Privacy Policy

SREDr ("SREDr", "we", "our", or "us") is committed to protecting the privacy and confidentiality of personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you use our website, software, and related services (collectively, the "Services").

SREDr is based in Toronto, Ontario, Canada, and complies with the Personal Information Protection and Electronic Documents Act (PIPEDA)and applicable provincial privacy laws.

1. Information We Collect

We may collect the following types of information:

a. Personal Information

Name
Email address
Company name
Job title
Billing and payment information
Account credentials

b. Business and Technical Data

SR&ED-related project data provided by you
Supporting documentation, technical descriptions, and evidence
Metadata from connected systems (e.g., issue trackers, repositories, time-tracking tools), where authorized by you

c. Usage and Log Data

IP address
Browser type
Device information
Usage patterns and interaction data
Diagnostic and performance data

2. How We Use Information

We use information for the following purposes:

To provide, operate, and improve the Services
To generate SR&ED analyses, reports, and supporting documentation
To authenticate users and manage accounts
To process payments and invoices
To communicate with you regarding updates, support, or service notices
To maintain security, prevent fraud, and ensure system integrity
To comply with legal and regulatory obligations

We do not sell personal information.

3. Use of Artificial Intelligence

SREDr uses artificial intelligence and machine learning models to assist with:

Analyzing technical project data
Grouping activities into SR&ED-eligible projects
Drafting technical narratives, evidence summaries, and reports

AI processing is performed only on data you provide or explicitly authorize. Your data is not used to train public AI models. When you upload a payroll file — including a spreadsheet, pay stub, or tax slip — we convert it to text where needed and remove identifiers we do not need (such as a Social Insurance Number) before analysis. Scanned pages are converted in Canada.

4. Disclosure of Information

We may disclose information:

To trusted service providers under confidentiality agreements
When required by law, regulation, or legal process
To protect the rights, property, or safety of SREDr, our users, or others
With your explicit consent

5. Data Storage and Cross-Border Transfers

Where your information is stored.Your claim information — including uploaded files and the encrypted credentials used to retrieve evidence from systems you connect — is stored and processed on our service providers' infrastructure in Canada. Your sign-in and account authentication information, and requests to the artificial intelligence service described above, are stored, processed or transmitted through infrastructure in the United States; content sent to the artificial intelligence service is not retained there once a request is complete. As a result, your information may be subject to the laws of the United States, including lawful requests for access by United States courts, law enforcement and other government authorities. Some supporting infrastructure — including domain name resolution and the network that delivers our public website — operates globally and does not store personal information.

The service providers we use, what each does, and where each operates:

Provider	Role	Personal information	Location
Amazon Web Services	Hosting, database, file storage, transactional email	Claim, evidence and account records; encrypted connection credentials for systems the user connects; email delivery metadata	Canada
Amazon Web Services (Textract)	Converting an uploaded payroll or tax document to text, where it is an image or scan	The document itself, transiently, before identifiers are removed	Canada
Amazon Web Services (Cognito)	Sign-in and account authentication, multi-factor authentication	Email address, phone number, session information	United States
Amazon Web Services (Bedrock)	AI-assisted analysis and drafting	Content of the request being analyzed; not retained after the request completes	United States
Intuit Inc. (QuickBooks)	Invoicing, where an agency connects its own accounting system	Billing contact name and email, invoice amounts	United States
Google LLC (Google Analytics)	Analytics on our public marketing website only, not the signed-in product	IP address, browsing activity	United States

6. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

7. Security Safeguards

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, or alteration. However, no system is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Subject to applicable law, you have the right to:

Access your personal information
Request correction of inaccurate or incomplete information
Withdraw consent (where applicable)
Request deletion of your data, subject to legal or contractual obligations

9. Cookies and Tracking Technologies

We use cookies and similar technologies to enable core functionality, improve performance and user experience, and analyze usage trends. You can control cookie preferences through your browser settings.

10. Third-Party Services

Our Services may integrate with third-party platforms (e.g., Jira, GitHub, cloud services). Your use of those services is governed by their respective privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on our website, and the "Last updated" date will be revised accordingly.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

SREDr
Toronto, Ontario, Canada
Email: privacy@sredr.com