Privacy Policy
Seller: Accountants Expert, operated by BOMCAS Canada. The seller has not published a street address or a registration number on this page. Write to licences@accountantsexpert.com.
1. Who we are
This policy describes how Accountants Expert, operated by BOMCAS Canada, handles personal information on accountantsexpert.com. The privacy contact is licences@accountantsexpert.com. The seller is the organisation that decides why account, billing, and support information is collected. Processors act on the seller's instructions for the purposes this policy names. The seller has not appointed a separate European representative on this page. A person in the European Union or the United Kingdom may still write to the privacy contact, and may complain to their own supervisory authority.
The seller designs the store for Canadian customers and also serves visitors in other countries who choose to use the site. This policy is written to meet the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA), the Personal Information Protection Act of Alberta, SA 2003, c. P-6.5, the Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25, which amends the Act respecting the protection of personal information in the private sector, CQLR c. P-39.1 (commonly called Quebec Law 25), the General Data Protection Regulation (EU) 2016/679, the UK GDPR as retained in the United Kingdom together with the Data Protection Act 2018, and the core access and deletion ideas of the California Consumer Privacy Act, Cal. Civ. Code section 1798.100 and following, as amended by the CPRA. The seller does not claim a certification under any of those laws.
2. What we collect
When a person creates an account, the seller stores the name, the email address, the password hash, and any optional company, country, province or territory, and phone the form asks for. When a person buys, the seller stores the plan, the term, the subscription status, the renewal date, the activated site addresses, and the last four characters of the licence key. The full key is not shown again after it is issued, except through the account flow the product provides. Checkout consent is stored with the time, the policy versions, the checkbox text, and, for the site consent bar, a hash of the IP address and the user agent. The seller does not store the raw IP address in that bar's consent row.
Card numbers are handled by Stripe and are not stored on this site. PayPal handles a payment only when card checkout cannot start, and PayPal processes that payment. The seller receives a status, an amount, and a reference. A calculator runs in the visitor's browser. What the visitor types into a calculator is not saved on the seller's server unless a later feature, which is off unless the site owner turns it on, sends an email or a file the visitor asked for.
The site consent bar stores the choice in a cookie named ae_consent and in local storage on the device. That record includes the policy version so the bar can ask again when the version changes. Server logs on the host may include an IP address, a user agent, and the page requested, for security and for keeping the site up. Support email contains whatever the sender wrote. The seller asks senders not to include a social insurance number, a full return, or a full licence key.
3. Why we use it
The seller uses account and billing information to create the account, supply the licence, charge the subscription, prevent fraud, provide support, and keep the consent record. Those purposes are the contract with the buyer, and the seller's legitimate interest in running a secure store, where a legitimate-interest test applies. Marketing email is sent only if the person opts in, and the person may withdraw that opt-in at any time. A withdrawal does not affect the account or the licence.
Where the GDPR or the UK GDPR applies, the seller relies on contract for the account, the licence, and the billing, on consent for optional marketing email and for non-essential cookies, and on a legal obligation where tax law requires a record to be kept. Where PIPEDA or Alberta's Personal Information Protection Act applies, the seller identifies the purposes at or before collection, as this policy and the checkout screen do. Where Quebec Law 25 applies, consent for a purpose that needs consent is requested in clear terms, and the person may withdraw it. Where the California Consumer Privacy Act applies, the seller does not sell personal information and does not share it for cross-context behavioural advertising. The seller does not use calculator inputs to build advertising profiles.
4. Processors
Stripe processes card payments, including wallets that ride on the card method, and holds the card data. PayPal processes a payment when it is the backup. Hostinger hosts the website and the databases. The email provider is the service that delivers WordPress mail, which may be the host's mail system or an SMTP service the seller has connected. Those processors receive only what they need for their task. The seller does not authorise them to use account data to market their own unrelated products to the buyer.
A processor may host data outside the buyer's province or country. Stripe and PayPal operate internationally. Hostinger may process in the European Economic Area and in other locations it uses to run the service. The seller uses contractual terms with those processors. Where the GDPR applies to a transfer out of the European Economic Area, the seller relies on an adequacy decision where one exists, including the European Commission's adequacy decision for commercial organisations subject to PIPEDA where that decision actually covers the recipient, and otherwise on standard contractual clauses and a transfer assessment. The seller does not claim that every transfer is covered by an adequacy decision.
5. Cookies
The Cookie Policy describes the cookies in detail. Essential cookies are required to sign in and to remember the consent choice. Statistics and marketing cookies stay off until the visitor switches them on. The visitor can do that in Cookie settings. Accepting the legal terms is still required to use the site, even if statistics and marketing stay off. That split is deliberate. Quebec Law 25 and the GDPR require that non-essential cookies be refusible. They do not require the seller to let a visitor ignore the terms of the website.
A YouTube embed, if a page has one, is a privacy-enhanced player and does not load until marketing consent is on. The poster image is stored on this site. The seller does not set advertising cookies of its own.
