Privacy policy
This policy explains what personal information we collect through this website, why we collect it, who we share it with, how long we keep it and what you can ask us to do with it. It applies to rmacpa.ca, our consultation form and Eliot, our AI assistant. Work we do for clients is covered by our engagement letters and our professional duty of confidentiality.
Who we are
RMA Professional Corporation ("RMA", "we", "us") is a chartered professional accounting firm at 69 Lebovic Ave, Suite D207, Toronto, Ontario M1L 0H2. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA), and as members of CPA Ontario we are bound by its Code of Professional Conduct, which includes a duty to keep client information confidential.
Our Privacy Officer is Arief, the firm's director. He is accountable for how we handle personal information and answers every privacy question and request. He may pass a request to another member of our team, but he stays responsible for it. You can reach the Privacy Officer at the details in Contact us.
What we collect
We only collect what you choose to give us, plus the technical minimum that any website receives.
- Consultation form. Your name, email address, phone number, the service you need help with and, if you add one, a short message.
- Chat with Eliot. The messages you type. If you ask Eliot to have the team contact you, it also asks for your name, email address and phone number.
- Technical information. Your IP address and basic browser details, which every website receives when your browser asks for a page. We use your IP address only for a short time, in memory, to stop the chat from being flooded with messages. We do not store it with your chat.
Please do not send us your Social Insurance Number (SIN), bank details or financial documents through the website. When you become a client, we collect those through a secure channel.
Why we collect it
- To answer your question and to arrange your free consultation.
- To follow up on a conversation you started with Eliot, when you asked us to.
- To review chat conversations so we can correct mistakes Eliot made and improve its answers.
- To keep the website and the chat secure and available, for example by limiting how many messages one connection can send.
We do not sell personal information, and we do not use it for advertising. If you become a client, we use your information only for the work you engage us to do.
Eliot, our AI assistant
Eliot is an artificial intelligence (AI) assistant, not a person and not an accountant. It answers general questions about our services, documents and deadlines, and it can pass your details to our team so we can book your free consultation. It does not make decisions about you, it does not give personal tax advice and it can make mistakes.
When you send a message, it travels from our website to OpenRouter, which passes it to an AI model made by Anthropic, run on Amazon Web Services or Google Cloud, to write the reply. We have set OpenRouter to use only AI providers that do not keep your messages after the reply is written (zero data retention), and to never use your messages to train AI models.
Separately, a copy of the conversation is saved in our own records so our team can follow up and check Eliot's answers (see How long we keep it). Do not enter your SIN, account numbers or other financial details in the chat.
Service providers
We use a small number of companies to run this website. They process personal information only on our behalf and only to provide their service to us. We remain responsible for your information while they handle it.
- Netlify hosts this website, runs the chat connection and receives consultation form submissions.
- OpenRouter routes chat messages to the AI model.
- Anthropic makes the AI model that writes Eliot's replies.
- Amazon Web Services and Google Cloud run that AI model for OpenRouter, without keeping your messages.
- Google stores chat conversations and contact requests in Google Sheets and delivers email alerts to our team through Gmail.
- Hostinger hosts the server that runs our automation software (n8n), which moves chat conversations and contact requests from the website into Google Sheets and email.
We may also disclose personal information when the law requires it, for example in response to a court order.
Processing outside Canada
Our service providers store and process information outside Canada, mainly in the United States. The server that runs our automation software is in India. While your information is in another country, it is subject to that country's laws and may be accessible to its courts, law enforcement and national security authorities.
We choose providers that protect information to a standard comparable to ours, and we remain accountable for your information wherever it is processed.
Your consent
When you send the consultation form, or give Eliot your contact details and ask us to contact you, you consent to us using that information for the purposes in this policy. Before your first message, Eliot shows a short notice about how the chat works, and the chat only starts when you choose "Start chat". By choosing it, you consent to your messages being processed as described in Eliot, our AI assistant.
You can withdraw your consent at any time by contacting our Privacy Officer. We will then stop contacting you and delete your enquiry, unless the law requires us to keep it. If you withdraw consent, we may not be able to answer your question or book your consultation.
How long we keep it
- Chat conversations are deleted automatically 12 months after the conversation.
- Contact requests from the form or the chat are kept for up to 24 months after you send them, and then deleted, unless you become a client.
- If you become a client, your information becomes part of your client file and is kept for as long as the law and our professional standards require.
When we no longer need information, we delete it.
How we protect it
We treat what you send us as confidential. The website and the chat use encrypted (HTTPS) connections, access to stored enquiries is limited to our team, and our accounts are protected with passwords and access controls. No method of sending or storing information is completely secure, so some risk remains; this is one reason we ask you not to send sensitive financial details through the website.
If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires.
Your rights
You can ask us whether we hold personal information about you, see that information, learn how it has been used and who it has been shared with, and ask us to correct it or delete it. Send your request to our Privacy Officer. We will reply within 30 days. There is no charge for most requests; if a request would cost us significantly to answer, we will tell you the approximate cost first and you can decide whether to go ahead.
We may need to confirm your identity before we act on a request. If the law lets or requires us to refuse part of a request, we will tell you why.
Complaints
If you have a concern about how we handle your personal information, please contact our Privacy Officer first so we can try to fix it.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3, toll-free 1-800-282-1376, www.priv.gc.ca.
Changes to this policy
We update this policy when the way we handle personal information changes. The date at the top of the page shows when it last changed. If a change affects information we already hold, we will ask for your consent where the law requires it.
Contact us
Arief, Director and Privacy Officer
RMA Professional Corporation
69 Lebovic Ave, Suite D207, Toronto, ON M1L 0H2
Email: info@rmacpacga.com (please put "Privacy" in the subject line)
Phone: (416) 573-3652