Privacy Policy

1. Information We Collect

When you create an account, we collect your email address and name through our authentication provider (Clerk). When you complete onboarding, we collect your company name, province of incorporation, incorporation date, fiscal year end, and shareholder information.

2. Corporate Documents

Documents you upload to Formbase (such as certificates of incorporation, articles of incorporation, or shareholder agreements) are stored encrypted and used solely to pre-populate your company profile and provide context for document generation. We do not share uploaded documents with third parties.

3. Generated Documents

Documents generated by Formbase are stored in your account and are accessible only to you. Generated documents are deleted upon account cancellation after a 30-day grace period.

4. Financial Data

Retained earnings balances, dividend history, and expense records you enter are stored to provide Formbase's services. This financial data is never shared with or sold to third parties.

5. Bank Account Data

If you choose to connect your bank account, Formbase uses Plaid to securely access your banking information. We collect bank transaction data including transaction descriptions, amounts, dates, and account balances. This data is used to categorize business expenses, monitor HST revenue thresholds, and verify payroll remittances. Bank transaction data is stored encrypted in our database and retained for 24 months from the date of collection. This data is never sold to third parties. You may disconnect your bank account at any time from Settings. You may request deletion of your bank transaction data by contacting us at hello@formbase.ca.

6. AI Processing

When you generate documents or use the compliance chat, your company context is sent to OpenAI for processing. We do not use your data to train AI models. OpenAI processes this data under their API data usage policy, which does not use API inputs for model training.

7. Data Storage

Your data is stored securely using Supabase (hosted on AWS). All data is encrypted in transit and at rest. We implement industry-standard security measures to protect your information.

8. Data Retention

We retain your data for as long as your account is active. Upon account cancellation, your data is retained for 30 days to allow you to download your documents, after which it is permanently deleted.

9. Your Rights

You can access, update, or delete your company data at any time through the Settings page. You can request complete deletion of your account and all associated data by contacting us.

10. Third-Party Services

Formbase relies on these service providers to run the service. Each receives only what its part needs, and each has its own privacy policy governing how it handles your data.

• Supabase: our database, file storage and sign-in. Stores your company records and documents. Hosted on Amazon Web Services in the United States.
• Vercel: hosts the application, so every page and file you load passes through it. United States. On our public pages only, never inside the app, Vercel Web Analytics counts page views without cookies.
• OpenAI: our AI model provider. Receives your company context and the text involved when you generate or edit a document, upload a document to be read, or ask the assistant a question. Under OpenAI's API terms this data is not used to train its models.
• Resend: sends our email, such as invitations, reminders and signature requests. Receives each recipient's name and address and the content of the email.
• Stripe: payment processing. Receives your billing details; card details are entered directly with Stripe and never reach us.
• Sentry: server error tracking, starting once it is enabled. It will receive technical details of errors on our servers, such as the type of error and where in our code it happened. Company records, document content and personal information are removed before anything is sent.

11. Contact

For privacy-related questions or data requests, contact us at hello@formbase.ca.