Privacy Policy

Last updated 2026-11-04 · Applies to riratrace.com and app.riratrace.com

RiraTrace prepares SR&ED claims on a platform we built for that purpose. Doing that means handling our clients' technical records and some personal information about the people who did the R&D. This policy says, in plain language, what we collect, why, where it goes, and how you can ask us about it.

1. Who we are and what this covers

"RiraTrace", "we" and "us" mean the business that operates riratrace.com and the RiraTrace platform at app.riratrace.com. We are a Canadian SR&ED consulting firm. This policy covers:

• visitors to our marketing site, riratrace.com;
• people who use the platform: our own team, our clients' staff and contacts, and the staff of partner accounting firms we work with;
• the people whose information appears in a client's records (for example, employees named on a timesheet or payroll register), even if they never sign in themselves.

We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair information principles, and, for clients in Quebec, the Act respecting the protection of personal information in the private sector as amended by Law 25. Where a provincial law applies instead of PIPEDA (Alberta, British Columbia), we follow it.

For most of the information on the platform, our client (the employer) decides why it is collected and we process it on their instructions, under the engagement letter. Where that is the case, requests about that information are handled with the client; see section 10.

2. What we collect

Account information

Name, work email address, role (for example firm admin, senior consultant, client contact), for a client's lead their job title, an optional phone number, how they prefer to be contacted and whether they signed the engagement contract, the firm or client you belong to, sign-in records (time, IP address, device type), and a record each time you agree to our Terms of Use and this policy at sign-in (date, version, how you signed in, browser). Accounts are created by invitation; we do not collect anything to create one that you do not give us. Your firm's administrators and senior consultants can see when you were invited, whether your sign-in link was sent and used, and when you last signed in (date and time, not your IP address or device); our platform administrators can see when you last signed in.

Information from Google

If you choose "Continue with Google", we receive your basic Google profile. Section 3 explains exactly what, and what we do with it.

Client records uploaded or connected to the platform

What a client gives us to substantiate its claim: project descriptions and monthly project logs, drawings, photos, test logs, design documents, emails and meeting notes, source-control activity (for example commit and pull-request metadata from GitHub, read-only), accounting data from the client's books when the client connects them (see below), invoices and material costs, and financial and payroll information such as timesheets, salary and T4-type data for the people who worked on the R&D, and, for each of them, the client's answer to whether they own 10% or more of the company's shares or are related to someone who does (the CRA treats these "specified employees" differently; the consultant makes the final decision). Most of this is confidential business information; some of it is personal information about the client's employees and contractors.

If the client's lead connects the company's books (QuickBooks Online, read-only), we read the company name, home currency and fiscal year start; the chart of accounts; the total of each expense account for each claim year and each month of it; the names of the classes and locations the books use, and the same totals for each; and the supplier invoices and purchases on accounts the client marks as contractors or materials, with the supplier's name, business number and country. We never read payroll by person, bank details or anything about the client's sales. The total of a salary account is seen only by the client's lead, the client's accountant and the consultant. A line from the books becomes part of the claim only when a person confirms it. What we read is stored in Canada with the client's other records. The access Intuit grants is stored encrypted (sealed with a key only our servers hold), is never shown to anyone, and is deleted when the client disconnects.

Each client also has its own evidence address (for example harbourweld@evidence.asurnd.ca). An email sent or forwarded there is received by Amazon SES in Canada, which checks it for spam and viruses and whether it really comes from the sender's domain, and stores it briefly in Amazon S3 in Canada until our server reads it. If the sender is on the client's team, we keep the sender's address and name, the subject, the date, the text (only when the privacy check finds no personal information in it; otherwise it is kept as a restricted file, or not at all if it holds a Social Insurance or ID number) and each attachment, which goes through the same privacy check as an upload. Email from anyone else is held: the client's lead sees only its sender, subject and date, and nothing from it is added until the lead adds it; the lead may also drop it. Spam and viruses are refused. Once an email is added, refused or dropped, its stored copy is deleted from S3.

