Privacy Policy

TaxCove ("we", "us", or "our") explains here how personal information is collected, used, disclosed, retained, and protected when you use our public website, account and document flows, tax or accounting services, payment and booking features, support channels, or property-management inquiry form.

• Personal identification: name, email, phone number, address
• Tax-related information: Social Insurance Number (SIN), income details, employment records
• Financial documents: T4s, T5s, rental income statements, expense receipts
• Account information: login credentials, booking history
• Inquiry information: high-level contact and building details submitted through public contact, resource, or property-management forms
• Technical and security information: device, browser, network, consent, CAPTCHA, request, and diagnostic events needed to deliver and protect the service

• Prepare and file your tax returns with CRA and Revenu Québec
• Communicate with you about your submissions and bookings
• Process payments securely through Stripe
• Improve our services and user experience
• Respond to support or property-management consultation inquiries without treating a public inquiry as a signed service mandate
• Prevent abuse, protect accounts and uploads, and diagnose application errors
• Comply with legal and regulatory requirements

We use layered safeguards such as access controls, encryption in transit and at rest where supported, restricted server-side access, logging controls, abuse screening, and document-security checks for applicable uploads. No online system is risk-free. Send tax documents and other sensitive information only through the designated secure flow, never through public contact or property-management forms. Provider processing location depends on the configured service, region, contract, and technical path; this policy does not make a blanket Canada-only hosting claim.

Retention is set by information category and purpose, not by one blanket period. Tax and accounting records may be kept for the applicable statutory, professional, contractual, audit, or dispute period, which can vary with the record type, filing date, amendments, late returns, capital-property history, or a legal hold. Operational records such as resolved inquiries, handled property-management leads, security events, and blocked upload remnants may be kept for shorter periods. When retention is no longer justified, information is deleted or anonymized where reasonably possible and legally permitted. Deletion applies to live systems first: secure backup copies are held in immutable storage, cannot be altered or removed for 35 days, and are destroyed automatically within 60 days.

We use providers only for the applicable configured flow and aim to limit the information shared to what that purpose requires. A provider may process information outside Quebec or Canada according to its infrastructure and contract. Government authorities such as the CRA and Revenu Québec receive information only when required for an authorized tax-service step or by law.

• Supabase: authentication, database, file storage, and server-side processing for the relevant TaxCove flows
• Stripe: payment processing; Stripe handles payment-card details while TaxCove receives transaction status and identifiers rather than full card numbers
• Vercel: website and application hosting, delivery, and request processing
• Postmark: transactional, service, or lifecycle email delivery when the applicable email flow is configured
• Sentry: minimized application error and diagnostic reporting when monitoring is enabled
• Expo: mobile application build and update delivery; push-notification relay applies only to devices whose users explicitly enable notifications
• Apple platform services: Sign in with Apple, App Store distribution, opted-in Apple Push Notification service delivery, and Apple Pay platform processing when the applicable feature is enabled
• Google services: Google sign-in, reCAPTCHA abuse screening, Play distribution, opted-in Firebase Cloud Messaging delivery, and Google Pay platform processing when applicable; analytics or tag services operate only when enabled and subject to the applicable consent settings
• Microsoft identity: Microsoft account authentication when a user chooses the Microsoft sign-in option
• Cloudmersive: document security and content-disarm processing for configured upload types or security paths; document content may be sent for validation or cleaning only when that path applies

TaxCove's Privacy Officer, acting as the person responsible for the protection of personal information, receives privacy questions and rights requests at operations@taxcove.ca. Use “Privacy request” in the subject line when possible.

• Access your personal data we hold
• Request correction of inaccurate information
• Request deletion of your data (subject to legal requirements)
• Withdraw consent for marketing communications
• Request a copy in a structured, commonly used technological format where the applicable law provides that right
• Raise a concern with TaxCove’s Privacy Officer and, where applicable, the Commission d’accès à l’information du Québec

For privacy-related questions or to exercise your rights, contact us at operations@taxcove.ca.