CC Compliance Calendar
Privacy

Privacy policy

Last updated: 2026-10-04. Aligned with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) Schedule 1.

1. Who we are

Compliance Calendar is a corporate filing-assistance service operated by 1001726270 ONTARIO INC., based in Toronto, Ontario, Canada. Our Privacy Officer (per PIPEDA Principle 1) is reachable at caleb@compliancecalendar.ca.
1001726270 ONTARIO INC., 5 Defries St, Toronto ON M5A 0W7, Canada.

2. What personal information we collect

We collect only what is needed to provide the service. This includes:

  • Corporation identifiers: corporation number, Business Identification Number (BIN), Ontario corporation number, Company Key or Corporation Key (where provided to enable filing).
  • Contact information: your name, email address, and phone number (optional).
  • Filing details you provide: director information, registered office address, or other details required for the specific return you ordered.
  • Individuals with significant control (ISC), for a federal annual return: Corporations Canada requires the corporation's ISC information to be filed with its annual return. For each individual with significant control (up to 5 per filing) we ask for their full legal name, date of birth, country or countries of citizenship, country or countries of tax residence, residential address, an optional address for service, the dates the person became or stopped being an individual with significant control, and a description of their control. If the corporation has no such individual, or cannot identify one, you give the statement the law requires instead. These individuals may not be our customers, and you confirm that you are allowed to give us their details. We ask for these details only after payment, on the secure filing form at api.compliancecalendar.ca; we never ask for them on the order form or by email.
  • Billing metadata: payment processing is handled by Stripe; we receive only non-sensitive metadata (transaction status, last four digits of card, Stripe session ID). We do not store full card numbers.
  • Technical data: IP address, browser user-agent, and referral source, collected automatically when you visit the site. We use Cloudflare Web Analytics (a cookieless, privacy-first pageview beacon — no cookies, no cross-site tracking) plus server-side visit logging on specific API endpoints. We do not use advertising trackers or fingerprinting.
  • Cold-outreach source: for corporations we contact proactively, the corporation name, number, and publicly-listed contact address come from the Corporations Canada open dataset, a public government registry. We do not purchase or trade personal data lists.
  • Business contacts at accounting and bookkeeping firms: what we collect from your firm's own website, why, and for how long is set out in section 9.

3. Why we collect it (PIPEDA Principle 2 — purposes)

  • To prepare and submit the corporate filing you have authorized us to make.
  • To send you receipts, filing confirmations, and the government confirmation number.
  • For a federal annual return, to file the ISC information (section 2) with Corporations Canada together with the annual return, as the Canada Business Corporations Act requires (the s. 21.1 register, filed under s. 21.21). Corporations Canada publishes each individual's name, address for service (or the residential address if no address for service is given), the dates they became or stopped being an individual with significant control, and the description of their control. It does not publish the date of birth, citizenship, tax residence, or the residential address when an address for service is given; law enforcement and FINTRAC can see this information.
  • To send renewal reminders if you have opted in or have an active service relationship with us.
  • To respond to your inquiries and support requests.
  • To meet our legal record-keeping obligations (e.g., transaction records).
  • To send cold-outreach email to corporations whose upcoming compliance deadlines we have identified from the public Corporations Canada registry (CASL implied consent — see section 9).

4. Consent (PIPEDA Principle 3)

For customers: you provide express consent at intake by submitting the order form. For cold-outreach recipients: we rely on CASL implied consent under section 10(9)(b) of the Canada Anti-Spam Legislation — the recipient's electronic address is conspicuously published and the message is relevant to the corporation's business role (compliance filing). You may withdraw consent at any time by emailing the Privacy Officer or by replying "Unsubscribe" to any email we send. Consent to receive service-critical communications (e.g., your filing confirmation) cannot be withdrawn without cancelling your service.

For ISC details (section 2), the secure filing form asks for a separate consent, which you must tick before the details can be submitted: “I am allowed to give these people's date of birth, citizenship, tax residence, and addresses so you can file them with Corporations Canada. You will not email them or show them to support, and you will delete them 15 days after the filing is confirmed.”

