Privacy

1. Who this covers

This policy applies to standkeep.ca and to the emails and documents Standkeep sends you. Standkeep serves corporations across Canada, including Quebec, so it is written against the federal Personal Information Protection and Electronic Documents Act and Quebec's Law 25 together, and follows whichever is stricter.

2. What is collected

Account information

Your email address, the language you chose, when you last signed in, and when the account was created. Your password is stored only as a salted hash that cannot be reversed, and the second-factor secret only in encrypted form.

Corporation information

What the rules need in order to produce a calendar: legal name, corporation number, governing jurisdiction, incorporation and anniversary dates, fiscal year end, status, extra-provincial registrations, CRA program account identifiers and filing cadences, and the declarations you make about the small business deduction and your GST/HST reporting periods.

Documents you upload

Files you choose to attach as evidence, and the notes you write on an obligation. Standkeep does not read them for any purpose other than storing and returning them to you.

Invoices, if your corporation issues them here

Who your corporation bills and what it billed them: a client's name and, if you add them, an email and — for a business only — its address, since a person billed as themselves has no address field at all; the lines, taxes and totals of each invoice and credit note; the payments you record as received; the payment instructions and other text you write; and your logo, with its location and author metadata removed before it is stored. Since 15 September 2026 also the suppliers who bill your corporation and their bills as you record them — a supplier billed as a person held with a name and, if you add one, an email, never an address — and the bill itself if you attach it. It is held on your corporation's behalf, and since 14 September 2026 the record of each email you send — from an issued document, of a receipt for a payment you record, or of a client's statement of account: the address it went to, the subject and the covering note, and the message id the email provider returned. Standkeep emails an invoice only when you ask it to — from the document's own page, or, if you turn overdue reminders on, three fixed reminders after its due date, or, if you turn receipts on, a receipt when you record a payment, or, on the schedule of a recurring invoice you set to send, that invoice — with the PDF attached and the reply going to your corporation's own address; it collects no payment and sends no part of any of this to a language model. A client who asks Standkeep about their information is directed to your corporation.

Your corporate registers

The registers your governing Act obliges your corporation to keep: the names of your directors, officers and shareholders, the office each holds, the number and class of shares, the dates each entry began and ended, and the address for service a registry publishes. These are the first records here about people who are not Standkeep users, and they are held on your corporation's behalf, because it is your corporation the Act obliges. Standkeep does not read them to make any decision about anybody, and no part of them is ever sent to a language model. There is no date of birth, no residential address and no jurisdiction of tax residence in any register, so your register of individuals with significant control stays a document you upload rather than data held here. Someone named in your register who asks Standkeep about it is directed to your corporation: answering them directly would disclose that your corporation is a customer.

Support and suggestions

What you write in a support ticket or a suggestion, and — where a ticket is opened without an account — a one-way hash of the originating address, used to limit abuse of the unauthenticated form.

Billing

A customer reference and subscription state from the payment provider. Card numbers go to the payment provider directly and are never received by Standkeep.

The free filing check

The corporation number looked up, the language, and whether the lookup succeeded. No IP address and no session identifier is stored, so a recorded lookup cannot be tied back to a person. Your IP address is read to rate-limit the form and held in memory only for the length of that window; it is never written to the database.

3. What is never collected

No social insurance numbers, no bank account details, no residential addresses and no dates of birth — there is no field for either anywhere in the system, which is why the register of individuals with significant control stays a document you upload rather than data held here. The one place you write free text for someone else to read — the payment instructions printed on your invoices — is stored exactly as you write it, so give an e-Transfer address there rather than an account number. And no credentials of any kind for a government service. Automated tests fail the build if a column for a credential, a date of birth or a residential address is added.

4. Why it is collected

To produce your statutory calendar, to send the reminders you asked for, to store the evidence you upload, to answer your support requests, to bill you, and to keep the service secure and working. Standkeep does not sell personal information, does not share it for advertising, and does not use it to train models.

