Privacy policy

1. Who is responsible

AccountantPortal is operated by Dereck Guay, a sole proprietor based in Alberta, Canada. Dereck Guay, founder, is also the person in charge of the protection of personal information. You can reach him at privacy@accountantportal.ca or through our contact form.

2. Two roles

For our customers (accounting firms and their staff), we decide how and why we use their information: we are responsible for it.

For our customers’ clients (the people who upload documents or sign forms), the accounting firm is responsible for their information. We process it on the firm’s behalf, only to provide the service. Questions about those documents should first go to the firm.

3. What we collect

• Account information: names, email addresses, firm name, language, sign-in and two-factor details.
• Billing information: plan and billing history. Card payments are handled by our payment processor (Stripe); we don’t store full card numbers.
• Documents and signatures: files uploaded by clients or staff, checklist content, signatures, one-time code confirmations and consent records.
• Phone numbers and text messages: when a firm turns on text messages, the client’s mobile number, the date the client agreed to receive texts, the texts sent and their delivery status, and STOP or START replies.
• Technical information: IP address, browser type and activity logs used for security and the audit trail.
• Website information: the contact form, the campaign that brought you to our site (utm parameters, kept for 30 days in a first-party cookie and saved on your firm if you sign up) and, only with your consent, analytics and advertising cookies.

4. Why we use it

• To provide, secure and support the service
• To send the emails the service depends on (requests, reminders, signing codes)
• To send text-message reminders and one-time codes, only to clients who agreed to receive them; replying STOP ends them
• To bill for paid plans
• To understand, with your consent, how our website is used and measure our advertising
• To meet legal obligations

5. Where it is stored and who processes it

The service runs in Canada: the application, its database, uploaded documents and backups are hosted in Toronto. We rely on the service providers below, each only for the purpose shown. Where a provider processes information outside Quebec or outside Canada, we assess the protection offered and rely on contractual safeguards, as Law 25 requires.

We don’t sell personal information. Mobile numbers and text-message consent are never shared with third parties or affiliates for marketing purposes. Each provider is bound by its own terms to use the information only to provide its service to us.

When a firm connects its own Google Drive or OneDrive, the copies are stored in the firm’s account, under the firm’s agreement with that provider and in that provider’s data locations, which may be outside Canada. The firm controls those copies: disconnecting stops new copies but does not delete the ones already there. We keep the access the firm granted encrypted, and use it only to add files to the folder the app created.

6. How we protect it

• Encryption in transit (HTTPS) and at rest
• Virus scanning of every upload
• Private client links that expire, with optional one-time codes
• Two-factor authentication for staff
• Access limited to what each person needs, and an audit trail

7. How long we keep it

Firms choose how long documents are kept in their retention settings. Account and billing records are kept as long as the account is active and afterwards as required by law. Signing records are kept for as long as the firm keeps the signed document.

Database backups, taken several times a day and stored in Canada, are kept for up to 4 months and then deleted automatically, including after a firm closes its account.

8. Cookies and tracking

Our website uses essential cookies (language, security, your cookie choice and campaign attribution). Analytics (Google Analytics) and advertising cookies (Google Ads, Meta) are off by default and load only if you accept them in the cookie banner. You can change your choice at any time with the “Cookie preferences” link at the bottom of every page. The app itself does not use advertising cookies.

9. Your rights

You can ask to access or correct your personal information, withdraw consent, or ask that it be deleted or exported in a structured, commonly used format, subject to legal exceptions. If you are a client of an accounting firm, contact the firm first; we’ll help them answer. We respond within 30 days.

If you aren’t satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d’accès à l’information.

10. Incidents

If a confidentiality incident presents a risk of serious harm, we notify the affected firms, the people concerned and the competent authorities as the law requires, and keep a register of incidents.

11. Changes

We’ll post any change here and, for important changes, tell customers by email.