Privacy Policy

1. Introduction

MyCPACRM ("we", "us", "our") is a client relationship management platform designed for accounting and tax filing firms across the United States and Canada. We are committed to protecting the personal information entrusted to us by our users and their clients in accordance with the privacy laws of both jurisdictions.

Canadian users are protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation (including Alberta's PIPA, BC's PIPA, and Quebec's Law 25). US users are protected under the California Consumer Privacy Act (CCPA / CPRA), the Virginia Consumer Data Protection Act (VCDPA) and similar state laws, the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule for financial institutions, and IRS Publication 4557 (Safeguarding Taxpayer Data).

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights regarding your data — applying these protections regardless of which side of the border you operate from.

2. Accountability

MyCPACRM is accountable for all personal information under its control. Our designated Privacy Officer can be reached at:

Each accounting firm using MyCPACRM is a separate data controller for their own client data. MyCPACRM acts as a data processor on behalf of these firms.

3. Purposes of Collection

We collect and use personal information only for the following identified purposes:

We do not use personal information for purposes other than those identified above without obtaining further consent.

3b. Cookies and Website Tracking

This section applies to our public marketing website (www.mycpacrm.com) and describes cookies and similar technologies (pixels, tags, local storage) placed on your device when you browse it. It is separate from the client and tax data described in Section 3, and the information collected here is not linked to any client's tax file.

What is on by default depends on where you are. In Ontario, the rest of Canada (outside Quebec) and the United States, Google Analytics and Google Ads measurement cookies are on from your first visit, so we can see which pages are useful and whether our ads lead to a contact or demo request. Retargeting is not: the AdRoll (NextRoll) advertising pixel is loaded, and ads are personalized, only after you press Accept on the consent banner. In Quebec, the European Union, the United Kingdom and Switzerland, no analytics or advertising cookies are set until you press Accept; until then Google Analytics runs in Google's consent mode and sends only basic signals, such as that a page was viewed or a form was sent, without setting cookies or storing an identifier on your device. Wherever you are, pressing Decline turns all analytics and advertising cookies off. If your browser sends a Global Privacy Control signal, we keep advertising cookies off and the AdRoll pixel unloaded even if you press Accept. You can change your answer at any time through the Cookie Preferences link in the footer of every page.

The MyCPACRM application itself (the logged-in product at app.mycpacrm.com and the client portal) carries no advertising or analytics trackers. It sets only the essential, HttpOnly session cookies needed to keep you signed in, as described in Section 8.

These technologies collect online identifiers — a cookie ID, IP address, browser and device type, referring URL, and the pages visited on this site. We do not use them to collect names, SSN, SIN, EIN, BN, or any tax information, and we do not upload client lists to advertising platforms. The one exception is the email address you type into our contact or demo form: unless you have declined (or are in a region where you have not yet accepted), Google's tag turns it into a one-way hashed code before sending it to Google Ads, which uses it only to match your request to the ad click that led to it.

Your Choices

You can opt out of analytics and advertising cookies at any time. Strictly necessary cookies cannot be disabled.

• Cookie Preferences (this site): Use the Cookie Preferences link in the footer of any page to review or change your choice. Declining turns off all analytics and advertising cookies and keeps the AdRoll pixel unloaded; Google Analytics then only sends the cookieless signals described above.
• Browser controls: Every major browser lets you block or delete cookies, and most offer a private browsing mode. Blocking cookies may affect how parts of this site work.
• Google Analytics: Install the Google Analytics Opt-out Browser Add-on.
• AdRoll / NextRoll: Opt out through the NextRoll Privacy Notice, which describes the data NextRoll processes as an independent controller and the choices available to you.
• Industry opt-out tools: DAA WebChoices and the NAI opt-out page (United States), or AdChoices Canada.
• Global Privacy Control: Where required by law, we honour an opt-out preference signal (such as GPC) transmitted by your browser as a request to stop sharing your information for cross-context behavioral advertising.
• Mobile devices: Use "Limit Ad Tracking" (iOS) or "Opt out of Ads Personalization" (Android) in your device settings.

Opting out stops interest-based targeting; it does not stop you from seeing advertisements generally. Because opt-outs are themselves stored in a cookie, you may need to repeat them if you clear your cookies, change browsers, or use a different device. Questions about tracking on this site can be sent to privacy@mycpacrm.com.

4. Consent

We obtain meaningful consent before or at the time of collecting personal information. Consent is recorded in the system with full audit trail including date, method, and type.

• Express consent is obtained for sensitive information such as SSN, SIN, EIN, BN, and financial data
• Implied consent may apply when a client engages the accounting firm for tax preparation services
• Clients may withdraw consent at any time by contacting their accounting firm or through the client portal. Withdrawal does not affect the legality of processing performed before withdrawal.
• Note: Certain data must be retained regardless of consent withdrawal to comply with IRS record-keeping requirements (typically 3 years general, 6 years for substantial understatement, 7 years for bad debt / worthless securities) and CRA record-keeping requirements (6 years from the end of the tax year)

5. Limiting Collection

We collect only the personal information that is necessary for the purposes identified in Section 3. We do not collect information indiscriminately. SSN, EIN, SIN, and BN are collected solely because they are required by law for tax filing — with the Internal Revenue Service (IRS) for US clients and the Canada Revenue Agency (CRA) for Canadian clients.