5. Where it is stored, and what leaves Canada

The database and the document storage are in the Canada (Central) region, and since 4 September 2026 the application's own processing runs there too, in the same region. Five providers handle some information outside the country: transactional email, which carries your address and the content of a reminder, a sign-in message or a security notice, and — only when you send one — a quote, invoice, credit note, receipt or statement of account with your client's address, your covering note and the PDF; the payment provider, which holds your email address and the billing name and address it collects at checkout; the hosting platform's own operation, such as its build and runtime logs; if you turn on mobile notifications, the push relay and Apple or Google that deliver them; and, only if you ask it to, the AI provider: to read a document for you — a founding document into the corporation form, or a file into the vault — after addresses, dates of birth and contact details have been removed; to answer a question about a rule; to match the other matters of a resolution to Standkeep's fixed clauses; or to say in plain words what is outstanding across your corporations, from the dates the engine computed and nothing else. Information stored outside a jurisdiction may be subject to that jurisdiction's laws.

A privacy impact assessment covering all five was adopted September 15, 2026. It is redone before any new transfer of Quebec personal information outside Quebec, and reviewed at least once a year.

6. Service providers

Standkeep uses a small number of providers to run: a managed Postgres and file-storage platform for the database and the vault, a hosting platform, a transactional email provider, and a payment provider. Each receives only what its function needs, under contract, and none is permitted to use your information for its own purposes.

7. How long it is kept

Account and corporation records are kept while the account exists. Deleting the account deletes them. Reminder dispatch records are kept while the obligation they belong to exists, because they are the evidence a reminder was sent. Support threads are kept so a conversation can be picked up again. Invoices, credit notes and the payments recorded against them are kept while the account exists and deleted with it; the tax laws ask your corporation to keep its records for six years, so export them before deleting the account. Records that must be retained for tax or legal reasons are retained for as long as that requires, and no longer.

8. Your rights

You can see what is held, correct it, export all of it, and delete the account outright — all from inside the product, without asking anybody. Under Law 25 you also have the right to have information transferred in a structured, commonly used technical format, which is what the export is, and the right to withdraw consent. Where a request cannot be satisfied in the product, support will handle it.

9. Cookies

Standkeep sets six cookies, every one of them strictly necessary and none of them a tracker: one that keeps you signed in, one that remembers your language, two that the sign-in library sets while you are signing in — a cross-site request forgery token and the address to return you to afterwards — one that lasts five minutes while you move from your password to your authenticator code, and one that lasts fifteen minutes to remember that you have entered your vault PIN in this browser. There is no advertising cookie, no third-party analytics script and no cross-site tracker. The session cookie is scoped to this host only and is never set on a parent domain. Two things sit in your browser's own storage and are not cookies: a note that you declined the offer to install Standkeep as an app, and a copy of the page that says you are offline. Neither identifies you and neither leaves your device.

10. Security

Sign-in takes a password and, where you have set one up, a second factor; the password is kept only as a salted scrypt hash. Documents live in a private bucket and are read only through short-lived signed links: sixty seconds for a document you open in the app, and ten minutes for the links bundled into an export, which have to last long enough for you to download them. Administrative access to customer records is role-limited, recorded in an append-only audit log, masked by default, and reviewed periodically — an unmasking is itself recorded with the reason given for it.

11. Children

Standkeep is a tool for corporations and is not directed at children. It does not knowingly collect personal information from anyone under the age of majority.

12. Changes to this policy

If this policy changes in a way that materially affects you, you will be told by email before the change takes effect, not by a silently updated date at the top of the page.

13. Contacting us

Privacy questions, access requests and complaints go to support and are handled by the person responsible for the protection of personal information at LOONIELODGE INC. If you are not satisfied with the answer, you may complain to the Office of the Privacy Commissioner of Canada, or to the Commission d'accès à l'information du Québec if you are in Quebec.