Privacy Policy

What we collect

From you: your name, email address and mobile number; your corporation's legal name, business number, address, tax year and business activity; the names and shareholdings of its shareholders; and the name and position of its signing officer.

Documents you upload: articles of incorporation, bank statements, prior-year returns and anything else you attach.

From your use of the service: which filing you are working on, when you paid, when you signed, and the messages you send us.

We do not collect card details. Payment is handled by Stripe and your card number never reaches our servers.

Why we collect it

To prepare and file your T2 return, which is the service you are paying for. Most of what is collected goes onto the return or onto the T183CORP.

To verify who is signing. A code sent to your mobile number is what proves the person authorising a filing is you.

To check what you have told us. We read your documents to confirm the corporation's legal name and to look for activity in a year declared nil, because filing a nil return for a year that had activity would be filing something untrue.

To reach you about your filing, and to keep the records the CRA requires us to keep.

Who else handles it

Supabase — stores the database, your uploaded documents and your account. Hosted in Canada.

Vercel — hosts and serves the site.

Stripe — takes the payment. Stripe holds your card details; we hold only the amount, the date and Stripe's own reference.

Twilio — sends the security codes to your mobile number.

Resend — sends the emails about your filing.

Anthropic — reads the documents you upload, to answer the two questions above: what legal name is on the articles, and whether the bank statements or prior return show activity. Documents sent for this purpose are not used to train models.

The Canada Revenue Agency — receives your return, once you have signed the T183CORP authorising it.

Google — measures our advertising, and only on the public pages described under Cookies below. It receives your IP address, your browser and device type, and which of those pages you looked at. It receives nothing from your filing, your documents, your messages or your account, because it does not run on any of them. Google processes this outside Canada, including in the United States.

We do not sell your information. We do not share it with anyone other than the parties named above, and otherwise only where the law requires it.

Cookies and analytics

Our own cookies keep you signed in, remember which language you are reading in, and remember a device you have marked as trusted. Those are what make the service work; without them you could not stay signed in, and they are not used to follow you anywhere.

Google Analytics runs on the public pages only — the home page and these legal pages — so that we can see which of them bring people here and whether our advertising is worth what it costs. It does not run on any page of your filing, on your documents, on your messages or on your account.

It is switched off until you agree. The first time you visit a public page we ask, and nothing is stored on your device unless you accept. If you accept, Google sets its own cookies (_ga and one beginning _ga_) which last up to two years and let it recognise the same browser returning. If you decline, or if you ignore the question, no such cookie is set.

You can change your mind at any time from the Cookie choices link at the foot of any page, or by clearing the site's data in your browser. Google also publishes an opt-out add-on for its analytics.

We do not record who agreed and who did not: your answer is kept on your own device and never reaches us.

How long it is kept

Six years after the end of the tax year the records relate to. That is the period for which the CRA may ask a filer to produce them.

You can ask us to delete an account that has no filed return attached to it. Where a return has been filed, the records behind it have to be kept for the six years above.

Your rights

You can ask what we hold about you, ask for a copy, and ask us to correct anything inaccurate. Most of it you can see and change yourself while a filing is still a draft.

You can withdraw consent and stop using the service, subject to the retention period above and to anything already filed on your behalf.

Ask at bahaatouni@yestax.ca. If you are not satisfied with our answer you may complain to the Office of the Privacy Commissioner of Canada.

Security

Your documents sit in private storage that is not reachable by a public link. Access to your filing is restricted to your own account and to the accountant, and this is enforced by the database rather than only by the screens.

Signing in needs your password and a code texted to the number on your account. A device you mark as remembered stays trusted for thirty days; changing your password ends that.

No system is perfectly secure. If a breach affects you in a way that creates a real risk of significant harm, we will tell you and the Privacy Commissioner, as the law requires.

Contact

Y.E.S TAX & ACCOUNTING SERVICES INC is responsible for the information described here.

bahaatouni@yestax.ca — 70 Absolute Ave, Mississauga, ON L4Z 0A4. Business Number 707518767RT0001.