6. Limiting Use, Disclosure, and Retention

Use and Disclosure

Personal information is used only for the purposes for which it was collected. We do not sell, rent, or trade personal information. Information may be disclosed only:

• To the Internal Revenue Service (US) or Canada Revenue Agency (Canada) as required for tax filing
• To state tax agencies (US) or provincial tax authorities (Canada, e.g. Revenu Québec) as required for jurisdictional filings
• To the client's accounting firm staff who need it to provide services
• When required by law, regulation, court order, or subpoena
• With the individual's explicit consent

Retention

Personal information is retained only as long as necessary to fulfill the purposes for which it was collected, subject to legal requirements:

After the retention period expires, personal information is securely deleted or anonymized.

7. Accuracy

We take reasonable steps to ensure that personal information is accurate, complete, and up-to-date:

• Clients can view and update their information through the client portal
• Accounting firm staff can correct client records at any time
• Clients are encouraged to notify their accountant of any changes to their personal information

8. Safeguards

We protect personal information with security safeguards appropriate to the sensitivity of the data:

• Encryption at rest: SIN, Business Numbers, and other sensitive identifiers are encrypted using industry-standard encryption before storage
• Encryption in transit: All data is transmitted over HTTPS/TLS
• Access control: Role-based access with per-user custom permissions
• Authentication: Strong password policy (12+ characters, complexity requirements), optional two-factor authentication (OTP), HttpOnly secure session cookies
• Account protection: Automatic account lockout after failed login attempts, rate limiting on authentication endpoints
• Audit logging: All access to sensitive data is logged, including who accessed what and when
• Data isolation: Each accounting firm's data is strictly separated and protected
• File validation: Uploaded documents are validated for type and content integrity
• Admin verification: Administrative actions (password changes, user management) require re-authentication

9. Openness

This Privacy Policy is readily available on our website, login pages, client portal, and consent forms. We will notify users of any material changes to this policy.

10. Individual Access

Individuals have the right to:

• Access all personal information we hold about them. Requests can be made through the client portal or by contacting the accounting firm. Administrators can generate a complete data export in JSON format.
• Correct any inaccurate or incomplete personal information
• Request deletion of personal information, subject to legal retention requirements (IRS minimum 3 years and up to 7; CRA minimum 6 years for tax records)
• Withdraw consent at any time, with the understanding that this may affect the firm's ability to provide services

Access requests will be responded to within 30 days, as required by PIPEDA. CCPA / CPRA verifiable consumer requests for California residents will be responded to within 45 days (extendable by an additional 45 days when reasonably necessary, with notice).

10b. US-Specific Privacy Rights

In addition to the access, correction, deletion, and consent-withdrawal rights described in Section 10, US users have the following rights under applicable state law:

• Right to Know (CCPA / CPRA, VCDPA, similar state laws): What categories and specific pieces of personal information we have collected, the sources, the business purposes, and any third parties with whom it has been shared.
• Right to Opt Out of Sale or Sharing: We do not sell personal information for money, and we never sell or share client or tax data for advertising of any kind. However, the advertising cookies described in Section 3b do constitute "sharing" for cross-context behavioral advertising as the CPRA defines that term. This applies only to browsing activity on our public marketing website. You may opt out at any time using the Cookie Preferences link in the footer, through any of the other methods listed in Section 3b, or by writing to privacy@mycpacrm.com. We also honour opt-out preference signals such as Global Privacy Control (GPC) where required by law.
• Right to Limit Use of Sensitive Personal Information (CPRA): Sensitive identifiers (SSN, EIN, financial account numbers) are used only for the strictly necessary tax-filing purposes described in Section 3.
• Right to Non-Discrimination: We will not deny services, charge different prices, or provide a different level of service because you exercised a privacy right.
• Authorized Agent: California residents may designate an authorized agent to make a request on their behalf. We will require written authorization and proof of identity.

Under the GLBA Safeguards Rule, MyCPACRM maintains administrative, technical, and physical safeguards designed to ensure the security and confidentiality of customer information, protect against anticipated threats, and protect against unauthorized access.

11. Challenging Compliance

Individuals may challenge our compliance with this Privacy Policy by contacting our Privacy Officer:

If you are not satisfied with our response, you have the right to escalate to your jurisdiction's regulator:

• Canada: Office of the Privacy Commissioner of Canada (or applicable provincial commissioner — Alberta OIPC, BC OIPC, Quebec CAI).
• United States: Your state's Attorney General office (e.g. California Office of the Attorney General for CCPA / CPRA matters), or the Federal Trade Commission for GLBA Safeguards-Rule concerns.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to users through the application and updated on this page. The "Last Updated" date at the top of this policy indicates when the most recent revision was made.

Contact Us

If you have any questions about this Privacy Policy:

• Privacy Inquiries: privacy@mycpacrm.com
• General Inquiries: info@mycpacrm.com

Mailing Address (Privacy Officer):