Privacy Policy

1. Overview

Ontyx ("we," "our," or "us") provides cloud-based business management software for Canadian businesses. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our service.

By using Ontyx, you consent to the data practices described in this policy. If you do not agree with the terms of this privacy policy, please do not access the service.

2. Information We Collect

Information You Provide

• Account Information: Name, email address, password, phone number
• Business Information: Business name, address, industry, tax numbers (GST/HST)
• Financial Data: Invoices, expenses, inventory, customer records you create
• Payment Information: Billing address, payment method (processed by Stripe)
• Communications: Support requests, feedback, and correspondence

Information Collected Automatically

• Usage Data: Features used, pages visited, actions taken
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, referring URLs
• Cookies: Session cookies, preference cookies (see Cookies section)

Information from Third Parties

• OAuth Providers: If you sign in with Google, we receive your name and email
• Integrations: Data from connected services (banking, accounting software)

3. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze usage patterns and trends
• Detect, investigate, and prevent fraudulent transactions
• Personalize and improve your experience
• Comply with legal obligations including tax reporting

Canadian Tax Compliance

We use your business and transaction data to help you comply with Canadian tax requirements, including GST/HST/PST calculations and reporting. This data is processed only as necessary to provide these features.

4. Information Sharing

We do not sell your personal information. We may share information with:

Service Providers

• Hosting: Supabase (database and authentication)
• Payments: Stripe (payment processing)
• Email: Resend (transactional emails)
• Analytics: Privacy-focused analytics tools

Legal Requirements

We may disclose information if required by law, court order, or government request.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change.

With Your Consent

We may share information with your explicit consent for purposes not covered here.

5. Data Security

We implement appropriate security measures including:

• Encryption: All data is encrypted in transit (TLS) and at rest
• Access Controls: Role-based access with audit logging
• Infrastructure: Secure, monitored cloud infrastructure
• Authentication: Secure password hashing, optional 2FA
• Regular Audits: Security assessments and penetration testing

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as your account is active or as needed to:

• Provide the Service to you
• Comply with legal obligations (e.g., tax records for 7 years)
• Resolve disputes and enforce agreements

Upon account deletion, we will delete or anonymize your data within 30 days, except where retention is required by law.

7. Your Privacy Rights

Under PIPEDA and applicable provincial laws, you have the right to:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Export: Download your data in a portable format
• Withdraw Consent: Withdraw consent for data processing
• Complain: File a complaint with the Privacy Commissioner of Canada

To exercise these rights, contact us at privacy@ontyx.ca. We will respond within 30 days.

8. Cookies & Tracking

We use cookies and similar technologies for:

• Essential Cookies: Required for the Service to function (authentication, security)
• Preference Cookies: Remember your settings and preferences
• Analytics Cookies: Understand how you use the Service

We do not use third-party advertising cookies. You can control cookies through your browser settings, but disabling essential cookies may affect functionality.

9. Children's Privacy

Ontyx is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected information from a child, we will delete it immediately.

10. International Data Transfers

Your data is primarily stored in Canada. Some of our service providers may process data in other countries. When transferring data internationally, we ensure appropriate safeguards are in place, including:

• Standard contractual clauses
• Data processing agreements
• Compliance with applicable privacy laws

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

We encourage you to review this Privacy Policy periodically for any changes. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact our Privacy Officer:

• Email: privacy@ontyx.ca
• Mail: Ontyx Privacy Officer, Toronto, Ontario, Canada

You may also contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.