Privacy Policy
Compliant with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
Introduction and scope
VertAcc Solutions Inc. (“VertAcc,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal information. This Privacy Policy describes how we collect, use, disclose, transfer, retain, and safeguard personal information when you visit vertacc.com (the “Site”), communicate with us, or engage our services (collectively, the “Services”).
This Policy applies to all visitors, prospective clients, current clients, and other individuals whose personal information we process. It supplements — and does not replace — any engagement-specific privacy or confidentiality terms set out in a written engagement letter between you and VertAcc.
Information we collect
We collect personal information in the following ways:
a) Information you provide directly
- Identity information (name, title, employer, professional designations)
- Contact information (email address, phone number, mailing address)
- Business information (company name, industry, jurisdiction, structure, size)
- Financial information you authorize us to access (bank records, ledgers, tax filings, invoices, payroll data, supporting documentation)
- Communications with us (form submissions, email, telephone, video calls, recorded meetings where consented)
b) Information collected automatically
- Device and connection data (browser type and version, operating system, IP address, time zone, language preferences). IP address is used for security, abuse detection, and rate-limiting of public API endpoints (including the Verta AI chat and contact forms)
- Usage data (pages viewed, time on site, navigation paths, referring URLs, interaction events)
- First-party cookie and session identifiers (see Section 10)
c) Information from Verta AI chat interactions
Verta AI is the conversational assistant available on this site. When you interact with Verta AI:
- Your messages are processed in real time by VertAcc’s AI provider (Anthropic) solely for the purpose of generating responses; messages are not used to train third-party foundation models
- Chat conversations are not persistently stored by VertAcc unless you choose to hand off to our team via the in-chat form. In that case, the recent transcript (up to the last 30 turns) is transmitted to our team along with your contact details so they can pick up where Verta left off
- Transcripts shared on handoff are retained with the same record-retention rules described in Section 6 of this Policy and may be reviewed by our team for quality assurance and follow-up
- You can request deletion of transcripts and any associated identifying information at any time using the rights described in Section 7
d) Information received from third parties
- Public sources (corporate registries, securities filings, news media, professional networks)
- Service integrations authorized by you (accounting software, banking platforms, payment processors)
- Service providers acting on our behalf (identity verification, fraud prevention, communications infrastructure)
- Referrals from existing clients and professional networks
How we use your information
We use personal information only for purposes that are reasonable and consistent with the circumstances under which it was collected, including:
- Providing, performing, maintaining, and improving the Services
- Processing payments and managing client billing
- Communicating with you about engagements, deliverables, service updates, and inquiries
- Complying with our legal, regulatory, and professional obligations, including tax-record retention
- Establishing, exercising, or defending legal claims
- Detecting, preventing, and addressing fraud, security incidents, and technical issues
- Conducting business analytics, training, and quality assurance
- Sending occasional service communications and, where you have opted in, marketing communications you can opt out of at any time
Information sharing and disclosure
We do not sell your personal information. We disclose personal information only in the following circumstances:
- Service providers: third-party vendors that perform services on our behalf (cloud infrastructure, payment processing, secure document storage, email and communications, analytics) and are bound by written confidentiality and data-protection obligations
- Professional advisors: our lawyers, accountants, auditors, and insurers, where reasonably required
- Government and regulatory authorities: when disclosure is required by law, court order, subpoena, or by a regulatory authority with jurisdiction (including the Canada Revenue Agency)
- Business transfers: in connection with a contemplated or completed merger, acquisition, financing, restructuring, or sale of assets, subject to confidentiality obligations on recipients
- With your consent or at your direction: with third parties you authorize, including counterparties in transactions we facilitate
- To protect rights and safety: where reasonably necessary to protect our rights, property, or safety, or the rights, property, or safety of our clients or others
Data retention
We retain personal information for only as long as is reasonably necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, regulatory, or reporting requirements.
Engagement-related records — including financial documents, tax filings, working papers, and correspondence — are retained for a minimum of seven (7) years from the end of the relevant tax year or engagement, in accordance with requirements under the Canadian Income Tax Act and the Excise Tax Act.
When personal information is no longer required, it is securely destroyed, erased, or anonymized in accordance with our internal retention schedule.
Data security
We implement reasonable administrative, physical, and technical safeguards to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification:
- Encryption of personal information in transit using industry-standard protocols and at rest using strong cryptographic standards
- Role-based access controls and multi-factor authentication for personnel
- Background checks and confidentiality obligations for all personnel and contractors
- Regular security assessments, vulnerability management, and patching
- Vendor security reviews and contractual data-protection obligations on service providers
- Documented incident-response procedures
No method of transmission over the Internet or method of electronic storage is one-hundred percent secure. While we take commercially reasonable measures to protect personal information, we cannot guarantee its absolute security.
Your rights under PIPEDA
Under the Personal Information Protection and Electronic Documents Act (Canada), and applicable provincial privacy legislation, you have the right to:
- Access: request a copy of the personal information we hold about you
- Correction: request correction or update of inaccurate or incomplete information
- Withdrawal of consent: withdraw consent to our processing of your personal information, subject to legal and contractual restrictions; withdrawal may affect our ability to provide certain Services
- Challenge: challenge our compliance with this Policy or applicable privacy law
- Complaint: file a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner
Requests should be submitted in writing to info@vertacc.com. We will respond within thirty (30) days. In some cases we may require additional information to verify your identity before acting on your request.
International data transfers
Some of our service providers may store or process personal information outside Canada, including in the United States and the European Union. When personal information is transferred outside Canada, it is subject to the laws of that jurisdiction and may be accessible to its courts, law enforcement, and national security authorities.
We require all such service providers to maintain a comparable level of protection through written contracts that include standard data-protection terms consistent with PIPEDA. You may contact us for more information about the safeguards we use.
Automated tools and supporting technologies
In delivering the Services, we use a range of supporting technologies, which may include accounting software, secure document portals, communication tools, analytics platforms, and artificial-intelligence assistants used to support — but not replace — professional judgment exercised by our team.
Where supporting technologies process personal information, they do so under written confidentiality and data-protection obligations. Personal information is not used to train third-party general-purpose models. Any decisions affecting your engagement are reviewed and approved by qualified personnel.
Cookies and similar technologies
The Site uses first-party cookies and similar technologies to operate the Site, remember your preferences, maintain session integrity, and analyze aggregate usage. We do not use third-party advertising cookies and do not sell visitor data to advertising networks.
You may control cookies through your browser settings. Disabling cookies may affect the functionality of some parts of the Site.
Children's privacy
The Services are directed to businesses and individuals over the age of majority. We do not knowingly collect personal information from individuals under the age of eighteen (18). If you believe a child has provided personal information to us, please contact us so we can take appropriate action.
Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated by posting the updated Policy on the Site with a revised effective date. Your continued use of the Site or Services after changes take effect constitutes acceptance of the updated Policy.
Contact us
Questions, requests, or concerns regarding this Policy or our handling of personal information may be directed to our Privacy Officer: