This Privacy Policy explains how SERVICES COMPTABLES ACCOUNT DIRECT inc. (ACCOUNT DIRECT BOOKKEEPING SERVICES inc.) ("Account Direct", "we", "us", "our") collects, uses, discloses, retains, and protects your personal information. We comply with the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA"), the Quebec Act respecting the protection of personal information in the private sector ("Quebec Privacy Act", as modernised by Bill 64 / Law 25), and other applicable privacy laws in Canada.
By creating an account or using the Account Direct service, you confirm that you have read, understood, and agree to the practices described in this Privacy Policy and that you consent to the collection, use, and disclosure of your personal information as described.
1. Quick summary (the key elements)
For a longer explanation, read the rest of this document. The short version:
- What we collect. Account information (name, email, business name), business records you upload (financial documents, transactions, transcriptions), usage information, and billing information. When your accountant prepares your employees' federal and provincial payroll slips (such as the T4, T4A and RL-1), we also collect their payroll information, including their social insurance numbers (section 2.2).
- Why we collect it. To provide the service, to allow your accountant to prepare your bookkeeping records, to process payments, to send you transactional emails, and to comply with our legal obligations.
- Who else gets it. A small number of carefully selected service providers that operate the platform on our behalf, including providers for infrastructure and hosting, payment processing, analytics, transactional email, email and file storage, and document processing. We describe them by role in section 4 and keep a current list available on request.
- Where it goes. We offer two service tiers. Under our Canadian-only tier, your financial documents are processed in Canada and their content is not sent across the border. Under our cross-border tier, some of your information, including the content of your financial documents, is processed in part by service providers in the United States (see section 3). The Account Direct team can tell you which tier applies to your data and can change it at your request.
- Your rights. You can access your data, correct it, port it, and delete it. Some records are retained for six years from the end of the last tax year to which they relate, to comply with Canadian tax-record-keeping rules (see section 5).
- Privacy inquiries. Reach the person in charge of the protection of personal information, the President of the firm, at [email protected].
2. Information we collect
2.1 Account information
When you create an account we collect: your name, your email address, the name of your business or firm, the province in which you operate, and a password (stored as a one-way hash).
2.2 Business information
You and your accountant upload financial documents, transcriptions, and supporting records to the platform. This typically includes vendor and customer names, transaction descriptions, dollar amounts, dates, and the categorizations assigned by you, by your accountant, or by the platform's automated tools. For some businesses this also includes information about employees (where payroll information is recorded through the platform), business clients (where the customer is a service business), and other third parties identified in invoices, receipts, or contracts you upload.
Payroll information. When your accountant prepares federal and provincial payroll slips (such as the T4, T4A and RL-1) through the platform, we collect, for each employee or payee: their name, social insurance number (SIN), province of employment, hire and departure dates and, where needed, their date of birth, address and email, together with the amounts on their slips. We use this information only to prepare, correct and keep those slips, which the employer is required to file. The SIN is encrypted in our database. Only the accountant assigned to the file and the President of the firm can see the full number, and every viewing is recorded. Everywhere else (lists, PDF working copies of the slips) only the last three digits appear. Your own client account does not display this information.
Invoices and payment reminders. When you invoice your customers through the platform, we keep the customer details you enter on each invoice, such as their name, email and address. If you turn on payment reminders for an invoice, we email your customer at the address on that invoice, on your behalf and on the days you choose, until the invoice is paid, and we keep a record of each reminder: its date, the address it went to and whether it was delivered. Payment reminders are optional: they stay off unless you turn them on for an invoice, and you can turn them off at any time and send your own reminders instead.
We treat this category of information as sensitive because it contains financial details and identifies third parties. Sensitivity influences how we protect, share, and disclose this information.
2.3 Usage information
We collect information about how you use the service: pages you visit, features you interact with, the time and approximate geographic origin of your sessions, the device and browser you use, and error events that help us diagnose problems. This information is collected through the analytics provider described in section 4.
2.4 Communications
When you write to us through the contact form on our website, send a message through the in-app messaging feature, exchange notes with your accountant, or contact us by email, we collect the contents of the communication and any attachments. When you submit a privacy inquiry, we collect the request and any documentation you provide to verify your identity.
2.5 Payment information
Payment is processed by a third-party payment processor. Cards go through our payment provider; for pre-authorized debit, cheque or wire, we keep the banking details needed. We receive from the payment processor a limited record of the transaction (subscription identifier, payment status, the last four digits of the payment method, the country of the card issuer) sufficient to manage the subscription.
