Privacy Policy

How Northfile collects and protects personal information for Canadian sales tax compliance (Law 25 / PIPEDA).

Who we are

Northfile Inc. (“Northfile”, “we”) provides simplified Canadian sales tax compliance software for ecommerce merchants and accounting firms.
This policy explains how we collect, use, disclose, and retain personal information under Quebec’s Law 25 (Loi 25) and Canada’s PIPEDA.
A Privacy Officer (RPD) will be designated before full public launch. Contact: privacy@northfile.com.

Account data: name, email, password hash, organization and role.
Business compliance data: legal/trade name, incorporation country, tax registration numbers, province market selections, and sales reports you upload.
Billing data: Stripe customer and subscription identifiers (card details are processed by Stripe; we do not store full card numbers).
Technical data: authentication cookies, optional cookie-consent preference, and basic server logs needed to operate the service (no SIN or unnecessary profiling).

Provide onboarding, import, simplified tax calculation, filing worksheets, remittance initiation, document vault, and firm workspace features.
Authenticate users, secure accounts (including password reset), and prevent fraud or abuse.
Bill subscriptions and send transactional notices related to your account.
Meet CRA and Revenu Québec record-keeping expectations for tax documents we store on your behalf.
We rely on your consent at signup for personal-information collection, and on contractual necessity to deliver the service you request.

Essential cookies keep you signed in (session token) and remember `/demo` unlock when you choose to browse demo workspaces.
We ask for consent before using non-essential cookies (for example analytics, if enabled later). You can change your choice via the cookie banner.

We use subprocessors to host and operate the product (for example application hosting, database, object storage, Stripe for billing, remittance payment partners, and email delivery for password resets).
Where practical we prefer Canadian or equivalent-protection hosting. Cross-border transfers use contractual and technical safeguards.

Fiscal documents and related filing records are retained for at least seven years to support CRA requirements, then eligible for secure deletion.
Sensitive integration credentials are encrypted at rest (AES-256). Access to personal and tax data is logged for security and compliance audits.
We practice data minimization: we collect what is needed for Canadian sales tax compliance, not commercial profiling.

Subject to applicable law, you may request access, correction, or erasure of personal information, and withdraw consent where consent is the basis for processing (this may limit service features).
To exercise rights, email privacy@northfile.com. We respond within the timeframes required by Law 25 / PIPEDA.

We may update this policy as the product evolves. Material changes will be posted on this page with an updated effective date.
Effective date: 2026-09-15.