Privacy Policy
Asurnd prepares SR&ED claims on a platform we built for that purpose. Doing that means handling our clients' technical records and some personal information about the people who did the R&D. This policy says, in plain language, what we collect, why, where it goes, and how you can ask us about it.
The short version. Client data stays in Canada and is used only to prepare and support the client's SR&ED claim. Each client's data is kept separate from every other client's. AI features are off for a new client until the client agrees in writing; when they are on, text may be sent to an external model provider outside Canada under terms that prohibit using it to train models. We do not sell data and we do not run advertising trackers.
1. Who we are and what this covers
"Asurnd", "we" and "us" mean the business that operates asurnd.ca and the Asurnd platform at app.asurnd.ca. We are a Canadian SR&ED consulting firm. This policy covers:
- visitors to our marketing site, asurnd.ca;
- people who use the platform: our own team, our clients' staff and contacts, and the staff of partner accounting firms we work with;
- the people whose information appears in a client's records (for example, employees named on a timesheet or payroll register), even if they never sign in themselves.
We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair information principles, and, for clients in Quebec, the Act respecting the protection of personal information in the private sector as amended by Law 25. Where a provincial law applies instead of PIPEDA (Alberta, British Columbia), we follow it.
For most of the information on the platform, our client (the employer) decides why it is collected and we process it on their instructions, under the engagement letter. Where that is the case, requests about that information are handled with the client; see section 9.
2. What we collect
Account information
Name, work email address, role (for example firm admin, senior consultant, client contact), the firm or client you belong to, sign-in records (time, IP address, device type), and a record each time you agree to our Terms of Use and this policy at sign-in (date, version, how you signed in, browser). Accounts are created by invitation; we do not collect anything to create one that you do not give us.
Information from Google, if you sign in with Google
"Continue with Google" is optional; you can always sign in with an email and password instead. If you use it, the Asurnd app (app.asurnd.ca) asks Google only for your basic profile: your email address, your name, your profile picture and Google's account identifier for you (the openid, email and profile permissions). We do not ask for access to your Gmail, Drive, Calendar, contacts or any other Google data.
- How we use it: only to sign you in. Your email address is matched to the account your firm invited you with; if there is no such invitation, sign-in is refused and nothing is kept.
- Where it is stored: with your account in our sign-in service (Supabase, Canada), for as long as you have the account.
- Sharing: we do not sell it, share it with anyone, use it for advertising, or use it to train AI models.
- Removing it: you can disconnect Asurnd from your Google account at any time at myaccount.google.com/connections, and ask us to delete your account as described in section 9.
Asurnd's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Client records uploaded or connected to the platform
What a client gives us to substantiate its claim: project descriptions and monthly project logs, drawings, photos, test logs, design documents, emails and meeting notes, source-control activity (for example commit and pull-request metadata from GitHub, read-only), invoices and material costs, and financial and payroll information such as timesheets, salary and T4-type data for the people who worked on the R&D. Most of this is confidential business information; some of it is personal information about the client's employees and contractors.
We ask clients for only what the claim needs. We never ask for social insurance numbers, bank details or health information, and we ask clients to leave them out of what they upload.
Information you send us
Messages to our team, demo and access requests from the form on asurnd.ca (your name, email, organization, what kind of organization it is, your message and your browser type; stored in Canada and emailed to our support mailbox so we can answer), and problem reports sent from inside the platform. A problem report may include a screenshot of the screen you were on; you see the screenshot before sending and can leave it out.
Technical information
Server logs (request path, time, status, IP address), and an audit ledger of actions taken on the platform (who uploaded, approved or changed what, and when). The ledger is part of how we show a claim was prepared methodically.
3. Why we use it
- Preparing and defending SR&ED claims. Organizing evidence, calculating eligible expenditures, drafting project narratives with citations back to the source documents, and supporting the client if the Canada Revenue Agency reviews the claim.
- Running the platform. Signing you in, keeping each client's workspace separate, sending the emails the platform needs to send (invitations, sign-in and password-reset links, notifications you have asked for), and fixing problems you report.
- Security and record-keeping. Detecting misuse, keeping the audit ledger, and meeting our own legal obligations as a claim preparer.
- Improving the service. Understanding, in aggregate, how the platform is used. Any cross-client analysis uses de-identified, aggregated data only.
We do not sell personal information, and we do not use it for advertising.
4. Consent
Clients consent to our collection and use of their records through the engagement letter, which states the purposes above. Employers are responsible for telling their employees that their work records and payroll information will be used to prepare the company's SR&ED claim; we provide wording to help with that on request.
You consent to the use of your account information by accepting an invitation and by ticking the box to agree to our Terms of Use and this policy, which we ask at every sign-in and record. You can withdraw consent by asking us to close your account; some information may be retained as described in section 7.
Two uses need a separate, explicit "yes": sending a client's text to an external AI provider (section 5), and any marketing email we may introduce in future. The cookie-free page counts described in section 10 identify no one, stay on our server in Canada, and are covered by your agreement to this policy.
5. AI and external model providers
The platform uses AI to classify documents, suggest where evidence belongs, and draft narratives from the evidence. Some of this runs on our own servers in Canada (text extraction, OCR, search indexing). Some of it uses a large language model from an external provider located in the United States (currently Anthropic).
What is sent, and on what terms. When AI is on for a client, excerpts of that client's documents and project logs, and the prompts we build from them, are sent to the provider to produce a classification or a draft. Under our agreement with the provider, that content is not used to train or improve the provider's models, is not sold or shared, and is kept only as long as needed to return the response, subject to the provider's limited security and abuse-prevention retention. We never send one client's data in the same request as another client's.
- Off by default. AI features are disabled for every new client. They are turned on only when the client has agreed in writing, and that agreement and the change are recorded in the audit ledger. A client can ask us to turn them off at any time.
