Privacy Policy

AuraTax is published by AuraSoft Inc., a Canadian company based in Brampton, Ontario ("AuraSoft", "we", "us"). We are responsible for the personal information we hold about our users and, when our customers enter it into AuraTax, about the people their records concern: their employees, shareholders and contacts.

This policy follows the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Quebec, the Act respecting the protection of personal information in the private sector (Law 25).

Your account. Your name and email address, your sign-in identity (managed by Auth0), the date your account was created and when you last signed in, your licences, subscriptions, trials and return credits, and your notification preferences.

Taxation. The returns you prepare: the corporation's identity (business number, name, Quebec enterprise number), its financial statements and schedules, the names, social insurance numbers and dates of birth entered on the forms, your signature, and what you enter to transmit a return to a tax authority — a web access code request, or your EFILE number and password when you transmit through EFILE. Your EFILE number is kept with the return; passwords and access codes are used for the transmission only and are never stored.

Bookkeeping. The businesses you keep books for, the bank and card statements you upload, the transactions read from them (dates, descriptions, amounts, account numbers), your entries, assets and liabilities, and your sales-tax settings and filings. When you connect a bank, the accounts you chose to bring in: their names, last digits, types and balances, and their transactions.

Payroll. The employers you manage and their employees: names, contact details, social insurance numbers, dates of birth, gender, marital status, number of children, salaries and pay stubs, emergency contacts, photos, identity documents and contracts, and the equipment and access identifiers you choose to record. For job postings: the applications candidates submit, with their résumés, cover letters and references.

Payments. When you buy a licence or a return, PayPal processes your payment. We never see or store your card number; we keep the payment's confirmation and amount.

Technical information. The IP address you connect from and the approximate location derived from it, the device and browser you use, and records of the requests our servers handle, including your email address where a request concerns your data. When you download the desktop app, the download is logged with the IP address and browser.

• To provide the apps: prepare, check, print and transmit your returns; read your statements and keep your books; run your payroll and produce pay stubs, T4 slips and records of employment.
• To transmit the returns and filings you ask us to send to the Canada Revenue Agency, Revenu Québec or Alberta's Tax and Revenue Administration.
• To manage your account, licences and payments, and to send you the emails the service needs: receipts, pay stubs you ask us to send, and notices about your account.
• To keep the service secure and working: detect abuse, investigate problems, and measure how the apps are used.
• To meet our legal obligations.

We do not sell personal information, and we do not use it for advertising. The information you enter about your business, its employees and its clients is used only to provide the service to you.

Bookkeeping can bring a business's bank and card transactions into its books by connecting to its bank through Plaid Inc. ("Plaid"). Before Plaid opens, you confirm your identity with a code from your authenticator app. You then sign in to your bank in Plaid's window: your bank username and password go to your bank and Plaid, never to AuraTax.

By connecting a bank, you grant AuraTax and Plaid the right to access and transmit, on your behalf, the account and transaction information of the accounts you choose, and you agree to Plaid collecting, transferring, storing and processing that information in accordance with the Plaid End User Privacy Policy.

Plaid gives us an access token for the connection, which we keep encrypted (AES-256) on our servers in Canada and use only to read the accounts' details, balances and transactions. We keep it until you disconnect the bank, or delete the business: the connection is then ended at Plaid, so the token stops working, and the token is deleted. When you disconnect a bank, you choose whether the transactions it brought in stay in your books or are deleted with it.

Some features send information to an AI model to do their work:

• Reading statements (Bookkeeping): the statement you upload is sent to Google's Gemini model, which returns its transactions.
• Categorizing transactions (Bookkeeping): transaction descriptions and amounts are sent to Gemini, which suggests a category.
• Ask AI (Taxation): your question and the lines of the return it is about are sent to Gemini to answer it; your question is also sent to Voyage AI to find the relevant help pages.

These features run only when you use them. Information sent to these providers is used to answer the request, under their terms for business customers.

We share personal information only with the people you share a business with in AuraTax (owners, editors and readers you invite), with the tax authorities you transmit to, and with the service providers below, who process it on our behalf and only for the purposes described:

• Auth0 (Okta) — sign-in and account security.
• PayPal — payments.
• Google Cloud — storage of files (signatures, photos, identity documents, contracts, logos, pay stubs) and of our software.
• Google (Gemini) and Voyage AI — the AI features above.
• Plaid — connecting your banks, when you choose to (see Bank connections).
• Mailgun — sending emails.
• ipinfo.io — the approximate location of the IP address you sign in from.
• Cloudflare Turnstile — protecting public job application forms from bots.

We may also disclose information when the law requires it, or to protect the rights and safety of our users or of AuraSoft.

Our servers and databases are operated by AuraSoft in Canada, and their backups are kept in Google Cloud's Montréal region. Some of the providers above process information outside Canada, notably in the United States, where it is subject to the laws of that country. Before entrusting information to a provider outside Quebec, we assess the protection it will receive.

On the desktop, your returns, your books and your signature stay on your computer, in the app's own data folder, except what you choose to transmit or send. Signing in, licences, payments, the AI features and transmissions still go through our servers.

We use only what the apps need to work: your sign-in session, kept in your browser's local storage; a cookie that protects your forms against cross-site requests; and your preferences, such as language and theme. We do not use advertising or third-party analytics cookies. Payment providers' scripts (PayPal, and Apple Pay or Google Pay when offered) may set their own cookies on the purchase pages.

Access to a business's records is limited to the people its owner invites, with the role they are given. Our apps connect to our servers over encrypted connections, files are kept in private storage and served through links that expire, and access to our systems is limited to the staff who need it. Our Information Security Policy describes these measures.

We keep personal information as long as your account is active and as long as needed for the purposes above, then delete it. Deleting a return, a business or an employer removes its records from our databases. Our Data Retention and Disposal Policy sets out the details.

• Access: ask what personal information we hold about you and receive a copy.
• Correction: have inaccurate or incomplete information corrected.
• Withdrawal of consent: stop a use of your information, unless the law requires it; some features may then no longer be available.
• Deletion: ask us to delete your account and the information it holds.
• Portability (Quebec): receive the information you provided in a structured, commonly used format.

If information about you was entered by one of our customers — your employer, for instance — we will refer your request to them, as they decide what is kept about you, and help them answer it. We answer requests within 30 days.

Our Privacy Officer is responsible for this policy and for protecting personal information at AuraSoft. Write to them at support@auratax.ca, with "Privacy" in the subject.

If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, to the Commission d'accès à l'information (cai.gouv.qc.ca).

We will post any change on this page with its new effective date, and tell you by email or in the apps before a significant change takes effect.