2.6 Information we do not collect
We do not collect your driver's licence number, your passport number, your medical or health information, information about your political opinions or religious beliefs, or biometric information. The only government identifier we collect is the social insurance number of our clients' employees and payees, for their payroll slips (section 2.2). We do not knowingly collect information about minors, except the payroll information of an employee under 18 (section 11).
3. How we use your personal information
We use your personal information for the following purposes:
- To provide the service. Storing your data, presenting it back to you in the platform, allowing your accountant to access it, and generating workbooks from it.
- To organize your records. Using automated tools to help organize and classify the records uploaded by your accountant. Your accountant reviews the result and may change it.
- To process payments. Sharing the necessary subscription information with our payment processor so it can charge your payment method.
- To send transactional email. Sending account confirmations, password resets, billing notifications, and approval or rejection notices.
- To send payment reminders on your behalf. Emailing your customers the reminders you turn on for an invoice. Each reminder shows your business name, and your customer's replies come to you.
- To improve the service. Analysing usage information to understand which features are useful and which are not. When you are signed in, this information is linked to the randomized account number assigned to you, never to your name or email; otherwise it is anonymous.
- To respond to communications. Replying to messages you send through the platform or to our support address.
- To comply with legal obligations. Responding to lawful requests from regulators, retaining records as required by Canadian tax law, and reporting privacy breaches as required by PIPEDA section 10.1 and Quebec Privacy Act article 3.5.
3.1 Two service tiers
The platform operates in one of two tiers. The applicable tier is selected by the Account Direct team and is in effect when your data is processed.
Tier 1 (Canadian-only). Your customer documents and the transcriptions of those documents are processed within Canada on Account Direct's own infrastructure. No customer document content is sent outside Canada during this processing. Some other supporting services may be provided from outside Canada, as described in this Policy.
Tier 2 (Cross-border). Your customer documents and the transcriptions of those documents are processed in part by a service provider located outside Canada. That provider handles the data under its own privacy and security commitments and a data-processing agreement with us, over an encrypted connection, and is not permitted to use the data for any purpose other than providing the service to us. This cross-border handling triggers the disclosure requirements of section 8 of this Policy and the Privacy Impact Assessment described in section 8.
4. How we share your personal information
We share your personal information only as described in this section. We do not sell it.
4.1 Service providers
We rely on a small number of carefully selected service providers to operate the platform. We engage them in the following roles:
- Infrastructure and hosting. The providers that run our servers, store your data securely, manage sign-in, and keep the platform available.
- Payment processing. The provider that securely processes your subscription payments.
- Analytics. The provider that helps us understand how the service is used so that we can improve it.
- Transactional email. The provider that delivers account confirmations, password resets, notification emails, and the payment reminders you send to your customers.
- Email and file storage. The providers that host our mailbox and the files we use to keep your books, such as your workbooks.
- Document processing. The provider that, depending on the service tier in effect, helps organize and classify the records uploaded to the platform.
Each service provider is bound by a data-processing agreement with Account Direct, or by terms that include comparable privacy and security commitments. Each may use your personal information only to provide its service to us and is not permitted to use it for its own separate purposes. A current list of the specific service providers we engage is available on request from the Account Direct Team.
We do not share your personal information with advertising networks, marketing partners, or data brokers.
4.2 Disclosure required by law
We may disclose your personal information when required to do so by applicable law, including in response to a lawful subpoena, court order, or other legally enforceable demand by a government authority or law-enforcement body. We will resist over-broad demands and will notify you of the demand unless legally prohibited from doing so.
4.3 Disclosure in connection with a corporate transaction
If Account Direct is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, your personal information may be disclosed to the parties to the transaction and to their advisors. We will require any successor to honour this Privacy Policy or to obtain fresh consent from you.
5. Your rights
You have the following rights with respect to your personal information. To exercise any of these rights, send a privacy inquiry to the Account Direct Team at [email protected]. We will acknowledge your request within five business days and respond substantively within thirty days. For complex requests we may extend the response period by an additional thirty days, with written notice to you.
5.1 Right of access
You can access and export your personal information at any time through the platform's data-export feature, which provides a copy in a structured, commonly used machine-readable format.
5.2 Right of correction
You may request that we correct personal information that is inaccurate, incomplete, or out of date. We will correct the information promptly and will notify any third party to whom we have disclosed the incorrect information, unless doing so is impossible or requires disproportionate effort.