The company's details, which the client's lead keeps on the Company page: legal and operating name, business number, incorporation date and jurisdiction, industry and NAICS code, website, head office and mailing addresses, where the R&D is done, fiscal year end, CCPC status, associated companies and the province of the T2. The legal name and business number are changed only by the consultant. The page also holds the company's main contact, accountant and project manager, with business contact details only: a name, a work email and a work phone number. Each change is recorded in the audit ledger with the previous values; the ledger names which contacts are set, not their details. These are stored in Canada with the client's other records and kept for as long as them.

Who sees the financial and payroll information. Inside a client, only the client's lead, a contact the client marks as its accountant, and the firm staff assigned to that client see payroll (the payroll sheet, salaries, T4 slips and payroll registers), subcontractor and material costs, the estimated credit, and the files sent for those items. Other people at the client (for example a project manager) see that these pages and files exist, shown with a lock, but not what is in them. A contact's own AI assistant sees only what that contact sees.

Messages between a client's team and its consultant on the platform are kept with the claim they are about, in one conversation per topic (a checklist item, a project, a month of the project log, or general). A conversation is seen only by that client's team and the firm staff working on that client; a conversation about payroll or other costs is seen only by the client's lead, the client's accountant and the consultant. Messages are stored in Canada with the client's other records. The other side is told by a notification email that does not include the message.

Weekly check-ins (optional). For people on a client's R&D team who do not use the platform, the client's lead can turn on a weekly check-in, person by person; it is off until the lead turns it on. We then keep that person's work email address and the day of the week the lead chose. On that day the person gets one email (sent through Amazon SES in Canada) that names the client and, for each project their connected sources showed that week, the project's title and what those sources already show, as counts and titles only (for example "GitHub shows 31 commits and 1 pull request ("Try ceramic inserts")" or a file's name), never the text of a commit, document or note. It asks two questions: what were you trying to find out, and what happened. The person answers on a page reached from a button in the email, without signing in: the link works once and closes after seven days, and we store only a scrambled form (a hash) of the key it carries, never the key. Their answers become evidence for the claim: each is kept as a piece of the project's evidence, in their words, dated the week it is about, with them named as its author, and is read like the client's other evidence by the client's team and the firm staff working on that client (and, while the client's AI is on, by the R&D judgement described in section 6). The person can stop the emails at any time from a link in each email; the client's lead then sees that they stopped them and cannot turn them back on. Replies to the email itself are not read.

For each subcontractor the client paid for R&D work, we record what the claim and a CRA review need: the subcontractor's legal name, business number and GST/HST number (a sole proprietor may have none), the work done and the project it was for, the amount and the invoice and payment dates, whether the work was done in Canada, whether the subcontractor deals at arm's length with the client, and the invoice or contract. The client may also add a contact name and email and the subcontractor's city and province, never a street address. When the subcontractor is a person, these details are personal information; we keep them with the client's other records, in Canada.

We ask clients for only what the claim needs. We never ask for social insurance numbers (including a subcontractor's), bank details or health information, and we ask clients to leave them out of what they upload.

Information you send us

Messages to our team, demo and access requests from the form on riratrace.com (your name, email, organization, what kind of organization it is, your message and your browser type; stored in Canada and emailed to our support mailbox so we can answer), and problem reports sent from inside the platform. A problem report may include a screenshot of the screen you were on; you see the screenshot before sending and can leave it out.

Technical information

Server logs (request path, time, status, IP address), and an audit ledger of actions taken on the platform (who uploaded, approved or changed what, and when). The ledger is part of how we show a claim was prepared methodically.

3. Google user data ("Continue with Google")

This section describes how the RiraTrace app at app.riratrace.com accesses, uses, stores, shares, protects, keeps and deletes the information it receives from Google. "Continue with Google" is optional: you can always sign in with an email address and password instead.

What we access

Only your basic Google profile, through the openid, email and profile permissions: your email address, your name, your profile picture and Google's account identifier for you. We do not request, and cannot read, your Gmail, Google Drive, Calendar, Contacts or any other Google account data, and we do not use any Google Workspace API.

