SimplifiedClaim (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our SR&ED tax calculation platform and website. It is designed to meet the requirements of Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and Canada's PIPEDA.

The person responsible for the protection of personal information (responsable de la protection des renseignements personnels) is Yankel Lahiany, Founder. You can reach the privacy officer at privacy@simplifiedclaim.com.

• To provide, maintain, and improve our SR&ED calculation services.
• To process transactions and send related information.
• To respond to your comments, questions, and support requests.
• To prepare the SR&ED estimate you requested and follow up with you about it.
• To send technical notices, updates, and security alerts.
• To monitor and analyze trends, usage, and activities.
• To detect, investigate, and prevent fraudulent or unauthorized activity.

We implement technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction:

• Storage in Quebec: our database, uploaded documents (payroll records, invoices, project evidence), and nightly backups are stored in Canada, on OVHcloud infrastructure in Beauharnois, Quebec. Our application servers run there too.
• Processing outside Canada: when you use AI features (document extraction, classification, drafting, or the in-app assistant), the relevant document text and project details are sent through OpenRouter (United States) to one of the inference providers listed below, which may process them outside Canada. Transactional emails, payments, and product analytics are also handled by providers in the United States (see the next section).
• Encryption in transit: all connections to our platform use HTTPS (TLS), as do connections from our servers to document storage and to AI providers.
• Isolated database: our database is not exposed to the internet; it is reachable only by our application, over a private internal network.
• Access control: every request is checked against your organization, so users only see the organizations they belong to. Within an organization, access is limited by role (administrator, technical, financial). Documents are served only through time-limited signed links.
• No AI training: we do not use client data to train AI models. Every AI request is restricted to an approved list of providers and sent with zero-data-retention and no-data-collection settings, so it is routed only to endpoints that neither keep prompts nor use them for training.
• Your own AI assistant: if you connect your own AI assistant (for example Claude or ChatGPT) to SimplifiedClaim through our connector, the claim data it reads is processed by that assistant's provider, under your own agreement with them.

We use a limited number of service providers (sub-processors). Some process specific categories of information outside Quebec; before doing so, we assess that the information receives adequate protection and bind each provider contractually, as required by Law 25:

• OVHcloud (Canada): application servers, database, and document storage, Beauharnois, Quebec.
• Supabase (Canada): a legacy copy of uploaded documents, Montréal region, kept temporarily during our migration and scheduled for deletion.
• AI processing (United States): document extraction and drafting go through OpenRouter, which routes each request to a vetted inference provider (OpenAI, Microsoft Azure, Google, Anthropic, DeepInfra, Fireworks, or DigitalOcean) under no-retention terms. Your data is never used to train AI models, and requests are technically restricted to this approved provider list.
• Stripe (United States): payment processing. We never store card numbers ourselves.
• Resend (United States): transactional email delivery, including sign-in emails and the invoices and receipts we send you.
• PostHog (United States): product analytics on usage data, including your email address, company name, and the file names of uploaded documents; the contents of client tax documents and payroll data are never sent to analytics.
• LinkedIn (United States): collects the contact details you submit in our LinkedIn Lead Gen forms and passes them to us.
• Google (United States): Google Calendar booking page used to schedule calls with us.

We do not sell personal information, and we do not share it with any other third party except where required by law.

We retain your information for as long as your account is active or as needed to provide the service. SR&ED supporting documentation is typically retained for the review periods contemplated by tax law; you may request deletion of your account and data at any time, subject to legal retention obligations. Contact details from estimate requests and bookings that do not lead to an engagement are kept for up to two years after our last exchange, then deleted. When information is no longer required, it is securely destroyed or anonymized.

• Access: obtain a copy of the personal information we hold about you.
• Rectification: have inaccurate or incomplete information corrected.
• Withdrawal of consent: withdraw consent to the use or disclosure of your information.
• Portability: receive computerized personal information you provided to us in a structured, commonly used format.
• Complaint: contact our privacy officer, and if unsatisfied, lodge a complaint with the Commission d'accès à l'information du Québec (CAI) or the Office of the Privacy Commissioner of Canada.

If a confidentiality incident presents a risk of serious injury, we will notify the Commission d'accès à l'information and the affected persons, as required by Law 25, and take reasonable measures to reduce the risk of harm. We maintain a register of all confidentiality incidents.

If you have questions about this Privacy Policy, please contact us at privacy@simplifiedclaim.com.