6. Retention
The seller keeps account and licence records for the life of the account and then for as long as a claim, a tax rule, or an accounting rule requires. Payment records are kept for at least six years after the end of the tax year they relate to, which is the general federal period in section 230 of the Income Tax Act, and longer if a statute or an open audit requires it. Consent rows are kept for the same kind of period so the seller can show what was accepted, unless an erasure request must be honoured and no legal hold applies. Security logs are kept for about ninety days unless an investigation needs a longer copy.
When a record is no longer needed, the seller deletes it or de-identifies it. Backups may hold a copy until the backup cycle overwrites it. The seller does not promise instant removal from every backup. A calculator input that was never sent to the server is not in the seller's retention schedule because the seller does not have it.
7. Rights
A person may ask for access to the personal information the seller holds about them, for a correction, for deletion, and for a withdrawal of marketing consent. A person in Quebec may exercise the rights Quebec Law 25 provides, including access, rectification, and cessation of dissemination where the statute applies. A person in Alberta may exercise the rights in the Personal Information Protection Act. A person in the European Union or the United Kingdom may request access, rectification, erasure, restriction, objection, and portability where the GDPR or the UK GDPR provides those rights, and may complain to a supervisory authority. A California resident may request access to and deletion of personal information the statute covers, and may appeal a denial by writing to the same privacy contact.
The seller may need to confirm identity before releasing information. The seller may refuse a request that the law allows the seller to refuse, including a request that would reveal another person's information or that would delete a record the seller must keep for tax. WordPress provides an export and erase tool for data tied to an email. Erasing a licence record removes the email, the key material, and the site list from that record. A consent row tied to that email is removed with the erase request, subject to a record the law requires the seller to retain. The form at the bottom of this page sends the request to licences@accountantsexpert.com.
8. Breach notification
If a breach of security safeguards creates a real risk of significant harm, the seller will notify affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA section 10.1 requires, and will keep the prescribed record. If Alberta's Personal Information Protection Act section 34.1 applies, the seller will notify the Alberta Commissioner without unreasonable delay. If Quebec Law 25 applies and the incident presents a risk of serious injury, the seller will notify the Commission d'accès à l'information du Québec and the persons concerned. If the GDPR or the UK GDPR applies, the seller will notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to rights, and will notify individuals when the breach is likely to result in a high risk.
Notification describes the nature of the incident in general terms, the likely consequences, and the measures taken or proposed. The seller does not promise to disclose investigative detail that would compromise a fix that is still in progress. A person who believes their account was accessed without permission should write to licences@accountantsexpert.com and change their password.
9. Children and automated decisions
The site is not directed at children. The seller does not knowingly open an account for a person under the age of majority who cannot form a contract. A parent who believes a child's information was collected should write to the privacy contact and ask for deletion. The seller does not use personal information to make a decision about a person that produces legal effects solely by automated means. A declined card is a decision by the processor about the payment instrument, not a profile of the person built by this site.
The seller does not sell personal information for money. The seller does not use sensitive information, as California defines it, for purposes that need a limit-the-use right beyond running the account. A request to limit use of sensitive information can be sent to the privacy contact and will be honoured where the statute applies.
10. Contacting you, and optional marketing email
When you accept the terms of this website, the seller may use the email address on your account to contact you about the account, a purchase, a licence, support, and service updates. Those messages are necessary to perform the contract and to run the service you asked for. They are not marketing. The seller records the acceptance of the terms with the time, the policy version, a hash of the IP address, and the user agent.
Email that contains news, offers, or product updates is optional and separate. The box on the consent panel is unchecked until you tick it. That is express consent for a commercial electronic message under Canada's anti-spam legislation, S.C. 2010, c. 23. The seller stores that choice on its own row in the consent table, with its own timestamp, whether you allow it or decline it. You may withdraw it at any time from a message or by writing to licences@accountantsexpert.com. Withdrawal stops the news and offers. It does not stop account, transactional, or service messages, and it does not delete the record of the choice you made.
Non-essential cookies are a different choice from that email. You can accept the terms and leave Preferences, Statistics, and Marketing cookies off. Necessary cookies stay on because the site cannot remember your decision, or keep you signed in, without them. Quebec's Law 25 and the GDPR require that those non-essential cookies remain optional. They do not require the seller to let a visitor use the site without accepting the terms.
11. How these words are used
Headings are for convenience. They do not change the operative text. “Including” means “including without limitation”. The singular includes the plural and the other way around. “Writing” includes email. A reference to a statute is to that statute as amended, and to any regulation made under it. A reference to a person includes a natural person, a corporation, a partnership, and any other entity. If a word is defined in this document, that definition applies wherever the word is used, unless the sentence says otherwise.
If a translation of this page is published, the English text controls. If a page on the site summarises this document in shorter words, this document controls where they differ. A failure to enforce a term on one occasion is not a waiver. A waiver must be in writing to be effective, and it applies only to the breach it names. The seller may assign this document to a successor of the business. The buyer may not assign a licence or an account without the seller’s prior written consent, except where a mandatory law says otherwise.