- Minimized. We send the excerpts the task needs, not whole workspaces, and we strip what we can before sending.
- Reviewed by people. AI output is a draft. A senior consultant reviews and signs off before anything is filed; the model cannot approve, file or send anything.
- Disclosed. Because this provider is outside Canada, the content is subject to the laws of that country while it is there. For Quebec clients we carry out a privacy impact assessment before enabling it.
If we change provider, or add one in Canada, we will update this section and tell affected clients.
6. Service providers and where data lives
Our primary data stores and compute are in Canada. We use a small number of service providers to run the service. Each one is bound by contract to protect the data and to use it only to provide its service to us.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in, encrypted file storage | Canada (Central) |
| OVHcloud | Application servers, background processing, daily backups | Canada |
| Amazon Web Services (SES) | Sending platform email (invitations, sign-in links) | Canada (Central) |
| Anthropic | Large language model, only for clients who have enabled AI; also the coding assistant our team uses to fix reported problems (see below) and to read our anonymous page counts (section 10) | United States |
| Cloudflare | Serves the marketing site (asurnd.ca) and DNS; forwards mail sent to our @asurnd.ca addresses (privacy, legal, security) to our support mailbox | Global edge network |
| Web fonts on our pages; our support mailbox (Google Workspace); "Continue with Google" sign-in, if you choose it (Google confirms your email to us and learns that you signed in; no client data goes to Google) | Global | |
| GitHub | Read-only connection to a client's repositories, when the client connects one | United States |
A problem report sent from the platform is stored in Canada, but the alert that reaches our support mailbox may include the screenshot, and that mailbox is hosted by Google outside Canada. If you prefer, leave the screenshot out of the report.
To fix a reported problem, our team gives the report to an AI coding assistant (Anthropic, United States): the page, your message, your role, your browser and screen size, and the screenshot if you sent one. It never includes your name, email, firm or client. The copy on our team member's computer is deleted once the problem is fixed.
Email you send to privacy@, legal@ or security@asurnd.ca passes through Cloudflare, which forwards it to the same support mailbox without keeping a copy. Please do not include more personal information in such an email than your request needs.
We do not transfer client records outside Canada for any other purpose. If a court or authority outside Canada were to demand data from a provider there, Canadian law could not prevent it; this is the main reason the AI provider is opt-in per client.
7. How long we keep it
- Client records and deliverables: for the CRA's review window for the claim, normally six years after the end of the tax year the claim relates to, unless the client asks us to delete earlier once the claim is filed. Clients can export their workspace at any time and on leaving.
- Deleted files: removed from the platform immediately and from our backups within 30 days.
- Account information: for as long as you have access, then kept in the audit ledger (name, role, what you did) for as long as the related client records are kept.
- Problem reports and screenshots: 90 days.
- Server logs: 90 days unless needed for a security investigation.
- Demo requests and correspondence: until the conversation has ended and for a reasonable time after, normally no more than two years.
8. How we protect it
Our Security page describes our controls in detail. In short: encryption in transit and at rest; every record tagged with the client it belongs to and every query scoped to that client; invitation-only accounts with role-based permissions; an audit ledger; daily backups in Canada; and a written incident process. Our team sees only the clients it works on.
9. Your rights
You can ask us:
- what personal information we hold about you and to receive a copy;
- to correct information that is inaccurate or incomplete;
- to delete your information, or to withdraw consent, subject to what we must keep for the claim and by law;
- for Quebec residents, to receive your information in a structured, commonly used format (portability), and to know whether a decision was made about you by automated means (none are: a person reviews every output);
- to complain. We will answer within 30 days. If you are not satisfied, you can contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
If your information is in a client's records (for example you are an employee of one of our clients), please ask your employer first; we will help them answer. We will verify your identity before acting on a request.
10. Cookies and analytics
The platform sets only the cookies it needs to keep you signed in and to remember your display preferences. The marketing site sets no cookies of its own. We do not use third-party advertising or behavioural-analytics trackers.
Page counts (Umami)
To see which pages are used and where the platform needs work, asurnd.ca and app.asurnd.ca count page visits with Umami, which we run ourselves on our server in Canada (analytics.asurnd.ca). No outside company receives this information, except that our team may ask an AI assistant (Anthropic, United States) to read the counts for us. It sees totals, page addresses and anonymous visit records (browser, device, country, pages viewed), never names, emails or client data. It records the page address (without anything after a ? or #), the site you came from, your browser, operating system, device type, screen size, language and country. It sets no cookies, does not store your IP address, and counts a visit with a code that changes every day, so it cannot follow you from one day to the next or tell us who you are. If your browser sends Do Not Track, you are not counted. We keep the counts for as long as they are useful, and no more than two years.
Emails the platform sends (invitations, notifications) tell us whether they were opened and which links were clicked, so we can see whether an invitation reached you. Sign-in and password-reset links are never tracked. Most email apps let you block this by not loading remote images.
Our pages load fonts from Google Fonts, which means your browser sends its request (including your IP address) to Google. No other third-party script runs on the platform; the page-count script above is our own.
11. Breaches
If a breach of security safeguards creates a real risk of significant harm to anyone, we will notify the affected clients and individuals, and the Privacy Commissioner of Canada (and, where applicable, the Commission d'accès à l'information du Québec), as soon as feasible, and we will keep a record of every breach as the law requires. Clients are notified of any incident affecting their workspace whether or not that threshold is met.
12. Changes and contact
We may update this policy. The date at the top shows the current version; material changes are announced to clients and to platform users before they take effect.
Our privacy officer is responsible for this policy and for answering requests under it:
Privacy Officer, Asurnd
Email: privacy@asurnd.ca