Privacy Policy
Last updated: May 8, 2026
AgentCRA ("we", "us") helps Canadian real estate agents organize business expenses for CRA filing. This policy explains what personal information we collect, why, and the choices you have. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA).
What we collect
- Account information — name, email, brokerage, and password (stored as a salted hash, never in plain text).
- Financial documents you upload — bank and credit-card statements (PDF), and the transactions we extract from them.
- Receipts — photos you snap, files you forward to your private intake address, and—only if you connect Gmail or Outlook—receipt emails found by the scanner. We request read-only email scopes, search for receipts only, and never send mail from your account.
- Mileage and business records — trips, listings/clients you tag, and notes you add.
- Billing — handled by Stripe. Your card number never touches our servers.
- Technical data — log and error data (via Sentry) used to keep the service reliable.
How we use it
Only to provide the service: extracting and categorizing your expenses, calculating HST, producing reports for you and your accountant, and sending you transactional email about your account. We use AI services (Anthropic) to categorize transaction descriptions and receipt text, and OCR (Google Cloud Vision) to read receipt photos. These providers process data to provide the feature and do not use your data to train their models under our agreements with them.
We never sell your data. We never share it with advertisers.
Where your data lives
Data is hosted on Railway infrastructure, which may store and process data on servers located in the United States. Wherever it is processed, your information receives the protections described in this policy. Email-account tokens are encrypted at rest; all traffic is encrypted in transit (TLS).
Retention
CRA requires business records to be kept for six years; we retain your records while your account is active so you can meet that obligation. You can export everything at any time (Settings → Download Everything), and you can ask us to delete your account and all data — we complete deletion requests within 30 days.
Your rights
You may access, correct, export, or delete your personal information at any time. Most of this is self-serve in Settings; for anything else, email support@agentcra.ca and we'll respond within 30 days. If you're not satisfied with our response you may contact the Office of the Privacy Commissioner of Canada.
Cookies
We use only essential session cookies to keep you logged in. No third-party advertising or tracking cookies.
Changes
If we make material changes to this policy we'll email you before they take effect.
Questions? support@agentcra.ca