How we use it

Only to sign you in to RiraTrace. Your Google email address is matched to the account your firm invited you with, and your name identifies you to the colleagues and clients you work with on the platform. Accounts are by invitation only: if no invitation exists for your email address, sign-in is refused and nothing from Google is kept. We do not use Google user data for advertising, to build profiles, to assess credit or lending, or for any purpose other than providing the sign-in you asked for.

Who we share it with

We do not sell Google user data or share it with anyone for their own use. It is processed only by the service providers that run RiraTrace for us, under contracts that limit them to providing that service:

• Supabase (Canada): our sign-in service and database, where your account is stored;
• OVHcloud (Canada): our application servers, which handle your requests;
• Amazon Web Services SES (Canada): sends the platform's emails (invitations, notifications) to your email address, and tells us (through Amazon SNS, also in Canada) whether an invitation email was delivered, bounced or marked as spam. We keep only that outcome and when it happened, so your firm can see that the invitation reached you.

We may also disclose it if the law requires us to. Google user data is never sent to our AI provider, and it is not used to develop, improve or train generalized or non-personalized AI or machine-learning models, ours or anyone else's.

How we protect it

Google user data is stored in Canada, encrypted in transit (TLS) and at rest. Only the sign-in service and the platform's own servers can read the account records; our team's access is limited by role and recorded in an audit ledger. Our Security page describes these controls in more detail.

How long we keep it, and how to delete it

• We keep your Google profile information only while you have an RiraTrace account.
• When your account is closed (by you, by your firm's administrator, or at the end of the engagement), we delete your Google email address, profile picture and account identifier from our sign-in service within 30 days, and from our backups within a further 30 days. Only your name and role remain in the audit ledger, as part of the record of who did what on a client's claim (section 8).
• To ask us to delete it, email privacy@riratrace.com from the address you sign in with. We confirm within 30 days. You can also remove RiraTrace's access at any time at myaccount.google.com/connections; after that you can still sign in with an email and password.

RiraTrace's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Why we use it

• Preparing and defending SR&ED claims. Organizing evidence, calculating eligible expenditures, drafting project narratives with citations back to the source documents, and supporting the client if the Canada Revenue Agency reviews the claim.
• Running the platform. Signing you in, keeping each client's workspace separate, sending the emails the platform needs to send (invitations, sign-in and password-reset links, notifications you have asked for), and fixing problems you report.
• Security and record-keeping. Detecting misuse, keeping the audit ledger, and meeting our own legal obligations as a claim preparer.
• Improving the service. Understanding, in aggregate, how the platform is used. Any cross-client analysis uses de-identified, aggregated data only.

We do not sell personal information, and we do not use it for advertising.

5. Consent

Clients consent to our collection and use of their records through the engagement letter, which states the purposes above. The client's lead signs the letter in the platform by typing their name and title and ticking "I agree", or asks for changes in writing; we record the name, title, the time, their IP address and browser, and a fingerprint of the exact text they signed, and keep that record with the letter for as long as the client's records are kept. Firm staff can see the IP address and browser; the client's other contacts cannot. Employers are responsible for telling their employees that their work records and payroll information will be used to prepare the company's SR&ED claim; we provide wording to help with that on request.

You consent to the use of your account information by accepting an invitation and by ticking the box to agree to our Terms of Use and this policy, which we ask at every sign-in and record. You can withdraw consent by asking us to close your account; some information may be retained as described in section 8.

Two uses need a separate, explicit "yes": sending a client's text to an external AI provider (section 6), and any marketing email we may introduce in future. The cookie-free page counts described in section 11 identify no one, stay on our server in Canada, and are covered by your agreement to this policy.

6. AI and external model providers

The platform uses AI to classify documents, suggest where evidence belongs, and draft narratives from the evidence. Some of this runs on our own servers in Canada (text extraction, OCR, search indexing). Some of it uses a large language model from an external provider located in the United States (currently Anthropic).