If a court finds that one term cannot be enforced, the rest of the document stays in force. The invalid term is modified to the minimum extent needed to make it valid, if a modification can do that without changing the bargain. This document, together with the other policies named in it and the plan the buyer selected at checkout, is the entire agreement on its subject. It replaces earlier oral statements and earlier website summaries about that subject. A purchase order or a buyer’s standard terms do not amend it unless the seller signs a document that says they do.
Days are calendar days unless a section says business days. A business day is a day other than a Saturday, a Sunday, or a statutory holiday in Alberta. Notices to the seller are sent to licences@accountantsexpert.com and are effective when the email is received, or on the next business day if it arrives outside ordinary business hours. Notices to the buyer are sent to the email on the account and are effective when sent, unless the message bounces and the seller has another address on file. The buyer must keep that email address current.
12. Governing law and mandatory rights
Accountants Expert, operated by BOMCAS Canada offers the website, the calculators, and the paid plans from Alberta, Canada. This document is governed by the laws of Alberta and the federal laws of Canada that apply in Alberta. The courts of Alberta have jurisdiction, subject to the dispute section of the Limitation of Liability and Indemnity and to any mandatory rule that lets a consumer sue or be sued at home.
Nothing in this document limits a right that a statute says cannot be limited. That includes mandatory protections for a consumer in the buyer’s province or country. For a consumer in Quebec, the Consumer Protection Act, CQLR c P-40.1, applies where it must, and a term that conflicts with it is read down. For a consumer in the European Union, the mandatory parts of Directive 2011/83/EU on consumer rights, as implemented in the buyer’s member state, and the mandatory parts of the digital-content rules that apply to that buyer, are preserved. For a consumer in the United Kingdom, the mandatory parts of the Consumer Rights Act 2015 and the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 are preserved.
Where those laws give a consumer a right to withdraw from a distance contract for digital content, the buyer is asked at checkout to request immediate supply and to acknowledge that the withdrawal right ends once supply of the digital licence begins. That request and acknowledgement do not apply where a mandatory law keeps the withdrawal right, including for a consumer in Quebec. A business buyer who is not a consumer does not receive consumer withdrawal rights.
The seller does not claim a professional designation, a certification, or a membership on these pages. The calculators are software. They are not a filing, a ruling, or a retainer. Dispute resolution, the class-action waiver, and arbitration are described in the Limitation of Liability and Indemnity. They are not enforceable against a Quebec consumer where the law of Quebec refuses them. They also do not apply where the law of the buyer’s province or country refuses a waiver of a class action or a requirement to arbitrate.
13. Changes, records, and survival
The seller may update this document by posting a new version with a new version number and a new effective date. The version line at the top of the page is the version in force. A material change to a paid plan is also handled in the Terms of Sale, including notice before a renewal price changes. Continued use of a free page after the effective date is acceptance of the new website terms. A paid subscription keeps the commercial terms accepted at the start of the current paid term until that term renews, except where a change is required by law or is needed to stop abuse.
The site consent bar asks again when the policy version changes. A previous acceptance stored in the cookie, in local storage, or in the consents table does not cover a later version. Checkout keeps its own consent screen. Accepting the bar does not replace the checkboxes at checkout, and the checkboxes at checkout do not replace the bar.
Terms that by their nature should survive the end of a subscription do survive. That includes accrued payment obligations, the refund rules for a period already paid, the licence restrictions on a copy already received, the disclaimer, the limitation of liability, the indemnity, the governing-law clause, and the sections needed to interpret them. The end of a subscription does not erase a record the seller must keep for tax, accounting, or a legal claim.
The contact for every policy on this site is licences@accountantsexpert.com. Support about a licence key or a download may also be handled from My Account. Do not send a client’s tax return, a social insurance number, or a full licence key to that address. Send the account email and a description of the issue.
14. Directory leads shared with a firm
When a visitor sends a quote request on a directory profile, the seller stores the name, email, phone, service, city, and message, with the time and the consent text. That lead is shared with the firm that owns the profile, by email and in that firm’s account, when the firm’s plan includes the lead or when the firm pays to unlock it. A masked preview may be shown before a pay-per-lead unlock. The firm is then an independent recipient of that enquiry and is responsible for its own handling of it. The visitor can ask the seller for access or deletion of the copy the seller still holds, at licences@accountantsexpert.com. Deleting the seller’s copy does not automatically delete the copy already delivered to the firm.
Send a privacy request
These pages are written for customers of Accountants Expert. They are not a legal opinion and they are not a certification. Have them reviewed by a lawyer before you rely on them.
Terms of Service · Terms of Sale · Refund and Cancellation Policy · Software Licence Agreement · Privacy Policy · Cookie Policy · Acceptable Use Policy · Disclaimer · Limitation of Liability and Indemnity · Your account · Support
Card payments are processed by Stripe. Accountants Expert does not store card numbers.
