Privacy policy

1. Who we are

Veralyt is a service of ARCHETYPE ORIGIN DYNAMICS INC., an Ontario corporation (“we”, “us”). This policy explains what personal information we collect, why, who processes it for us, how long we keep it, and your rights under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Our privacy officer answers questions at privacy@veralyt.com, or by mail at 236 Albion Road, Etobicoke, ON, Canada, M9W 6A6.

2. What we collect, and why

• Your account: your email address and the name you choose, to sign you in and contact you. If you use a passkey, Apple or Google, we keep what's needed to recognize you: the passkey's public key, or your Apple or Google account ID and email. We don't use passwords.
• Your tax files: the names of your businesses, rental properties or corporations, the province, fiscal year end and GST/HST registration details, and what you enter for each year (such as home office, vehicle kilometres and capital cost allowance), to prepare your figures.
• Your records: the bank and credit card exports, PDF statements and receipts you upload or email to us, the transactions in them, the categories you choose, and a history of your changes. We never connect to your bank.
• Billing (paid plans): your plan, your province (to charge the right GST/HST) and your customer ID at Stripe. Stripe handles your card.
• Security: a log of sign-ins and account changes, with the device, browser and IP address, so you and we can spot activity that isn't yours. To stop abuse, we also count requests per IP address in short-lived counters.
• AI use: for each AI request, the model, the number of tokens and the cost, to keep costs under control. Not what you asked, and not your documents' content.
• Emails you asked for: your deadline-reminder setting and, for beta news, your address and when you confirmed it.

We don't sell personal information, and we don't use it for advertising.

3. AI features

Veralyt uses Anthropic's Claude models through Anthropic's API:

• Reading documents (Pro): the PDF statement, receipt photo or emailed receipt you send is passed to Anthropic to read its lines. Nothing it reads counts until you confirm it.
• Category suggestions: the names of merchants you haven't reviewed yet, with what your business does, so it can suggest categories. You confirm each one.
• Ask (Pro): your question, your own totals as Veralyt calculated them, and our notes from CRA pages. We don't store your question or the answer.

Anthropic processes this data in the United States to provide its service to us. Under its commercial terms it keeps the data only for a limited time and doesn't use it to train its models.

4. Email

• Sign-in codes and security alerts (a new device, a passkey added or removed) protect your account, so they can't be turned off.
• Deadline reminders are on once you have a tax file. Turn them off in Settings or with the link in any reminder.
• Beta and product news starts only after you confirm your address from the email we send, and every email has a one-click unsubscribe. If you unsubscribe, we keep your address marked as unsubscribed so we don't email it again.
• Receipts by email (Pro): each tax file has a private address. We accept mail only from your own address, signed by your email provider (DKIM), and keep the receipt as a document. These emails pass through Cloudflare.

5. Accountant links

You can make a read-only link to one tax year for your accountant. Anyone who has the link can see that year's figures and download its accountant package and CSV files until the link expires (after 90 days at most) or you turn it off. We count views and keep the time of the last one; we don't record who opened it.

6. Who processes your information

Each provider gets only what it needs for its part. Apart from Supabase, these providers store or process information outside Canada, mostly in the United States, where it may be accessible to courts and authorities under local law.

7. Cookies

We use only the cookies that keep you signed in. The sign-in page loads Cloudflare Turnstile to check that you're not a bot, and it may set its own. Payment happens on Stripe's page, under Stripe's privacy policy. We use no analytics or advertising cookies.

8. How we protect it

Data is encrypted in transit and at rest. Each account can read only its own records, enforced in the database. Sign-in uses passkeys or one-time codes rather than passwords, and sensitive actions ask you to confirm it's you. Backups are encrypted before they leave the backup job.

9. How long we keep it

• While your account is open, we keep your data so you can use it. CRA asks you to keep your records for six years.
• When you delete your account in Settings, we delete your records, uploaded files and security log, and delete your customer record at Stripe, which cancels any subscription. Stripe keeps the payment records the law requires it to keep.
• Our encrypted backups are kept for 35 days, so a deleted account is gone from them within 35 days.
• Download what you need first: Settings exports your data as a file, each original document downloads from its tax file page, and each year has an accountant package.
• If you signed up for beta news without an account, write to us to have your address deleted entirely.

10. Your rights

You can ask what personal information we hold about you and how we've used it, ask us to correct it, and withdraw your consent: unsubscribe, turn off reminders, or delete your account. Write to privacy@veralyt.com; we answer within 30 days. If you aren't satisfied, you can complain to the Office of the Privacy Commissioner of Canada.

11. Changes to this policy

We post any new version here with its date. Before a significant change takes effect, we email account holders.

12. Contact

ARCHETYPE ORIGIN DYNAMICS INC. · privacy@veralyt.com · 942-380-2385 · 236 Albion Road, Etobicoke, ON, Canada, M9W 6A6