• Off by default, decided by the client. AI features are disabled for every new client. They are turned on only by the client's lead, in the platform: the lead reads the exact text of the agreement, ticks "I agree" and types their name, and we record that text, its version, their name and title and the time in the audit ledger. The AI controls page shows the client the provider, the country and exactly what each AI step sends and never sends. The lead can turn AI off there at any time, and so can the firm; nothing more is sent from then on. The firm cannot turn it on.
• The client's own provider, if it prefers. Instead of ours, the client's lead can have these AI steps run on the client's own provider: its own Anthropic account, an OpenAI-compatible endpoint it chooses, or Amazon Bedrock in a region it chooses (Canada (Central) keeps the text in Canada). The excerpts then go to that provider under the client's own agreement with it, and the AI controls page names the provider and where it runs. The client's key is stored encrypted on our servers in Canada, is never shown again, and is deleted when the client goes back to our provider. Changing the provider turns AI off until the lead agrees again.
• A contact's own AI assistant, if the lead allows it. A contact at the client can let their own AI assistant (for example Claude, ChatGPT or Microsoft Copilot Studio) read the client's claim evidence through RiraTrace, read-only, after signing in and approving it. What the assistant reads then goes to that assistant's provider under the contact's or client's own agreement with it, which may be outside Canada; we do not control that provider. If the contact allows it when connecting, the assistant can also suggest which checklist item a document supports, or add a summary it wrote as the contact's document; the firm confirms or dismisses each suggestion. Each read and suggestion is recorded in the audit ledger, and the contact or the client's lead can disconnect the assistant at any time on AI controls.
• Technical write-ups from the monthly logs. While AI is on, the problem, hypotheses, tests and results entries of a project's submitted monthly logs (never months still being written, and never financial or payroll records) are sent to the provider to draft that project's technical write-ups. Each draft names the log months it was built from; the client approves or edits each one, and the consultant reviews it. While AI is off, or the day's budget is used up, nothing is sent and the client writes them instead.
• Monthly drafts from connected activity. While AI is on, one project month of connected activity (commit messages, pull request and issue text, and changed file names with line counts, never source code) is sent to the provider to draft that month's log entry; every drafted sentence names the activity it rests on. Activity the R&D judgement or a person found not claimable is left out. Payroll records and the client's books are never sent.
• R&D judgement of collected pieces. Only when the client's consultant runs it, and while AI is on, the pieces collected for one project are sent to the provider, at most 40 at a time and at most 90,000 characters, with the project's title, to label each one in the CRA's terms (an uncertainty, a hypothesis, an experiment, a result, a conclusion, support work, or excluded routine work) with a one-sentence reason and the pieces it rests on. The pieces are connected activity and, as each becomes available, passages of documents the client attaches, notes it types, weekly check-in answers, web pages and meeting statements it adds. Payroll records, the client's books, restricted files and files sent for financial checklist items are never sent. The judge is the consultant's assistant for reviewing the evidence: it never runs on its own, the client does not see its labels, and a label is advice that never decides the claim. The consultant can overrule any label with a reason (recorded in the audit ledger), and the senior signs the claim. Reading anything other than connected activity needs the AI agreement of 2026-11-03 or later: a lead who agreed earlier is asked to agree again.
• Batch import of a notebook or log. When the client imports a file that holds many records (a lab notebook, a test-data sheet, a project log), RiraTrace splits it into dated pieces on our server in Canada: a spreadsheet by its date column, a notebook by its dated headings, with no AI. Only a document with neither is sent to the provider, and only while AI is on and the client's AI agreement is of 2026-11-04 or later: its pages, each cut to 8,000 characters, at most 60,000 characters a call and 10 calls a file, with the titles of the claim year's projects and without the file name. The model only says where each entry starts and its date; the text of every piece stays the file's own. Restricted files, files sent for financial checklist items and files the privacy check has not yet cleared are never split or sent. A person checks every piece before it is imported; a date the file does not state is shown as guessed. While AI is off, each page becomes one piece for the client to date.
• The privacy check agent, only if the lead turns it on. The upload privacy check (section 2) runs on our server in Canada and needs no AI. The client's lead can also turn on a Privacy check agent on AI controls; it is off by default and runs only while AI is on. It sends the text of a file the pattern check found clear, at most 12,000 characters and without the file name, to the client's AI provider, to catch personal information the patterns missed; it can only restrict a file, never open one. Files already restricted or refused, and Social Insurance and other ID numbers, are never sent. For a Quebec client we carry out a privacy impact assessment before it is turned on.
• Minimized. We send the excerpts the task needs, not whole workspaces, and we strip what we can before sending.
• Reviewed by people. AI output is a draft. A senior consultant reviews and signs off before anything is filed; the model cannot approve, file or send anything.
• Disclosed. Because this provider is outside Canada, the content is subject to the laws of that country while it is there. For Quebec clients we carry out a privacy impact assessment before enabling it.