5. Where your data is stored

Your personal information is stored on infrastructure operated in Canada or by Canadian-resident operators. Exceptions for operators that may process data outside Canada are listed in section 6 (hosted AI providers and Telegram for operator alerts). When you reply to one of our emails, the text of your reply may be sent to a cloud-hosted AI service (currently Cerebras and/or OpenRouter; NVIDIA NIM remains a supported alternate path) solely so we can classify, extract filing facts, or draft a proposed reply for an operator to review. We apply automated secret redaction before that text leaves our systems (see section 8) — this is a best-effort scrub of key-shaped tokens and labelled secrets, not a cryptographic guarantee that every possible credential string is removed. Apart from the processors listed below, we do not transfer personal data to servers outside Canada.

6. Processors and third-party sharing (PIPEDA Principle 5)

We share information with the following processors strictly to deliver the service:

  • Stripe — payment processing.
  • Resend — transactional email delivery (filing confirmations, receipts).
  • Zoho Mail — outreach and reply-handling mailbox.
  • Cerebras / OpenRouter / NVIDIA NIM (hosted AI) — when you reply to one of our emails, the reply text may be processed by a cloud-hosted AI model so we can classify and route your message, extract structured filing answers, or draft a proposed operator reply. Configuration may use Cerebras, OpenRouter, or NVIDIA NIM as OpenAI-compatible paths. Before any of that text is sent, we run automated secret redaction intended to remove Corporation Keys, access codes, passwords, bearer tokens, and similar labelled secrets. The redaction is best-effort regex scrubbing, not a guarantee against every possible secret form.
  • Telegram — operator (staff) alerts only. When a customer or prospect replies and auto-processing is offline, fails, or needs human approval of a drafted reply, we may send a short operator preview over Telegram that includes the sender address/subject and a truncated excerpt of the (secret-redacted) reply text and/or the proposed draft. Telegram is not used for customer-facing messages.
  • Cloudflare — DNS, and the network that carries traffic between your browser and our API server (api.compliancecalendar.ca), including the secure filing form and Stripe's payment notifications, and Web Analytics (cookieless pageview beacon).
  • Vercel — hosts the website (compliancecalendar.ca). Our own server runs the API and the database.
  • Government portals — Corporations Canada, as required to file the returns you authorize.

We never send ISC details you give on the secure filing form (section 2) to Stripe, Resend, Zoho Mail, Telegram or any hosted AI provider. Apart from Cloudflare carrying the secure filing form to our server, the only place we send them is Corporations Canada, when we file.

We do not sell, rent, or share your personal information with any third party for marketing or any purpose other than delivering the service.

7. Retention (PIPEDA Principle 5)

  • Filing records and transaction data: 7 years, to satisfy Canadian tax record-retention requirements.
  • Cold-outreach marketing data (email addresses of corporations we contacted): retained until unsubscribe, plus 60 days for suppression-list hygiene, then deleted.
  • ISC details (section 2): encrypted at rest. They are deleted 15 days after Corporations Canada confirms the filing, counted from the day we record its confirmation number or the day the filing is marked confirmed, whichever comes first. They are deleted within an hour if your order is refunded or will not be filed. If a paid order has still not been filed 60 days after you gave us the details, they are not deleted automatically: the order is flagged for a person on our team to review. Copies of our database kept on our server for backups are cleared on the same schedule. The corporation's own ISC register and Corporations Canada keep their copies under their own rules (Canada Business Corporations Act s. 21.1(5) and s. 21.21(3)). Please do not email these details to us; we never ask for them by email. If you email them anyway, we do not use them for your filing, and the email is handled like any other email you send us (sections 5, 6 and 8): it stays in our mailbox and in our store of replies until you ask the Privacy Officer to delete it.
  • Corporation Keys and Company Keys provided to us to perform a filing: requested only after payment, on the secure filing form, and encrypted at rest. A key is deleted as soon as we record your return as filed, within an hour if your order is refunded or will not be filed, and in any case 15 days after the filing is confirmed. Copies of our database kept on our server for backups are cleared on the same schedule. We do not keep keys for future filings.
  • Checkout: Stripe keeps the email address you enter at checkout for its own record of the checkout session (see Stripe's privacy policy); from the order form we send Stripe only that email address and the corporation number, with our order reference, the product and the price.

