Privacy Policy

This policy explains how CorpStart handles personal information collected through corpstart.ca and in the course of preparing and filing your registration. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

We collect only what a filing requires, plus what we need to run the business. Specifically:

• Contact details: your name, email address, and phone number if you provide one.
• Filing information: the full legal names and residential addresses of directors, officers, and shareholders, the registered office address, share structure, and the proposed corporate or business name. Some registry forms require dates of birth or residency declarations.
• Order and payment records: what you ordered, what you paid, and your Stripe payment reference. We never see or store your full card number.
• Technical data: IP address, browser and device type, pages visited, and how you moved through the order flow.

Director residential addresses are among the most sensitive things we hold. Note that for most corporate filings this information becomes part of a public government registry record. That is a consequence of the filing itself, not of our handling.

Canadian corporate law requires every corporation to keep a register of the individuals who ultimately control it, and federal corporations must file that register with Corporations Canada when they incorporate and whenever it changes. This is the most sensitive information we hold, so it is worth setting out separately rather than leaving it inside a longer list.

For each such individual we ask for:

• Full legal name.
• Date of birth.
• Residential address, and an address for service if it differs.
• Country of tax residence.
• The basis on which they qualify, for example holding 25 per cent or more of the voting shares, or having control in fact.

You tell us who these individuals are. We do not work it out for you and we do not verify it, because control is not always a matter of shareholding and because the register is your declaration to make. We record what you declared and when we asked.

Corporations Canada makes part of this register publicly searchable, including names and addresses for service. Your date of birth is not published. We say so before asking for it, not afterwards.

Dates of birth, residential addresses, addresses for service and tax residence are encrypted at rest with a key held separately from the database, so a copy of the database alone does not reveal them. Names are not encrypted, because the register is searched and filed by name.

We keep an entry for six years after an individual ceases to be an individual with significant control, which is the period the Canada Business Corporations Act requires, and then delete it. That is why a ceased entry is retained rather than removed when you tell us someone no longer qualifies.

To correct or ask about this information, contact us at [email protected]. If a filing has already been made on the basis of it, a correction may require a further filing, and we will tell you if so.

• To prepare your documents and submit your filing to the appropriate registry.
• To take payment and issue receipts.
• To email you order confirmations, status updates, and completed documents.
• To answer your support questions.
• To understand where the ordering process confuses or loses people, so we can fix it.
• To meet our own legal, tax, and record-keeping obligations.

We do not sell your personal information. We do not share it with advertisers, data brokers, or other businesses for their own marketing.

We disclose personal information only to the parties needed to deliver what you ordered:

• Government registries: the Ontario Business Registry, Corporations Canada, and ServiceOntario, which receive the filing information you submitted. This is the purpose of the service.
• NUANS search providers, for named corporations.
• Stripe, which processes payments. Your card details go directly to Stripe and never touch our servers.
• Postmark, which delivers our transactional email.
• PostHog and Google Analytics, which receive technical and usage data about site visits.
• Our hosting provider, which stores the application and database.

We may also disclose information where required by law, court order, or a lawful request from a public authority.

We keep our own basic record of which pages are visited and where visitors arrived from, stored on our own servers. We do not store your IP address for this. It is converted into a one-way code using a key that changes every day, which lets us count visitors without identifying anyone, and makes yesterday's records impossible to link to today's.

We also use PostHog to understand how people move through the ordering process, and Google Analytics to understand how people find the site. Both set cookies or similar identifiers.

We configure analytics to avoid capturing the contents of the filing forms. Director names, addresses, and other form field values are masked and are not sent to our analytics providers.

PostHog and Google Analytics can be blocked through your browser settings or a tracking blocker, and the site works normally without them. Our own page-visit record is kept on our servers and is not affected by a blocker, which is why it holds no IP address and nothing that identifies you.

We keep order records, filing information, and the documents we prepared for seven years. This reflects the reality that customers come back years later needing a copy of their minute book or Articles, and that tax and business records generally must be retained for six years.

Draft orders that are never paid for are deleted after 90 days.

You can ask us to delete your information sooner. Where we are legally required to retain a record, we will tell you so rather than quietly keeping it.

Data is transmitted over encrypted connections and stored in access-controlled systems. Access to filing data is limited to the people who need it to prepare and submit your filing. Payment card data is handled entirely by Stripe, which is PCI DSS compliant.

No system is perfectly secure. If a breach affects your personal information and creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

Under PIPEDA you can:

• Ask what personal information we hold about you and get a copy of it.
• Ask us to correct information that is wrong or incomplete.
• Ask us to delete information we are not required to keep.
• Withdraw consent to non-essential uses, such as analytics or marketing email.
• Complain to us, and if you are not satisfied, to the Office of the Privacy Commissioner of Canada.

To exercise any of these, email [email protected]. We will respond within one business day and complete the request within 30 days.

One important limit: once a filing has been submitted to a government registry, we cannot remove or amend the record the registry holds. Changing a public registry record requires a separate filing, which we can help with.

Your information is stored and processed in Canada and the United States. Some of our service providers, including Stripe, Postmark, Anthropic, and our analytics providers, operate in the United States, which means your information may be subject to lawful access requests by US authorities.

If you use the question box on the site, what you type is sent to Anthropic to generate an answer. Do not put personal information into it. We never send your filing form values to it.

Our service is for people forming and running businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16 other than where it appears in a filing you submit.

We may update this policy. Material changes will be reflected in the 'last updated' date at the top of this page.

Privacy questions and requests go to [email protected].