Privacy policy

Scope

This policy covers personal information we control in connection with our marketing website (including the contact form, CRA Health Check, and scheduling links), inquiry channels, and client relationships. It does not replace the privacy policies of third-party processors or platforms we use or link to (listed below). Those providers process data under their own terms and policies.

Information we collect

Depending on how you interact with us, we may collect:

• Identity and contact data — name, email address, company name, optional phone number, and message content you submit via our contact form, email, or scheduling tools.
• Inquiry and Health Check context — details you provide about your bookkeeping needs, and if you complete the CRA Health Check and share results with us, your self-assessed score, band, and related notes (this is a self-assessment for education, not a CRA or tax opinion).
• Service and client data — information needed to deliver bookkeeping services (for example accounting file access, transaction details, payroll coordination data, and documents you provide), under the access you grant.
• Technical and security data — IP address, browser type, device information, approximate location derived from IP, pages visited, and timestamps, via hosting logs, spam protection, and privacy-respecting web analytics.
• Communications and scheduling — records of emails, form submissions, support messages, discovery-call notes, and booking details (for example date/time and attendee information) related to your inquiry or engagement.

We do not knowingly collect personal information from children under 13. If you believe we have received such information, contact us and we will delete it promptly where required.

How we use information

We use personal information only for purposes a reasonable person would consider appropriate in the circumstances, including to:

• Respond to inquiries and schedule discovery or service discussions
• Provide, administer, and improve bookkeeping and related services you request
• Send transactional or service-related communications
• Operate, secure, and improve the website (including spam and abuse prevention)
• Comply with legal, regulatory, tax, and professional obligations
• Establish, exercise, or defend legal claims

We do not sell personal information. We do not use contact-form submissions for unrelated marketing lists without a lawful basis and a clear way to opt out where required.

Consent

Where required, we rely on your consent (for example when you submit the contact form or engage our services). You may withdraw consent subject to legal or contractual restrictions and reasonable notice. Withdrawal may limit our ability to provide certain services. Some processing is necessary for contract performance, legitimate interests consistent with PIPEDA, or legal compliance and does not rely solely on consent.

Website contact form, Health Check, and booking

When you submit the website contact form, your name, email, message, and any optional company or phone details (and Health Check context if you shared it) are processed so we can reply and follow up. Typical flow:

• Your browser sends the form over HTTPS to our website infrastructure (Cloudflare).
• Spam checks run via Cloudflare Turnstile.
• We receive a lead notification email via Resend (and may send you an automatic acknowledgement).
• We append a lead row to an internal log in Google Sheets (via a Google Apps Script webhook we control) for follow-up.
• If you choose to book a discovery call, you use Cal.com, which may connect to a calendar we use (for example Google Calendar) to show availability and create the meeting.

Form data is used to respond to your inquiry and, if you become a client, may form part of your client record. The CRA Health Check self-score is not a CRA review, audit, or professional tax opinion.

Financial and client data

Client bookkeeping data is generally processed inside cloud accounting and document platforms you authorize (for example QuickBooks Online, Xero, Sage, Oracle, or spreadsheet tools). We use least-privilege access where available, and you may revoke access subject to the platform’s controls and any ongoing engagement needs. We do not sell client financial information.

Service providers (processors) and transfers

We use service providers to operate the website and related tools. Depending on how you use the Site, the following may process personal information on our behalf or as independent platforms you interact with:

• Cloudflare, Inc. — website hosting and delivery (Cloudflare Workers / CDN), DNS, and security. May also provide Cloudflare Web Analytics (privacy-oriented traffic measurement) and Cloudflare Turnstile (spam/bot protection on forms).
• Resend — transactional email delivery (for example lead notifications to us and automatic acknowledgement emails to you).
• Google LLC — Google Sheets (internal lead log) and, where connected, Google Calendar / related Google accounts used for scheduling availability; also Google Apps Script for the sheet webhook.
• Cal.com, Inc. — online booking / discovery-call scheduling when you use our “select slot on calendar” flow or booking links.
• Accounting and document platforms you choose — for example Intuit QuickBooks Online, Xero, Sage, Oracle NetSuite/related products, or spreadsheet tools, when you grant access for bookkeeping services.

We may also use ordinary business tools (for example email clients or office productivity software) to communicate with you. We do not sell personal information to data brokers.

Some providers may store or process data outside Canada (including in the United States). Where cross-border processing occurs, we take reasonable steps appropriate to the sensitivity of the information and applicable law. By using our site or services, you understand that information may be processed in jurisdictions with different privacy rules than your own. Each provider’s own privacy policy and terms also apply to their services.

Retention

We retain personal information only as long as necessary for the purposes described above, to meet legal, tax, accounting, or professional requirements, or to resolve disputes. Inquiry data that does not lead to an engagement is retained for a limited period and then deleted or anonymized where practicable. Client records are retained according to engagement terms and applicable retention rules.

Security

We implement administrative, technical, and organizational measures appropriate to the sensitivity of the information, including access controls, encrypted transport where standard, and vendor due diligence for core tools. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Your rights

Subject to applicable law, you may request access to, or correction of, personal information we hold about you. You may also ask questions about our privacy practices or withdraw consent where applicable. We may need to verify your identity and may refuse or limit a request as permitted by law (for example where disclosure would reveal confidential commercial information or personal information of others). To make a request, contact us using the details below. If you are not satisfied with our response, you may have the right to contact the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.

Cookies and similar technologies

Our site may use essential cookies or similar technologies required for security, load balancing, spam protection (Turnstile), or basic functionality. We may use Cloudflare Web Analytics, which is designed to measure traffic with limited personal identifiers compared with traditional advertising analytics. You can control cookies through your browser settings; disabling some cookies may affect site features. Third-party booking or calendar pages (for example Cal.com or Google) may set their own cookies when you use those services.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the website after an update constitutes notice of the revised policy for website visitors. Material changes affecting clients may also be communicated through engagement channels where appropriate.

Contact

Privacy questions and access requests:
Balance-Books Bookkeeping Inc.
Remote-first · Serving businesses across Canada
Email: contact@balance-books.ca