8. Safeguards (PIPEDA Principle 7)

Data is encrypted in transit (TLS) and at rest. Operator access to government portals uses multi-factor authentication. Corporation Keys and Company Keys provided by customers through our intake form are encrypted at rest in a separate table and are never stored in plain text alongside the rest of your order. Our website cannot read them. Our API server holds the decryption key and decrypts a Corporation Key only for our filer, through a filer endpoint that requires the filer's secret access token; no customer-facing page or route returns it. ISC details you give on the secure filing form are encrypted the same way and decrypted only for our filer at filing time, through the same token-protected access. They are never put in emails, reminders, staff alerts, the support desk, AI tools or logs, and our software filters its own output to enforce this. Separately, when reply text is forwarded to a hosted AI provider or included in an operator Telegram preview (section 6), we apply automated secret redaction first: labelled keys/passwords/tokens and Corporation-Key-shaped mixed alphanumeric tokens are replaced with a redaction marker before the payload is built. That scrub is best-effort (regex-based) and is what our regression tests enforce — we do not claim it catches every imaginable secret format. Corporation Keys supplied for filing are permanently deleted once your filing is complete (see section 7). Only personnel who need a credential to perform your filing can access the encrypted store.

9. Cold-outreach and CASL

If you received an email from us without previously contacting us, it is because your corporation's compliance deadline appeared in the public Corporations Canada open dataset and the email address was publicly listed in connection with the corporation. Every such message identifies us as the sender (Compliance Calendar, operated by 1001726270 ONTARIO INC.), includes our mailing address (1001726270 ONTARIO INC., 5 Defries St, Toronto ON M5A 0W7), and provides a functional unsubscribe mechanism. Unsubscribe requests are honored within 10 business days and your address is added to our permanent suppression list.

Accounting and bookkeeping firms: if we emailed the contact address your firm publishes on its own website, the paragraph above does not describe you; this one does. We collect your firm's name, that published email address, the web address of the page where it appears, the date we read that page, and a short excerpt of the page, which may include a name, phone number or street address the page itself shows. We take this only from your firm's own public website. We do not buy lists, and we do not take firm addresses from the Corporations Canada dataset. We use it to send your firm one email about our federal annual return filing service for corporations your firm works with, with no follow-up unless you reply, and to keep a record of why we were allowed to send it. We rely on CASL implied consent under section 10(9)(b): the address is conspicuously published, the page does not say you refuse unsolicited commercial email, and the message is relevant to your firm's business. We do not ask you for your clients' details; a client who chooses to use the service gives us their own details on our order form. We keep this record for three years after the email is sent, then delete it; if your firm becomes a customer, section 7 applies instead. To opt out, use the unsubscribe link in the email, reply "Unsubscribe", or email the Privacy Officer. We act on it without delay and within 10 business days, and we then keep only the email address, on our suppression list, so that we do not email it again. Our emails to firms carry the same sender name, mailing address and unsubscribe link described above. The record is seen only by the people who run Compliance Calendar, the AI tools they use to read the same public pages and prepare the email, and the email services listed in section 6 that carry our email and hold replies. If you reply, your reply is handled as described in sections 5, 6 and 8. We do not sell your firm's details or share them with anyone else.

10. Your rights — access, correction, and deletion (PIPEDA Principles 9–10)

You have the right to request access to, correction of, or deletion of the personal information we hold about you. Email the Privacy Officer at caleb@compliancecalendar.ca. We will respond within 30 days. We may need to verify your identity before processing a request, and some information may be retained to meet our legal obligations. Individuals with significant control whose details were given to us for a filing (section 2), and who are not our customers, can ask the Privacy Officer for access or deletion in the same way.

11. Complaints

Contact our Privacy Officer first. If your concern is not resolved, you may file a complaint with the Office of the Privacy Commissioner of Canada: 1-800-282-1376 / priv.gc.ca.