SimplifiedClaim (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our SR&ED tax calculation platform and website. It is designed to meet the requirements of Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and Canada's PIPEDA.

The person responsible for the protection of personal information (responsable de la protection des renseignements personnels) is Yankel Lahiany, Founder. You can reach the privacy officer at privacy@simplifiedclaim.com.

• To provide, maintain, and improve our SR&ED calculation services.
• To process transactions and send related information.
• To respond to your comments, questions, and support requests.
• To send technical notices, updates, and security alerts.
• To monitor and analyze trends, usage, and activities.
• To detect, investigate, and prevent fraudulent or unauthorized activity.

All client data — including databases, uploaded documents, payroll records, and project evidence — is stored in Canada, in data centres located in Montréal, Quebec (AWS ca-central-1). Our application servers also run in Montréal.

We use a limited number of service providers (sub-processors). Some process specific categories of information outside Quebec; before doing so, we assess that the information receives adequate protection and bind each provider contractually, as required by Law 25:

• Supabase (Canada): database and document storage, Montréal region.
• Vercel (Canada): application hosting, Montréal region; global content delivery network for static assets.
• AI processing (United States): document extraction and drafting use vetted inference providers (including OpenAI, Google, Anthropic, DeepInfra, Fireworks, and DigitalOcean) under no-retention terms. Your data is never used to train AI models, and requests are technically restricted to this approved provider list.
• Stripe (United States): payment processing. We never store card numbers ourselves.
• Resend (United States): transactional email delivery.
• PostHog (United States): product analytics on usage data; no client tax documents or payroll data are sent to analytics.

We do not sell personal information, and we do not share it with any other third party except where required by law.

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. All data is encrypted in transit and at rest using industry-standard protocols, access is restricted per tenant and per role, and administrative access is limited to what is strictly necessary.

We retain your information for as long as your account is active or as needed to provide the service. SR&ED supporting documentation is typically retained for the review periods contemplated by tax law; you may request deletion of your account and data at any time, subject to legal retention obligations. When information is no longer required, it is securely destroyed or anonymized.

• Access: obtain a copy of the personal information we hold about you.
• Rectification: have inaccurate or incomplete information corrected.
• Withdrawal of consent: withdraw consent to the use or disclosure of your information.
• Portability: receive computerized personal information you provided to us in a structured, commonly used format.
• Complaint: contact our privacy officer, and if unsatisfied, lodge a complaint with the Commission d'accès à l'information du Québec (CAI) or the Office of the Privacy Commissioner of Canada.

If a confidentiality incident presents a risk of serious injury, we will notify the Commission d'accès à l'information and the affected persons, as required by Law 25, and take reasonable measures to reduce the risk of harm. We maintain a register of all confidentiality incidents.

If you have questions about this Privacy Policy, please contact us at privacy@simplifiedclaim.com.