This Privacy Policy explains how Ashbridge Tax P.C. collects, uses, stores and protects personal information through our public website, quote and contact forms, checkout process, client portal, and related tax, accounting and bookkeeping services.
1. Who is responsible
Ashbridge Tax P.C. is responsible for personal information under its control.
Our designated privacy officer is:
Privacy Officer, Ashbridge Tax P.C.
Email: info@ashbridgecpa.ca
Phone: 647-215-4407
Mail: 81 Bay St., Toronto, ON M5J 0E7
Questions, access requests, correction requests and privacy complaints can be sent to the Privacy Officer.
2. Privacy law
Ashbridge is based in Ontario. We handle personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and other privacy laws that apply to the information or service involved.
3. Information we collect
Public website quote
Our online quote may collect:
- your name, email address and phone number;
- information about the tax, accounting, bookkeeping, payroll or incorporation services you need;
- corporation names and business information;
- information about a prior accountant where relevant;
- referral information; and
- optional information you choose to provide.
Starting a quote creates a lead record containing your name, email address, phone number and your quote answers. We use this lead record to contact you by email, text or phone about your file.
The public quote is intended for scoping and pricing. Do not upload tax documents through the public quote unless the page specifically provides a secure upload function for that purpose.
Contact forms and communications
If you contact us, we may collect your name, email address, phone number, message and other information you choose to provide.
Checkout and payments
Stripe processes online payments. Stripe may collect billing and payment information directly. Ashbridge does not receive or store your full payment-card number.
Client portal and engagement information
Once you become a client, we may collect information needed to perform the services you have engaged us for, including:
- contact information;
- corporation, ownership, director and officer information;
- share structure and related corporate information;
- tax residency and related-party information;
- bookkeeping and accounting records;
- payroll information;
- answers to onboarding and year-end questions;
- uploaded documents;
- information concerning shareholders, employees, family members or other people where relevant to the engagement; and
- information needed for corporate tax, personal tax, HST/GST, payroll, bookkeeping, compilation work, incorporation or related services.
Depending on the engagement, this information may include sensitive identifiers such as social insurance numbers, dates of birth or banking information.
QuickBooks Online
If you choose to connect QuickBooks Online, Ashbridge reads accounting information through Intuit's API after you authorize the connection.
The portal integration is configured for read access for the Ashbridge workflow. Ashbridge does not use the integration to post or make changes to your QuickBooks Online books.
You can revoke the connection through the portal where that function is available or through the Apps area of your QuickBooks Online company. Revoking access stops future access through the connection but does not require Ashbridge to delete records we are legally or professionally required to retain.
Canada Revenue Agency
Where you authorize Ashbridge as your representative, we may obtain information from the Canada Revenue Agency about your accounts, filings, balances and other matters relevant to the engagement.
Technical information
Our systems may record information needed to operate and secure the website and portal, such as session activity, timestamps, request information, system logs and error reports.
When you sign an engagement letter online, we record signing evidence including the date and time and a salted, one-way hash of the IP address the signature was submitted from, so it cannot be reversed back into the original address. We do not store your raw IP address as part of that evidence.
4. Sensitive information
Ashbridge uses additional safeguards for sensitive information such as social insurance numbers, dates of birth and banking details.
Our systems and procedures are designed to:
- restrict access to people who need the information for the engagement;
- use encryption and access controls appropriate to the systems involved;
- mask sensitive values where practical when displayed in the portal;
- keep sensitive identifiers out of routine email and text-message content; and
- keep sensitive identifiers out of AI-assisted workflows unless a future use is specifically assessed, disclosed and authorized.
Ashbridge does not intentionally send social insurance numbers, banking details or other sensitive identifiers that are not needed for the task to the AI service described below.
5. Why we use personal information
We use personal information to:
- provide quotes and respond to inquiries;
- identify and communicate with clients and authorized users;
- open, administer and complete engagements;
- prepare tax returns, filings, bookkeeping, payroll, compilation work and other agreed services;
- deal with the CRA where authorized;
- understand what information is still needed from a client;
- process payments;
- provide and secure the client portal;
- maintain records required by law or professional obligations;
- respond to access, correction, complaint, audit, dispute or regulatory matters;
- improve the operation of our public website and service workflow; and
- otherwise carry out purposes a reasonable person would consider appropriate in the circumstances.
