Privacy Policy
What SREDDY collects, where it lives, who touches it, how long we keep it, and how to have it corrected or deleted. Written for the person deciding whether to upload a payroll file.
Who is responsible
Bison & Bird Inc. (carrying on business as SREDDY), #302, 1812 4th St SW, Calgary, Alberta T2S 1W1, is the organisation responsible for the personal information described here. Our privacy officer is Ryan Hopf, reachable at sreddy@teambisonandbird.com or 587-330-5509. This policy is written to meet the Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA).
What we collect
- Account information. When you buy access, Stripe collects your name, email address and the company name you enter, and passes them to us. We store the name, email and company against your account. We never see or store your card number.
- Claim data. To prepare a claim you give SREDDY, through your own AI assistant, the information an SR&ED claim is made of: your corporation’s identifiers, the projects, and the people who did the work — including personal information about your employees and contractors such as names, salaries, bonuses, time allocations and ownership percentages — plus any documents you choose to share and the narratives you write. You decide what to share; SREDDY reads only what your assistant sends it.
- Activity. Each change to a claim is recorded in that claim’s audit trail (what changed, when). We do not keep access logs that record who read what beyond that. Our infrastructure providers keep operational logs (see below).
- Support email. If you write to us, we keep the correspondence.
We do not use cookies or advertising trackers on this site. Page views are counted by Vercel Web Analytics, which sets no cookie, stores no IP address and records nothing that identifies you; the counting script is served from sreddy.ca itself, and the site's typeface is too, so no third-party resource loads when a page is opened.
Why we use it
To provide the service you bought: preparing the claim, producing the filing package, delivering your access key and recovery links, answering support requests, and issuing receipts. To keep the service secure and to detect abuse. To meet our own legal obligations, including tax and accounting record-keeping. We do not sell personal information and we do not use claim data for anything other than your claim.
Where it lives
Your claim data is stored and processed in Canada by SREDDY. The database is in the Canada (Central) region, and the servers that read and write claims and serve the documents also run in Canada (Central). Access to claim data is isolated to your access key. Keys are stored only as cryptographic hashes.
Two things sit outside that statement, and we would rather say so than let you assume otherwise:
- Your AI assistant. The assistant you connect — Claude, ChatGPT, Gemini, Cursor or another — receives everything you share with it and everything SREDDY returns to it. It runs wherever its vendor hosts it, usually in the United States, under that vendor’s privacy terms. SREDDY does not control it. Choose the assistant, and its data settings, with that in mind.
- Payment, email and the website use providers listed below, some of them in the United States. None of them receives claim data.
Who processes it for us
| Provider | What they do | What they see | Where |
|---|---|---|---|
| Supabase | Database | Account and claim data (encrypted at rest) | Canada (Central) |
| Amazon Web Services | Claim servers, document delivery, security logging | Claim data in transit; operational logs without claim contents | Canada (Central) |
| Vercel | This website, checkout, key delivery and recovery; cookieless page-view counting | Account data; anonymous page-view counts; no claim data | United States |
| Stripe | Payment | Name, email, company, payment details | United States |
| Resend (on Amazon SES) | Transactional email | Email address, the message contents (never a key or claim data) | United States |
Each provider is bound by its own contractual and security commitments. We will update this table if a provider changes.
How long we keep it
- Claims and documents: seven years after the end of the tax year they relate to — CRA can ask for supporting records for six years — unless you ask us to delete them sooner.
- Account information: for as long as you have an account, and seven years after your last purchase for tax and accounting records.
- Access keys: hashes only, until revoked; revoked hashes are kept for the audit trail.
- Enquiries that do not become purchases: two years.
Your rights
You can ask what personal information we hold about you or your corporation, ask us to correct it, ask for a copy of your claim data, and ask us to delete your account and claims. Write to the privacy officer at the address above; we will respond within 30 days, and we may need to verify that you are entitled to act for the corporation. Deleting a claim is permanent, so we will confirm before we do it. If you are not satisfied with our answer you can complain to the Office of the Privacy Commissioner of Canada or, in Alberta, the Office of the Information and Privacy Commissioner.
Your employees’ information
The employee and contractor information in a claim is yours to give: you are the organisation that collected it, and you confirm you are entitled to disclose it to us for the purpose of preparing your claim. We process it only for that purpose and only on your instructions. If one of your employees asks us about their information, we will refer them to you.
Security
Claim data is isolated per access key, stored encrypted at rest, and served over encrypted connections only. Keys are shown once and stored as hashes. Access to the database is limited to the service’s own least-privilege role and to our administrators, who use multi-factor authentication. Our infrastructure keeps a tamper-evident audit log of administrative actions. No system is perfectly secure; if we learn of a breach that creates a real risk of significant harm to anyone whose information we hold, we will notify the people affected and the relevant privacy commissioner as the law requires, and we keep a record of every breach.
Quebec
SREDDY prepares the federal claim for corporations anywhere in Canada. If your corporation is in Quebec, Quebec’s private-sector privacy law also applies: our privacy officer is named above, your claim data is stored in Canada, and the transfer to your chosen AI vendor is under your control and your vendor’s terms. Tell us if you need a copy of this policy in French.
Children
SREDDY is a business service and is not directed at anyone under 18.
Changes
The version and effective date are at the top. A material change will be sent to the email address on your account before it takes effect.