor the Platform may use other AI service providers, which can process information outside Canada. These tools receive what the task in hand needs — mainly records about the operation of the Platform, and Customer Data only where our personnel use them to work on a Customer's account.

We will not begin using a new AI provider for a Customer-facing feature without updating this policy and giving notice under section 7.

5.4 The AI proposes; a person decides. The AI does not, on its own authority, move money, post or materially change entries in your books, file anything with a government, or send a message to someone outside your business. Actions of that kind are held for an explicit confirmation by an authorized person. No decision that produces a legal or similarly significant effect on an individual is made solely by automated processing.

5.5 Accuracy. AI output can be wrong, incomplete or out of date. It is a starting point for a person's review, not professional advice, and it must be checked before anyone relies on it — especially before it is used in a filing, a financial statement, legal work, or a communication to someone else.

5.6 Social Insurance Numbers and the AI. The structured payroll fields that hold employees' Social Insurance Numbers are never sent to an AI provider; they are encrypted and excluded from what the AI can read. A document may itself contain a SIN — a T4, a Record of Employment, a TD1 or a payroll register. If such a document is placed in a Drive, its contents are processed as described in 5.2 and 5.3, including anything printed on it. Subsection 237(2) of the Income Tax Act restricts the use and communication of a SIN to the purposes for which it was provided, and we use such documents only to provide the payroll, tax and filing services for which they were given to us. Customers should place SIN-bearing documents on the Platform only where that is needed for that work.

5.7 What to keep out of the AI. Please do not give the AI information it does not need for the task — in particular personal information about people unconnected to your business records, health information beyond what a task requires, and passwords or payment card numbers.

6. Who can see information

6.1 You and the people you authorize. Access follows the roles and permissions a Customer configures. Each Customer's data is isolated from every other Customer's at the database level.

6.2 VertAcc personnel. A limited number of VertAcc personnel can access Customer accounts to provide the services a Customer has engaged us for, to give support, and to secure and maintain the Platform. Staff access is:

• role-based and least-privilege — granted for a purpose, not by default;
• visible and recorded — when a staff member works inside a Customer's account the Platform shows it, and significant actions are recorded in the audit log against the named individual;
• removed immediately when a person leaves or no longer needs it; and
• subject to written confidentiality obligations.

We do not look at Customer Data out of curiosity, and we do not access privileged legal information except where necessary to provide or support the services, to secure the Platform, or where the Customer asks us to.

6.3 Service providers. We use the providers listed in section 7. Each processes information only to provide its service to us, under written terms that require protection comparable to ours. LEAP: where a law firm authorizes it, the Platform signs in to the firm's LEAP account with the credentials the firm provided — decrypting them only for the duration of one retrieval, inside a temporary, isolated computing environment that is destroyed afterwards — and retrieves only the reports the firm has chosen.

6.4 People a user chooses to share with. When a user sends a document, invoice, signing request, folder, upload link, form or collaboration invitation, the recipient sees what was shared with them. Shared links can be withdrawn by the sender.

6.5 Legal requirements and protection. We may disclose information where required by law, a court order, a warrant or another lawful demand from an authority with jurisdiction; where necessary to establish, exercise or defend legal claims; to investigate or prevent fraud, security incidents or a threat to someone's life, health or security; or as otherwise required or permitted by law. If we receive a demand from a government or law-enforcement authority for Customer Data, we will — unless the law prohibits it — notify the Customer so it can seek to protect the information, require the demand to be lawful and properly issued, disclose only what is legally required, and assert any privilege we are entitled or instructed to assert.

6.6 Business transactions. If VertAcc is involved in a merger, financing, acquisition, reorganization or sale of all or part of its business, information may be disclosed to the parties to the transaction under confidentiality obligations and used only for that transaction, and after completion it will remain protected by commitments at least as protective as this policy.

6.7 With consent. Otherwise, only with the consent of the person concerned or, for Customer Data, on the Customer's instructions.

7. Service providers, and where information is processed

Your books, documents and records are stored in Canada. The Platform's database, authentication service and file storage are hosted by Supabase in its Canada (Central) region, in Montréal, and the application's servers run in Vercel's Montréal region. Some processing takes place outside Canada:

Exchange-rate and news services used by the Platform receive no personal information.