Ashbridge does not sell personal information and does not share one client's information with another client.
We do not use client tax information for third-party advertising.
6. Consent and choices
Ashbridge obtains consent through the steps by which you request a quote, purchase a service, accept an engagement, accept the portal terms, provide information, and authorize specific connections.
Sensitive or separately authorized activities use express authorization where appropriate.
In particular:
- QuickBooks Online access requires your separate Intuit authorization;
- CRA representative access requires the applicable CRA authorization; and
- portal users accept the applicable portal terms and privacy notice.
You may withdraw consent for future use or access by contacting us, subject to legal and contractual restrictions, professional obligations and reasonable notice.
Withdrawing consent may mean Ashbridge can no longer complete some or all of an engagement. Withdrawal does not require us to destroy information we are required or permitted to retain.
7. Service providers and other disclosures
Ashbridge uses technology providers to operate the website, quote flow, portal and engagement workflow. Depending on the service, these may include:
| Provider | Purpose / information involved |
|---|---|
| Intuit / QuickBooks Online | Accounting information accessed after the client authorizes the connection |
| Google Workspace | Client documents and business communications |
| Supabase | Portal database and client-record infrastructure |
| Netlify | Portal hosting and technical requests |
| Upstash | Public website quote-storage infrastructure where used |
| Resend | Transactional email and email delivery |
| Twilio | Text-message delivery where enabled |
| Stripe | Payment processing |
| Sentry | Technical error monitoring |
| Anthropic API | AI-assisted processing described in section 8 |
| Google Analytics / Google Tag Manager | Public-website analytics described in section 15 |
We may also disclose information:
- to the CRA where authorized or required;
- to a successor accountant or other adviser with appropriate authority;
- to professional advisers, insurers or regulators where reasonably necessary;
- where required by law, court order or lawful regulatory process; or
- as otherwise permitted or required by applicable law.
Ashbridge is not acting on behalf of Intuit, Google, Anthropic or another technology provider when providing Ashbridge services.
Intuit and QuickBooks are registered trademarks of Intuit Inc. Used with permission.
8. AI-assisted processing
Ashbridge may use the Anthropic API to assist with tasks such as reviewing bookkeeping information and drafting year-end questions.
We limit AI-assisted processing to information reasonably useful for the task and design the workflow to exclude sensitive identifiers that are not needed.
AI-assisted output is not treated as final professional advice by itself. Ashbridge personnel review AI-assisted work where professional judgment is required before it is relied on for client work or filing decisions.
Anthropic states that inputs and outputs from its commercial products, including its API, are not used to train its models by default. Anthropic handles API information under its commercial terms and privacy practices.
Ashbridge may change or add technology providers over time. If a change materially affects how personal information is handled, we will update this policy and provide additional notice where required.
9. Where information is stored and processed
Ashbridge's primary client-portal records and client-document storage are configured to be stored in Canada.
Some service providers, communications systems, analytics systems and public-website infrastructure may process or store limited information outside Canada. For example, the public website quote system may use infrastructure hosted outside Canada, and email or analytics providers may process information through systems in other countries.
Information processed outside Canada may be subject to the laws of the country where it is processed, including lawful access by courts, law-enforcement agencies or other authorities.
10. How we protect information
Ashbridge uses administrative, technical and organizational safeguards appropriate to the sensitivity of the information.
These safeguards include, as applicable:
- encrypted connections;
- restricted access to client information;
- role-appropriate internal access;
- protected client-document and database systems;
- masking or separation of sensitive information where appropriate;
- single-use or time-limited access links in the portal;
- monitoring and error logging intended to identify faults; and
- backup and recovery controls provided through our systems and service providers.
No online system can be guaranteed completely secure.
If you believe a portal link, account, message or document has been accessed by the wrong person, contact info@ashbridgecpa.ca promptly so we can investigate and take reasonable protective steps.
11. Accuracy
We rely on clients and authorized users to provide accurate and complete information.
Please keep your contact, company and engagement information current. If you identify an error in personal information held by Ashbridge, contact us and we will make an appropriate correction.
