Privacy Policy

This policy explains how CorpStart handles personal information collected through corpstart.ca and in the course of preparing and filing your registration. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

We collect only what a filing requires, plus what we need to run the business. Specifically:

• Contact details: your name, email address, and phone number if you provide one.
• Filing information: the full legal names and residential addresses of directors, officers, and shareholders, the registered office address, share structure, and the proposed corporate or business name. Some registry forms require dates of birth or residency declarations.
• Order and payment records: what you ordered, what you paid, and your Stripe payment reference. We never see or store your full card number.
• Technical data: IP address, browser and device type, pages visited, and how you moved through the order flow.

Director residential addresses are among the most sensitive things we hold. Note that for most corporate filings this information becomes part of a public government registry record. That is a consequence of the filing itself, not of our handling.

• To prepare your documents and submit your filing to the appropriate registry.
• To take payment and issue receipts.
• To email you order confirmations, status updates, and completed documents.
• To answer your support questions.
• To understand where the ordering process confuses or loses people, so we can fix it.
• To meet our own legal, tax, and record-keeping obligations.

We do not sell your personal information. We do not share it with advertisers, data brokers, or other businesses for their own marketing.

We disclose personal information only to the parties needed to deliver what you ordered:

• Government registries: the Ontario Business Registry, Corporations Canada, and ServiceOntario, which receive the filing information you submitted. This is the purpose of the service.
• NUANS search providers, for named corporations.
• Stripe, which processes payments. Your card details go directly to Stripe and never touch our servers.
• Postmark, which delivers our transactional email.
• PostHog and Google Analytics, which receive technical and usage data about site visits.
• Our hosting provider, which stores the application and database.

We may also disclose information where required by law, court order, or a lawful request from a public authority.

We keep our own basic record of which pages are visited and where visitors arrived from, stored on our own servers. We do not store your IP address for this. It is converted into a one-way code using a key that changes every day, which lets us count visitors without identifying anyone, and makes yesterday's records impossible to link to today's.

We also use PostHog to understand how people move through the ordering process, and Google Analytics to understand how people find the site. Both set cookies or similar identifiers.

We configure analytics to avoid capturing the contents of the filing forms. Director names, addresses, and other form field values are masked and are not sent to our analytics providers.

PostHog and Google Analytics can be blocked through your browser settings or a tracking blocker, and the site works normally without them. Our own page-visit record is kept on our servers and is not affected by a blocker, which is why it holds no IP address and nothing that identifies you.

We keep order records, filing information, and the documents we prepared for seven years. This reflects the reality that customers come back years later needing a copy of their minute book or Articles, and that tax and business records generally must be retained for six years.

Draft orders that are never paid for are deleted after 90 days.

You can ask us to delete your information sooner. Where we are legally required to retain a record, we will tell you so rather than quietly keeping it.

Data is transmitted over encrypted connections and stored in access-controlled systems. Access to filing data is limited to the people who need it to prepare and submit your filing. Payment card data is handled entirely by Stripe, which is PCI DSS compliant.

No system is perfectly secure. If a breach affects your personal information and creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

Under PIPEDA you can:

• Ask what personal information we hold about you and get a copy of it.
• Ask us to correct information that is wrong or incomplete.
• Ask us to delete information we are not required to keep.
• Withdraw consent to non-essential uses, such as analytics or marketing email.
• Complain to us, and if you are not satisfied, to the Office of the Privacy Commissioner of Canada.

To exercise any of these, email [email protected]. We will respond within one business day and complete the request within 30 days.

One important limit: once a filing has been submitted to a government registry, we cannot remove or amend the record the registry holds. Changing a public registry record requires a separate filing, which we can help with.

Your information is stored and processed in Canada and the United States. Some of our service providers, including Stripe, Postmark, Anthropic, and our analytics providers, operate in the United States, which means your information may be subject to lawful access requests by US authorities.

If you use the question box on the site, what you type is sent to Anthropic to generate an answer. Do not put personal information into it. We never send your filing form values to it.

Our service is for people forming and running businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16 other than where it appears in a filing you submit.

We may update this policy. Material changes will be reflected in the 'last updated' date at the top of this page.

Privacy questions and requests go to [email protected].