If we change provider, or add one in Canada, we will update this section and tell affected clients.

7. Service providers and where data lives

Our primary data stores and compute are in Canada. We use a small number of service providers to run the service. Each one is bound by contract to protect the data and to use it only to provide its service to us.

A problem report sent from the platform is stored in Canada, but the alert that reaches our support mailbox may include the screenshot, and that mailbox is hosted by Google outside Canada. If you prefer, leave the screenshot out of the report.

To fix a reported problem, our team sends open reports to an AI coding assistant that runs in Anthropic's cloud (United States). It reads them from our servers in Canada through an access key that only lets it see open reports and record its proposed fix: the page, your message, your role, your browser and screen size, and the screenshot if you sent one. It never receives your name, email, firm or client, and no copy is kept on anyone's computer. The assistant cannot close a report; a person does, after reviewing the fix.

Email you send to privacy@, legal@ or security@riratrace.com passes through Cloudflare, which forwards it to the same support mailbox without keeping a copy. Please do not include more personal information in such an email than your request needs.

We do not transfer client records outside Canada for any other purpose. If a court or authority outside Canada were to demand data from a provider there, Canadian law could not prevent it; this is the main reason the AI provider is opt-in per client.

8. How long we keep it

• Client records, deliverables and messages about a claim: for the CRA's review window for the claim, normally six years after the end of the tax year the claim relates to, unless the client asks us to delete earlier once the claim is filed. Clients can export their workspace at any time and on leaving.
• Unfinished new-client drafts (the company details and client lead typed so far): visible only to the staff member who started them, and deleted when the client is created or they discard the draft.
• Records from a connected service: while the client keeps them. After disconnecting a service (for example GitHub), the client's lead can remove everything it brought in on Data sources: its documents, activity records and other collected pieces, and the drafts built from them. A document the firm confirmed as evidence, or that someone linked to a checklist item, is kept, hidden, so the claim's citations hold; the removal and its counts are recorded in the audit ledger. For connected books, removal deletes the accounts, classes, locations, totals and supplier lines read from them; a cost a person confirmed into the claim stays, because the claim relies on it. Disconnecting the books deletes the access Intuit granted at once.
• Files a client removes: on Documents, the client's lead can remove a file the company sent, as long as the firm has not confirmed it as evidence and the claim is not yet approved. The file is taken out of the claim at once and is no longer used; the firm still sees it, and until the claim is approved the lead can put it back. Its stored versions are kept, hidden, for the claim's retention period above, because an earlier citation or review may point at them, and the removal (and any return) is recorded in the audit ledger. Replacing a file adds a new version and keeps the earlier one for the same reason.
• Files the privacy check refuses (holding a Social Insurance, ID or card number): deleted from the platform at once and from our backups within 30 days. Only a record that a file was refused remains: its file name and when it was refused, shown to the person who sent it and to the client's lead, accountant and consultants so it can be sent again without the numbers, and the kind and number of identifiers found, never the identifiers.
• Email sent to an evidence address: the stored copy is deleted as soon as the email is added, refused or dropped; an email held for the client's lead is kept at most 30 days, then deleted. What was added is kept like any other client record. For each email received we keep a short record (sender, subject, date, number of attachments, and whether it was added, held, dropped or refused) for as long as the client's records.
• Deleted files: removed from the platform immediately and from our backups within 30 days.
• Account information: for as long as you have access, then kept in the audit ledger (name, role, what you did) for as long as the related client records are kept.
• Information from Google sign-in: while you have the account, then deleted within 30 days (backups within a further 30 days); see section 3.
• Problem reports and screenshots: 90 days.
• Weekly check-ins: the answers are client records (kept as above). The person's check-in email address and day are kept while the client's workspace is, and are removed with the person; a record of each week's check-in (what it asked, as counts and titles, and whether it was answered) is kept with the client's records.
• In-app notifications: 180 days.
• Server logs: 90 days unless needed for a security investigation.
• Demo requests and correspondence: until the conversation has ended and for a reasonable time after, normally no more than two years.