12. How long we keep information
Quotes that do not become engagements
Where a public website quote does not become an engagement, Ashbridge generally deletes it from the firm's quote system 24 months after it was created, subject to legitimate legal, security or dispute-related reasons to keep it longer.
Client and engagement records
Client and engagement records are generally retained for seven years after the later of the completion of the engagement or the end of the last tax year to which the records relate.
Some information may be retained longer where appropriate or required, including where:
- a tax law requires a longer period;
- a return was filed late;
- an audit, objection, appeal, dispute, complaint or investigation remains open;
- a regulator or court requires retention;
- the information forms part of corporate, ownership or other historical records that remain relevant; or
- professional obligations reasonably require a longer period.
When information is no longer required for an identified purpose and no retention obligation applies, Ashbridge may securely delete or de-identify it.
Disconnecting QuickBooks Online stops future access through the connection. It does not delete information already incorporated into Ashbridge's engagement records where retention is required or appropriate.
13. Access and correction rights
Subject to PIPEDA and other applicable law, you may ask Ashbridge to:
- tell you what personal information we hold about you;
- explain how it has been used and disclosed;
- provide access to that personal information;
- correct information that is inaccurate or incomplete; or
- address a concern about our privacy practices.
Send requests to:
Privacy Officer
info@ashbridgecpa.ca
81 Bay St., Toronto, ON M5J 0E7
We may need to verify your identity before responding.
We normally respond to a formal access request within 30 days, subject to any extension or exception permitted by law.
Access may be limited where the law permits or requires it, including where disclosure would reveal another person's personal information, legally privileged information, confidential information that cannot reasonably be severed, or other information protected by law.
14. Firm working papers
Ashbridge may create working papers, internal analyses, review notes and other professional records when performing an engagement.
The ownership or professional status of a working paper does not remove any right an individual may have under PIPEDA to access personal information about themselves that Ashbridge holds.
Where an access request involves firm working papers, Ashbridge will provide access to personal information as required by applicable law, subject to lawful exceptions, redaction and the protection of information concerning other people or confidential firm material.
15. Website analytics and tracking
Ashbridge uses Google Tag Manager and Google Analytics 4 on public website pages to understand general website usage, navigation and conversion activity.
These tools may collect general technical and usage information such as:
- pages viewed;
- approximate location;
- device and browser information;
- referral source; and
- interactions with public website pages.
Ashbridge does not intentionally send client tax information, uploaded tax documents, names, email addresses, phone numbers, SINs, tax IDs, banking information or free-text client answers to Google Analytics.
Ashbridge does not run ordinary Google Analytics page tracking on private client-portal, engagement or onboarding pages.
Limited server-side milestone events may be used to measure whether key workflow steps were completed. These events are designed not to include direct client identifiers or confidential tax content.
The client portal does not use third-party advertising analytics or advertising pixels.
Ashbridge does not use Microsoft Clarity at this time.
16. Children and minors
The client portal is intended for adults. Ashbridge does not create portal accounts for minors.
An adult client or authorized representative may provide information about a minor where that information is legitimately required for a tax, payroll, corporate or other engagement.
The person providing that information is responsible for having the authority to provide it. Ashbridge limits collection to information reasonably required for the engagement.
17. Privacy breaches
Ashbridge investigates suspected privacy or security incidents.
Where PIPEDA requires it, Ashbridge will report a breach to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible. Ashbridge also keeps breach records as required by law.
18. Changes to this policy
Ashbridge may update this Privacy Policy as our services, technology or legal obligations change.
The current version will be posted at:
https://ashbridgecpa.ca/privacy.html
The "Last updated" date will identify the current version.
If a change materially affects how we collect, use or disclose personal information, we will provide additional notice or obtain new consent where required.
19. Complaints and contact
Please contact Ashbridge's Privacy Officer first if you have a privacy question or complaint:
Privacy Officer, Ashbridge Tax P.C.
Email: info@ashbridgecpa.ca
Phone: 647-215-4407
Mail: 81 Bay St., Toronto, ON M5J 0E7
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada through its website at https://www.priv.gc.ca/.
You may also contact CPA Ontario concerning the conduct of a CPA Ontario member or firm where applicable.