5.3 Right of deletion
You can close your account at any time from Settings → Close account, or by writing to us at [email protected]. When your account is closed:
- Your access to the platform ends immediately and your sign-in credentials are blocked.
- We stop all work on your file.
- You receive an email confirming the closure and the date until which your records are kept.
- Your business records are kept for six years from the end of the last tax year to which they relate, as required by section 230 of the Income Tax Act (Canada) and the equivalent Quebec provisions. During this period you cannot reach them through the platform; only our staff can, and only to meet a legal obligation or to answer a request from you or from a tax authority.
- When the retention period ends, we review the file and delete your records, the files you uploaded and your account, permanently. A record that the law still requires us to keep (for example, a tax return under review) is deleted once that obligation ends. Residual copies may persist in encrypted backups for up to 12 months, after which they are also deleted.
Records that we are legally required to keep cannot be deleted before the end of the applicable retention period. You can export a copy of your data at any time before closing your account (see section 5.1).
5.4 Right of portability (Quebec residents)
Quebec residents have the right under article 27 of the Quebec Privacy Act to receive the personal information they have provided to us in a structured commonly used technological format and to have it transmitted to another organization where technically feasible. You can obtain your data in such a format at any time through the platform's data-export feature; to have it transmitted directly to another organization, contact the Account Direct Team.
5.5 Right to withdraw consent
You may withdraw your consent to our continued use of your personal information at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent will likely end our ability to provide the service to you.
5.6 Right to submit observations on automated processing
The platform uses automated tools to help organize the records uploaded by your accountant. You have the right under article 12.1 of the Quebec Privacy Act to be informed when an automated process is used in this way, to ask for the personal information used to be corrected, and to submit observations to a person within Account Direct in a position to review the result. To exercise this right, send a privacy inquiry to [email protected] or contact your accountant. See section 9 for more on automated processing.
5.7 Right to file a complaint
If you believe we have not handled your personal information in accordance with applicable law, you may file a complaint with:
- The Office of the Privacy Commissioner of Canada (priv.gc.ca);
- The Quebec Commission d'accès à l'information (cai.gouv.qc.ca);
- Both, if you reside in Quebec.
We encourage you to contact us first so we can attempt to resolve the matter directly.
6. Cookies and tracking technologies
We use cookies and similar technologies for authentication, security, preferences, and analytics. The Cookie Policy describes the categories of cookies we use, their purpose, and how to control them. You can adjust your cookie preferences at any time through the cookie banner that appears on your first visit and through the Cookie Settings link in the footer.
The Cookie Policy is incorporated by reference into this Privacy Policy.
7. Security
We use commercially reasonable administrative, technical, and physical safeguards to protect your personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification. These include:
- encryption of personal information at rest in our database and file storage;
- additional encryption of social insurance numbers, with every viewing of a full number recorded;
- encryption of personal information in transit over the public internet using TLS;
- role-based access controls that limit each user to the records they are entitled to see;
- authentication through a dedicated identity provider, with optional multi-factor authentication;
- regular security audits and reviews;
- service-provider data-processing agreements requiring comparable safeguards;
- a documented breach-response runbook with notification timelines aligned to PIPEDA section 10.1 and Quebec Privacy Act article 3.5.
No method of electronic storage or transmission over the internet is one hundred percent secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.
In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm to you, we will notify you and the appropriate regulator as soon as feasible after the breach is determined to present such a risk, in accordance with applicable law.
8. Cross-border transfers and the Privacy Impact Assessment
If the cross-border service tier is in effect, some of your personal information may be transferred to and processed by service providers located outside Canada, including in the United States. Such transfers are subject to Quebec Privacy Act article 17 (which requires a Privacy Impact Assessment before personal information is communicated outside Quebec) and to PIPEDA's accountability principle.
We have conducted a Privacy Impact Assessment for each cross-border transfer that may occur. The assessments consider:
- the sensitivity of the personal information being transferred;
- the purposes for which it is to be used;
- the protection measures, including contractual measures, that will apply to it; and
- the legal regime applicable in the receiving jurisdiction, including, where data is processed in the United States, the implications of the Foreign Intelligence Surveillance Act (FISA) section 702, the Clarifying Lawful Overseas Use of Data Act (CLOUD Act), and the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (USA PATRIOT Act), and the absence of a comprehensive federal privacy law equivalent to PIPEDA there.