9. How we protect it

Our Security page describes our controls in detail. In short: encryption in transit and at rest; every record tagged with the client it belongs to and every query scoped to that client; invitation-only accounts with role-based permissions; an audit ledger; daily backups in Canada; and a written incident process. Our team sees only the clients it works on.

10. Your rights

You can ask us:

• what personal information we hold about you and to receive a copy;
• to correct information that is inaccurate or incomplete;
• to delete your information, or to withdraw consent, subject to what we must keep for the claim and by law;
• for Quebec residents, to receive your information in a structured, commonly used format (portability), and to know whether a decision was made about you by automated means (none are: a person reviews every output);
• to complain. We will answer within 30 days. If you are not satisfied, you can contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

If your information is in a client's records (for example you are an employee of one of our clients), please ask your employer first; we will help them answer. We will verify your identity before acting on a request.

11. Cookies and analytics

The platform sets only the cookies it needs to keep you signed in and to remember your display preferences. The marketing site sets no cookies of its own. We do not use third-party advertising or behavioural-analytics trackers.

Page counts (Umami)

To see which pages are used and where the platform needs work, riratrace.com and app.riratrace.com count page visits with Umami, which we run ourselves on our server in Canada (analytics.asurnd.ca). No outside company receives this information, except that our team may ask an AI assistant (Anthropic, United States) to read the counts for us. It sees totals, page addresses and anonymous visit records (browser, device, country, pages viewed), never names, emails or client data. It records the page address (without anything after a ? or #), the site you came from, your browser, operating system, device type, screen size, language and country. It sets no cookies, does not store your IP address, and counts a visit with a code that changes every day, so it cannot follow you from one day to the next or tell us who you are. If your browser sends Do Not Track, you are not counted. We keep the counts for as long as they are useful, and no more than two years.

Emails the platform sends (invitations, notifications) tell us whether they were opened and which links were clicked, so we can see whether an invitation reached you. Sign-in and password-reset links, and the links in weekly check-in emails, are never tracked. Most email apps let you block this by not loading remote images.

Notification emails name the client, say what changed (for example, that a checklist item was returned or a month of the project log was submitted) and link to the platform. They never include project names, file names or anything people wrote. Each person chooses on the platform's Notifications page whether they get these emails soon after something happens, once a day, or never.

Our pages load fonts from Google Fonts, which means your browser sends its request (including your IP address) to Google. No other third-party script runs on the platform; the page-count script above is our own.

12. Breaches

If a breach of security safeguards creates a real risk of significant harm to anyone, we will notify the affected clients and individuals, and the Privacy Commissioner of Canada (and, where applicable, the Commission d'accès à l'information du Québec), as soon as feasible, and we will keep a record of every breach as the law requires. Clients are notified of any incident affecting their workspace whether or not that threshold is met.

13. Changes and contact

We may update this policy. The date at the top shows the current version; material changes are announced to clients and to platform users before they take effect.

Our privacy officer is responsible for this policy and for answering requests under it:

Privacy Officer, RiraTrace
Email: privacy@riratrace.com