What processing outside Canada means. Information processed in another country is subject to that country's laws and may be accessible to its courts, law-enforcement and national-security authorities, which no contract can prevent. Under PIPEDA, giving information to a service provider for processing is a use of it, not a disclosure, and we remain responsible for it: we require each provider by contract to protect it to a standard comparable to ours and to use it only to provide its service. We tell you about these transfers so that you can understand them and ask us about them.

Records you must keep in Canada. Subsection 230(1) of the Income Tax Act and subsection 286(1) of the Excise Tax Act generally require businesses to keep their books and records in Canada. The records on the Platform are stored in Canada. If you need written confirmation of where your records are stored, ask us.

Changes to this list. We will update this section before a new provider begins processing Customer Data. Where a Customer has a signed agreement with VertAcc, we will give it the notice that agreement requires — at least 30 days — except where a change is urgently needed for security or to keep the Platform running, in which case we will give notice as soon as practicable.

8. How long information is kept

We keep personal information only as long as it is needed for the purpose for which it was collected, or as long as the law requires, and then delete it or irreversibly de-identify it.

Canadian privacy law does not create a general "right to be forgotten", and some information must be kept by law. Where we cannot delete something, we will tell you why.

9. When an account closes — getting your data back

When a Customer's subscription ends, for any reason:

1. Customer Data remains available for export for 90 days, and on request during that period we provide a complete export in a commonly used format at no charge.
2. This applies whatever amount may be owing. We never hold a Customer's records as security for fees.
3. After that period we delete Customer Data, or irreversibly de-identify it, within a further 90 days — except information we are required by law to keep, the audit log, and copies in encrypted backups, which expire on their ordinary schedule.

During a subscription, a Customer can download its books at any time from Settings → Your data, and its documents from its Drive.

10. How we protect information

We protect personal information with safeguards appropriate to its sensitivity, including: encryption in transit (TLS) and at rest; isolation between Customers enforced in the database by row-level security; application-layer encryption of Social Insurance Numbers, bank details and stored credentials; two-step sign-in, available to every user; automatic sign-out after inactivity; least-privilege, recorded staff access; an audit log; a strict content-security policy and hardened security headers; daily encrypted backups whose restoration we test; bot protection on sign-in and public forms; and regular security review of the Platform and the software it depends on.

No system is perfectly secure. You help protect your information by using a strong, unique password, turning on two-step sign-in, keeping your devices secure, and telling us immediately at info@vertacc.com if you suspect your account has been compromised.

11. If something goes wrong

If a breach of our security safeguards involving personal information creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada, and to any other regulator whose law requires it (including Quebec's Commission d'accès à l'information for a "confidentiality incident"), and notify the affected individuals, as soon as feasible. Where the information is Customer Data, we will notify the Customer without unreasonable delay and give it the information it reasonably needs to assess the incident and make any notification of its own. We keep a record of every breach of security safeguards for at least 24 months, whether or not it had to be reported.

12. Your rights and choices

Subject to the law that applies to you, you may:

• access the personal information we hold about you and learn how it has been used and to whom it has been disclosed;
• correct it if it is inaccurate or incomplete;
• withdraw consent to a use, subject to legal and contractual limits — withdrawing consent to something essential to the Platform may mean we can no longer provide it;
• receive information you provided in a structured, commonly used technology format (a right under Quebec law that we extend to everyone);
• ask how a decision was reached where AI was involved, and have a person review it;
• ask about our safeguards, including for a particular transfer outside Canada; and
• complain, and have your complaint investigated.

Much of this you can do yourself: export your books in Settings → Your data, review and delete the assistant's saved facts, review the audit log, and manage users and notifications.

To make a request, email info@vertacc.com with "Privacy" in the subject line, or write to the Privacy Officer at the address in section 20. We respond within 30 days, or tell you within that time if we need longer and why, as the law allows. We may need to verify your identity before acting. If a request concerns Customer Data — for example, information an employer or a law firm holds about you — we will refer it to that Customer, which is accountable for it, and help it respond.