The Privacy Impact Assessments are available on request from the Account Direct Team.
8.1 Supporting services
Some supporting services may involve a cross-border transfer of certain personal information, such as transactional email content. Customer document content is not transferred outside Canada when the Canadian-only tier is in effect.
8.2 Cross-border processing of documents
If the cross-border tier is in effect, your customer documents and their transcriptions may be processed by a service provider located outside Canada. This is the highest-sensitivity cross-border transfer in our service. It is subject to:
- a data-processing agreement that prohibits the provider from using the data for any purpose other than providing the service to us;
- transmission over an encrypted connection (TLS);
- contractual confidentiality and security commitments by the provider;
- the legal regime described above.
If you do not wish to be subject to this transfer, do not use the platform when the cross-border tier is in effect, or ask the Account Direct team to use the Canadian-only tier for your data.
9. Automated processing
The platform uses automated tools to help organize and classify the records your accountant uploads. These tools assist your accountant; they do not make final decisions. Your accountant reviews the result and remains responsible for the records and for any filings based on them.
In accordance with Quebec Privacy Act article 12.1, you have the right to:
- be informed that automated tools were used to process your information;
- ask for the personal information used to be corrected; and
- submit observations to a person within Account Direct in a position to review the result.
To exercise these rights, contact your accountant or send a privacy inquiry to [email protected].
Depending on the service tier in effect, this processing takes place either entirely within Canada on our own infrastructure or, in part, through a service provider located outside Canada (see section 3.1).
10. Retention
We retain your personal information for as long as necessary to fulfil the purposes for which it was collected and to meet our legal obligations.
- Account information is kept while the account is open and, once it is closed, for the retention period described in section 5.3.
- Business records (financial documents, transactions, transcriptions, workbooks) are kept for six years from the end of the last tax year to which they relate, as required by section 230 of the Income Tax Act (Canada) and the equivalent Quebec provisions, and then deleted after our review.
- Payroll information (including SINs and dates of birth) is part of the business records: it is kept for six years from the end of the last tax year to which it relates, and then deleted after our review.
- Payment reminder records are kept with the invoice they belong to, as part of the business records.
- Communications are retained for the duration of the account plus the deletion-handling period.
- Messages sent through the contact form on our website are kept for up to 24 months, then deleted.
- Usage information is linked to the randomized account number assigned to you (never to your name or email) when you are signed in, and is deleted after 12 months.
- Audit and breach records are retained for at least twenty-four months in compliance with PIPEDA section 10.3.
After the applicable retention period, we review the information and delete it permanently and irreversibly from our active systems. Residual copies may persist in encrypted backups for up to 12 months, after which they are also deleted.
11. Children
The service is not directed to children under eighteen years of age and we do not knowingly collect personal information from anyone under eighteen. A client may, however, employ someone under eighteen. In that case we collect, through the client and its accountant, that person's payroll information described in section 2.2, only to prepare their slips, which the employer must file whatever the employee's age. This information receives the same protection and follows the same retention rules. If we discover that we have collected any other personal information from a child under eighteen without verified parental consent, we will delete it.
12. Privacy inquiries
The person in charge of the protection of personal information at Account Direct is the President of SERVICES COMPTABLES ACCOUNT DIRECT inc. The President is responsible for compliance with PIPEDA, the Quebec Privacy Act, and this Privacy Policy, and can be reached at [email protected].
Person in charge of the protection of personal information: the President
SERVICES COMPTABLES ACCOUNT DIRECT inc. (ACCOUNT DIRECT BOOKKEEPING SERVICES inc.)
NEQ: 1182272097
300-204 rue du Saint-Sacrement, Montréal, QC H2Y 1W8
You may send a privacy inquiry to the person in charge of the protection of personal information to exercise any of your rights under section 5, to raise concerns about our handling of your personal information, to request a current list of the service providers we engage, or to receive a copy of any of our internal privacy documents (including the Privacy Impact Assessments referenced in section 8) on reasonable terms.
13. Changes to this Privacy Policy
We may modify this Privacy Policy from time to time. We will post the modified Policy on the service and update the "Last updated" date at the top of the document. Material changes will be notified to you by email or by an in-app notice at least thirty days before they take effect. We will request fresh consent where required by law.
14. Language
This Privacy Policy is also available in French .
15. Effective date
This Privacy Policy is effective as of May 22, 2026 and supersedes all previous Account Direct privacy notices.