Privacy policy

This privacy policy explains how Sapere CPA (“Sapere,” “we,” “us,” “our”) collects, uses, discloses, and protects personal information when you visit sapere.ca, contact us, or use our services. Sapere is a Canadian CPA firm regulated by CPA Ontario (firm number 5046AW) and CPA Alberta, with its head office at 6790 Century Avenue, Suite 301, Mississauga, Ontario, Canada.

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA, federal) and Quebec’s Act to modernize legislative provisions respecting the protection of personal information (Law 25). Clients in other jurisdictions are covered by their applicable provincial privacy legislation.

1. What we collect

Depending on how you interact with us, we may collect the following categories of personal information:

• Contact information: name, email address, telephone number, mailing address
• Communication content: the text of messages you send us through our contact form, chatbot, email, or phone
• Account information: for clients, information required to deliver accounting, tax, and advisory services (business registration numbers, financial records, tax filings, supporting documents)
• Technical information: browser type, device information, IP address, pages visited, referring URL, timestamps
• Marketing information: if you subscribe to our newsletter, your email and any preferences you provide
• Chatbot session data: messages you send to our website chatbot, transcripts of chat sessions, and any information you provide to be contacted by one of our CPAs

We do not intentionally collect sensitive information (health, biometric, political) through our website. If you choose to share such information with us (for example, in a message), we will handle it with the same care as the rest of your personal information.

2. How we use it

• To respond to your inquiries — messages from the contact form, chatbot, or email are read by our team and used to answer your questions, prepare proposals, or schedule consultations
• To deliver professional services — information you provide as a client is used to prepare your tax filings, financial statements, bookkeeping records, advisory deliverables, and related work
• To comply with professional and legal obligations — CPA Ontario, CPA Alberta, and CRA may require us to retain certain records for a defined period
• To improve our services — we review aggregate usage patterns, chatbot transcripts, and feedback to improve how we communicate and what we offer
• For security and fraud prevention — we use rate limits, anti-bot measures, and log review to protect our systems

3. Legal basis for processing

• Consent: you consent to our collection and use of your information when you contact us, subscribe to our newsletter, or use our chatbot. You can withdraw consent at any time (see Section 7)
• Contractual necessity: for clients, processing is required to deliver the services you have engaged us for
• Legal obligation: CRA, CPA Ontario, and CPA Alberta require retention and disclosure of certain records

Under Law 25, we obtain explicit consent for the purposes stated above before collecting your information. You have the right to know how we use it and to withdraw consent at any time.

4. Who we share it with

We share personal information only as needed to deliver our services and as described below. We do not sell personal information to anyone.

Categories of sub-processors we use:

• Cloud hosting and infrastructure — website hosting, logging, rate-limiting backend, and backup records (United States, with some providers offering Canadian data-residency options)
• AI model provider — for the website chatbot. See Section 11 below for provider name and specifics (United States)
• Email delivery and productivity services — sending transactional and marketing email, our team inbox, and internal workflow (United States with Canadian data-residency options)
• Web analytics and advertising measurement — understanding site usage and measuring advertising campaigns (United States with Canadian data-residency options)

Each sub-processor is bound by its own terms, which include data-protection obligations. We review these before engagement. A current list of specific sub-processors is available on request at info@sapere.ca.

Regulators and authorities — CPA Ontario, CPA Alberta, and CRA may receive information when required by law or professional standard.

Professional advisors — lawyers, auditors, and other advisors we engage for our own business operations may see personal information to the extent necessary for their work.

5. Cross-border transfers

Most of our sub-processors are based in the United States. When your personal information is transferred to a country outside Canada, it remains subject to the laws of that country and may be accessible to foreign authorities under local legal processes. We have selected sub-processors that commit to industry-standard data-protection practices.

By using our website, contact form, newsletter, or chatbot, you consent to this transfer.

6. How long we keep it

• Contact form and chatbot inquiries that do not become clients: up to 2 years, then deleted or anonymized
• Chatbot session transcripts: up to 1 year in our email archive and backup records
• Client records: as required by CPA Ontario, CPA Alberta, and CRA — generally 7 years for financial and tax records, longer for certain categories
• Newsletter subscriptions: until you unsubscribe, plus a short retention for unsubscribe-confirmation records
• Technical and analytics data: as per Google Analytics 4 default retention (14 months) and Vercel log retention (short-term, typically days to weeks)

7. Your rights

Under PIPEDA and Law 25, you have the right to:

• Access the personal information we hold about you
• Correct inaccuracies in your personal information
• Withdraw consent for collection, use, or disclosure (subject to legal and contractual restrictions)
• Request deletion of your personal information (subject to our retention obligations under CPA and tax law)
• Receive your information in a structured, commonly used format (portability, under Law 25)
• File a complaint with us or with the regulator (Office of the Privacy Commissioner of Canada, or Commission d’accès à l’information du Québec for Quebec residents)

To exercise any of these rights, contact us at info@sapere.ca. We will respond within 30 days.

8. Security

We protect your personal information with technical and administrative safeguards appropriate to its sensitivity:

• Encryption in transit (HTTPS) across our website and APIs
• Encryption at rest with our hosting and storage providers
• Access controls on our email, cloud storage, and client file systems
• Rate limiting, anti-bot checks, and input validation on web endpoints
• Automated redaction of certain patterns (social insurance numbers, credit card numbers) in chatbot transcripts before storage

No system is perfectly secure. If a privacy incident affecting your information occurs, we will notify you in accordance with applicable law (including Law 25’s incident-notification requirements for Quebec residents).

9. Cookies and analytics

We use Google Analytics 4 and Google Ads measurement to understand how visitors use our website. These services set cookies that collect information about pages visited, time spent, and referring sources. The information is aggregated and used to improve our website.

You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on. You can also block cookies in your browser settings.

10. Children’s privacy

Our website and services are not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at info@sapere.ca so we can delete it.

11. The chatbot

Our website chatbot (available in English and Quebec French) processes your messages through Anthropic’s Claude model, routed via Vercel’s AI Gateway. When you chat with it:

• Your messages are sent to Anthropic in the United States for processing
• The chatbot does not retain conversation history between page loads
• If you provide contact information to be reached by one of our CPAs, that information is emailed to info@sapere.ca and stored in our lead management system
• Transcripts of chat sessions are automatically emailed to our team so we can review and improve the service
• We apply automated redaction (for Canadian social insurance numbers and credit card numbers) to transcripts before storage

The chatbot does not provide specific tax, legal, or financial advice. It is an informational tool only. For your specific situation, speak with one of our CPAs.

12. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top indicates the most recent version. For material changes, we will provide additional notice through our website or by email to subscribers.

13. Contact

For any question, concern, or request related to this policy or to your personal information, contact us:

• Email: info@sapere.ca (mark the subject line “Privacy inquiry”)
• Mail: Sapere, 6790 Century Avenue, Suite 301, Mississauga, ON L5N 2V8, Canada
• Phone: +1 (647) 545-3839

You may also contact our privacy officer, the senior leadership of the firm, through the same channels.

If you are not satisfied with our response, you may file a complaint with:

• Office of the Privacy Commissioner of Canada: priv.gc.ca
• Commission d’accès à l’information du Québec (for Quebec residents): cai.gouv.qc.ca