If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376), or to the privacy regulator of your province or country.

13. Cookies and similar technologies

The Platform uses only the cookies and browser storage it needs to work and to remember your choices:

• sign-in and security cookies that keep you signed in, protect against forged requests, sign you out after inactivity, and remember a device you trusted for two-step sign-in;
• working cookies that remember which business you are working in and how the screen is laid out; and
• preference storage in your browser for settings such as light or dark appearance and table layouts.

There are no advertising cookies, no cross-site tracking and no third-party analytics trackers in the Platform.

Some pages use third-party services that may set their own cookies or receive your IP address when they load: Cloudflare Turnstile on sign-in and account pages and Google reCAPTCHA on public forms (to tell people from bots), map tiles on pages that show a map, and embedded videos in privacy-enhanced mode when you play them. reCAPTCHA is subject to Google's Privacy Policy and Terms of Service. If you turn on device notifications, your browser's push service delivers them. Blocking essential cookies will prevent you from signing in.

14. Email we send

Platform email is transactional or service-related: invitations, sign-in and security messages, documents, invoices, estimates, signing requests, reminders, deadlines and notifications. Email a Customer sends to its own clients through the Platform is sent on that Customer's behalf and in its name, and the Customer is responsible for its content and for complying with anti-spam law when it sends a commercial message. Where VertAcc itself sends a commercial electronic message, it will comply with Canada's Anti-Spam Legislation: it will identify us, give our contact information, and include a working unsubscribe mechanism that we give effect to within 10 business days. You can choose which notification emails you receive in Settings → Notifications; security and account messages cannot be turned off.

15. Information from Google

The Platform's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: we use information from Google Drive and Google Calendar only to provide the features you connected them for — copying the files you select into your Drive and showing your calendar events — and the user-facing features built on them, such as letting the assistant read a file you asked about. We do not use that information for advertising, we do not sell it, and we do not use information received from Google Workspace APIs to develop, improve or train generalized or non-personalized artificial-intelligence or machine-learning models, and we do not allow our AI providers to. People at VertAcc do not read it unless you ask us to (for example for support), it is necessary for security or legal compliance, or it has been aggregated and anonymized for internal operations. You can disconnect Google at any time from the Platform or from your Google account's security settings.

16. Children and young people

The Platform is a business tool. Accounts are for people 18 or older, and we do not knowingly collect personal information from anyone under 18 to create an account. Customer Data may nonetheless contain information about minors — for example dependants on a payroll record, or children in a family-law matter. That information is entered by the Customer, which is accountable for it, and we protect it as sensitive information.

17. VertAcc Gov (municipal services)

Some municipalities use VertAcc Gov, a separate part of the Platform, to offer services to residents and businesses. For those services the municipality is the organization accountable for residents' information, its own notices and policies govern how that information is collected and used, and VertAcc provides the technology on the municipality's behalf and on its instructions. This policy's sections on security (10), breaches (11) and our service providers (7) also describe how we protect that information.

18. Businesses' own websites and communications

A Customer may use the Platform to publish its own website, send its own email, request documents, collect payments, run its own forms, or send documents for signature. That Customer is responsible for its own privacy practices and for what it collects through those tools, and its own privacy policy governs them. We process that information on its behalf as described in section 2(b).

19. Changes to this policy

We review this policy regularly and update it as the Platform and the law change. Each version is numbered and dated, and earlier versions remain available on this page. If we make a material change, we will tell you before it takes effect — by a notice in the Platform, by email, or both — and, where the law requires, ask for your consent. A material change takes effect no sooner than 30 days after we give notice, unless it is required sooner by law or is needed to protect people or the Platform. Where a Customer has a signed agreement with VertAcc and this policy conflicts with it, that agreement governs for its term.

20. Contact

Privacy Officer — VertAcc Solutions Inc.
info@vertacc.com (subject: "Privacy") · +1 (613) 908-5199
1 Rideau Street, Suite 700, Ottawa, Ontario K1N 8S7, Canada

If anything in this policy is unclear, tell us. That is a fault in the policy, not in the reader.