Privacy Policy

VertAcc Solutions Inc. (“VertAcc,” “we,” “us”) is an Ottawa company that provides bookkeeping, tax, payroll, advisory, incorporation, marketing and related professional services, and builds software. This policy explains how we handle personal information when you:

• visit vertacc.com (the “Site”), including its chat, contact form and Books Health Check;
• contact us, book or attend a consultation, or receive email from us; or
• engage us for professional services (the “Services”).

It does not cover:

• the VertAcc Platform (app.vertacc.com and office.vertacc.com), which has its own Privacy Policy and Terms of Service. Where we do your work inside the Platform, the records involved are governed by those documents;
• municipal services a city offers through VertAcc’s technology, which are governed by that municipality’s own notices; and
• websites and services of others that we link to.

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”) and, where they apply, provincial privacy laws, including Quebec’s Act respecting the protection of personal information in the private sector. If you have signed an engagement letter with us, it governs where it differs from this policy for that engagement.

We use personal information only to:

• respond to you, understand what you need and propose how we can help;
• open, carry out and bill engagements, and keep the records our work requires;
• file and correspond with government agencies, such as the Canada Revenue Agency, on your behalf and at your direction;
• keep the Site secure and prevent fraud and abuse;
• meet our legal, regulatory and professional obligations, and establish or defend legal claims;
• understand, in aggregate, how the Site is used so we can improve it; and
• send you marketing email only where Canada’s Anti-Spam Legislation allows (Section 12).

We do not sell personal information, rent it, or share it for anyone else’s marketing, and there is no advertising tracking on the Site.

• The chat is an AI assistant powered by Google’s Gemini service. What you type is sent to Google, in the United States, to generate each reply, and Google handles it under its own terms.
• We do not keep a copy of your conversation unless you choose to send it to our team. If you do, it arrives in our team’s inbox with the contact details you entered, and we keep it as we keep other inquiries (Section 7).
• The chat gives general information, not professional advice, and it can be wrong (see our Terms). Please do not type confidential financial details, Social Insurance Numbers, account numbers or passwords into it. If you want to share something sensitive, ask for a call instead.

We share personal information only:

• with service providers who run parts of our business for us, under written terms that require them to protect it and use it only for that purpose:
  • Vercel — hosting of the Site;
  • Google — our email and documents (Google Workspace), bot protection on forms (reCAPTCHA), and the Site chat (Gemini);
  • Cloudflare — cookie-free traffic statistics;
  • the software we use to deliver Services, including the VertAcc Platform (governed by its own policy) and any accounting, tax or payroll software an engagement requires;
• with government agencies when we file or correspond on your behalf, at your direction;
• with our own professional advisers — lawyers, accountants, insurers — under duties of confidentiality, where reasonably needed;
• where the law requires it, such as a court order, warrant or a demand from an authority with jurisdiction, or to protect someone’s life, health or security, or to investigate fraud or a security incident;
• in a merger, financing, acquisition or sale of our business, under confidentiality obligations, and afterwards only under protections at least as strong as this policy; and
• otherwise, only with your consent.

We are based in Canada, and some of our service providers process information in the United States and other countries. Information processed outside Canada is subject to the laws of those countries and may be accessible to their courts, law-enforcement and national-security authorities. We remain responsible for information we give a service provider to process for us, and we require it to protect that information to a standard comparable to ours. You can ask us about the safeguards for a particular transfer. Where the records are kept in the VertAcc Platform, the Platform Privacy Policy says where they are stored.

• Inquiries that do not lead to an engagement — as long as reasonably needed to respond, follow up and keep a record of our dealings with you.
• Chat conversations — not kept by us at all unless you send one to our team.
• Engagement records — generally at least six years after the end of the tax year to which they relate, as the Income Tax Act and Excise Tax Act contemplate, and longer where the law, a dispute or a professional obligation requires.

After that, we delete personal information or irreversibly de-identify it.

We protect personal information with administrative, technical and physical safeguards appropriate to its sensitivity, including encryption in transit, access limited to the people who need it for their work, and confidentiality obligations for everyone who works with us. No system is perfectly secure; if you think information you shared with us has been put at risk, tell us right away at info@vertacc.com.

If a breach of our security safeguards involving personal information creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and any other regulator whose law requires it, and notify the people affected, as soon as feasible. We keep a record of every breach of security safeguards for at least 24 months, whether or not it had to be reported.

Subject to the law that applies to you, you may:

• ask for access to the personal information we hold about you, and how it has been used and shared;
• ask us to correct it if it is inaccurate or incomplete;
• withdraw your consent to a use, subject to legal and contractual limits;
• in Quebec, also ask us to stop disseminating your information or to de-index a link to it where the law allows, and be told about any decision made about you solely by automated processing — we do not make any; and
• complain to us, and to the Office of the Privacy Commissioner of Canada or your provincial regulator.

Write to our Privacy Officer at info@vertacc.com with “Privacy” in the subject line, or to the address in Section 16. We respond within 30 days, or tell you within that time if we need longer and why, as the law allows. We may need to confirm your identity first.

• No advertising cookies and no cross-site tracking.
• Traffic statistics come from Cloudflare Web Analytics, which counts visits without cookies and without building a profile of you. We see totals and trends, not individuals.
• Our forms are protected by Google reCAPTCHA, which may set cookies and collect device and usage information to tell people from bots. It is subject to Google’s Privacy Policy and Terms of Service.
• The Site does not respond to “Do Not Track” signals, because it does not track you; your rights in Section 10 apply either way.

We send commercial email only with your express or implied consent, as Canada’s Anti-Spam Legislation permits. Every such message identifies us, gives our contact information and includes a working unsubscribe link, which we honour within 10 business days. Unsubscribing does not stop messages we need to send to carry out an active engagement.

Users of the VertAcc Platform can choose to connect Google services. When they do, the Platform requests only:

• Google Drive — access to the individual files and folders the user selects in Google’s own file picker, and nothing else in their Drive, so those files can be copied into their VertAcc documents;
• Google Calendar — read-only access to events the user owns, so they appear in their VertAcc calendar; the Platform cannot create, change or delete events; and
• the user’s Google account email address, to identify the connection.

VertAcc’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use this information only to provide those features to the user who connected them. We do not use it for advertising, we do not sell it, and we do not use it to develop, improve or train generalized artificial-intelligence or machine-learning models. People at VertAcc do not read it unless the user asks us to, it is needed for security or to comply with law, or it has been aggregated and anonymized for internal operations. A user can disconnect at any time in the Platform, which revokes our access and deletes the stored access token, or from their Google Account’s security settings. The Platform Privacy Policy describes how connected information is stored and protected.

The Site and our Services are for businesses and adults. We do not knowingly collect personal information from anyone under 18 except where a client gives it to us for an engagement — for example, a dependant on a tax return — in which case we protect it as sensitive information.

We update this policy when our practices or the law change, and show the effective date at the top. If we make a material change, we will say so on the Site before it takes effect and, for current clients, tell you by email.

Accessibility: if any part of the Site is hard to use, tell us and we will work with you to fix it.