Data Retention and Disposal Policy

• We keep personal information only as long as it is needed for the purpose it was collected for, or as long as the law requires.
• You decide how long your returns, books and payroll records are kept: they stay in AuraTax until you delete them or close your account.
• When information is no longer needed, it is deleted, or anonymized so that it can no longer identify anyone.

The Canada Revenue Agency and Revenu Québec generally require a business to keep its records and supporting documents for six years after the end of the tax year they relate to, and employers to keep their payroll records for six years. AuraTax holds your records for you but does not replace that obligation: keep your own copies — the PDF of each return and pay stub, your exported books — for as long as the law requires, especially before deleting anything from AuraTax.

• Your account — while it is active. When you ask us to close it, we delete your account and the records only you have access to within 30 days, except what we must keep by law (below).
• Tax returns — until you delete them. A deleted return is removed from our database; a return you paid for cannot be deleted before it is transmitted.
• Bookkeeping — businesses, transactions, entries, assets and liabilities and sales-tax profiles are kept until you delete them. The statements you upload are read and not kept on our servers: we keep only their name and a fingerprint, to recognize a file uploaded twice.
• Bank connections — a connection's encrypted access token is kept until you disconnect the bank or delete the business; the connection is then ended at Plaid and its token deleted. The transactions it brought in stay in your books, unless you choose to delete them when you disconnect it.
• Payroll — an employer's records (its employees, pay stubs, projects, calendar, job postings and applications) are kept until you delete the employer, which removes them all. A deleted employee's photo, identity document and contracts are deleted with them; the rest of their record is kept, marked as removed, as long as the employer exists, so the pay stubs and slips already issued stay complete.
• Files — signatures, photos, identity documents, contracts and pay stub PDFs are kept as long as the record they belong to.
• Payment records — six years after the payment, as our own tax obligations require.
• Backups — our databases are backed up every night; each backup is kept 30 days, then deleted. Information deleted from AuraTax therefore leaves our backups within 30 days.
• Server logs — application logs are kept only as long as needed to run and secure the service; logs of desktop app downloads, which include IP addresses, are kept no longer than 12 months.
• Breach register — at least 24 months after the incident is recorded, as the law requires.

Returns, books and signatures kept by the desktop app stay on your computer until you delete them in the app or remove the app's data folder. Uninstalling the app does not remove that folder on every system. Your account, licences and payments are kept on our servers as described above.

Our suppliers keep what they process for us only as long as their service and their legal obligations require, under their agreements with us: PayPal for payments, Auth0 for sign-in, Mailgun for emails sent, and Google and Voyage AI for the requests made by the AI features. A tax return you transmitted is kept by the tax authority under its own rules.

• Databases: records are deleted, not merely hidden, except where this policy says a record is kept marked as removed.
• Files: files in cloud storage are deleted with their record or on request; deleted files are then purged by the provider.
• Equipment: storage media from our servers and staff computers are wiped securely or physically destroyed before they are reused, returned or discarded.
• Paper: we do not keep customer information on paper; any printout is shredded.

We may keep information longer when the law requires it, to resolve a dispute, or because of a legal proceeding, an investigation or an audit; it is then kept only for that purpose and deleted once it ends.

To have your account closed or information deleted, or for any question about this policy, write to our Privacy Officer at support@auratax.ca. This policy is reviewed at least once a year.