Privacy Policy

• TaxGrit does not file tax returns, submit documents, or transmit data to any government authority.
• TaxGrit does not access, connect to, or retrieve information from the Canada Revenue Agency or any government system.

All tax-related information entered into the app is manually provided by users. Any documents, forms, or exports generated using TaxGrit must be manually submitted by the user to official government platforms of their choice.

We collect information only when users voluntarily provide it or when it is required for core functionality.

A. Account Information

• Name
• Email address
• Phone number (if provided)
• Login credentials

B. Tax Preparation Information (User-Entered)

• Income details
• Deductions and credits
• Spouse and dependent information
• Other tax-related information manually entered by the user

C. Documents Uploaded by Users

• Receipts
• Statements
• Tax-related PDFs, images, and documents

D. Communication Data

• Messages sent through in-app chat with a private tax professional or firm
• Support tickets and help desk communications

E. Electronic Signatures

• Signatures applied by users to documents within the app

F. Connected Email and Calendar Accounts (Firm Users)

Tax firms using our firm dashboard may optionally connect their own email and calendar accounts (such as Google Gmail and Google Calendar, or Microsoft Outlook) to manage client correspondence and schedule client meetings from within the platform. Where a firm connects a Google account, this may include email content and metadata (senders, recipients, subjects, message bodies, and attachments) and calendar event details. This is covered in detail under “Third-Party Integrations and Google User Data” below.

TaxGrit does not:

• Automatically collect tax data
• Retrieve information from CRA or any government system
• Access bank accounts
• Track users across other apps or websites
• Use personal data for advertising or profiling
• Sell or rent personal data

For security, stability, and performance only, we may automatically collect:

• Device type
• Operating system and app version
• Login timestamps
• Error logs and crash diagnostics

This data never includes tax content, uploaded documents, or financial details.

We use collected information solely to provide and operate the platform, including to:

• Allow users to enter and organize tax-related information
• Securely store uploaded documents
• Track preparation and workflow progress
• Send reminders and notifications
• Enable communication with selected tax professionals or firms
• Support electronic signatures
• Provide customer support
• Prevent unauthorized access and fraud
• Maintain system security and performance

TaxGrit offers optional integrations that let a tax firm connect its own email mailbox and calendar accounts, including Google (Gmail and Google Calendar) and Microsoft (Outlook), so the firm can manage client email and schedule client meetings directly within our firm dashboard. These integrations are enabled only when an authorized firm user explicitly connects an account through the provider’s official sign-in and consent screen, and they can be disconnected at any time.

Compliance with Google’s API Services User Data Policy

TaxGrit’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google Data We Access and Why

When a firm connects a Google account, TaxGrit requests only the access needed to operate the connected features, and only for the following purposes:

• View email (Gmail read access): to display the firm’s connected inbox inside TaxGrit, including message senders, recipients, subjects, message bodies, and attachments, and to associate incoming client emails with the correct client file.
• Send email (Gmail send access): to send replies, forwards, and messages from the firm’s connected mailbox at the firm’s direction.
• Manage calendar events (Google Calendar events access): to create, update, and cancel calendar events for meetings the firm schedules in TaxGrit, to generate video conferencing (Google Meet) links, and to send calendar invitations to attendees.
• Basic account email: to identify and display which Google account is connected.

Signing in to TaxGrit with Google (where offered) uses only your basic Google profile information (such as your name and email) to authenticate you. It does not grant TaxGrit access to your Gmail messages or your Google Calendar.

How We Use and Protect Google User Data

We use Google user data solely to provide and improve the user-facing email and calendar features described above. We do not:

• Sell Google user data to any third party;
• Use or transfer Google user data for advertising, marketing, or profiling;
• Use Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models;
• Transfer Google user data to others except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition in which the recipient continues to honor this policy.

Human access to Google user data is not permitted except in the limited cases allowed by Google’s policy: with the firm’s explicit consent (for example, to resolve a support request you make), where necessary for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymized.

Storage, Retention, and Deletion of Google User Data

• To keep the connected inbox current, incoming email content and metadata (subject, sender, recipients, message body, and attachment information) may be securely stored within TaxGrit and periodically synchronized. Attachments a firm chooses to keep may be filed into the firm’s secure document storage.
• Calendar event content is written directly to your connected Google Calendar; TaxGrit does not maintain a separate copy of your existing calendar events.
• Access and refresh credentials (OAuth tokens) for connected Google accounts are encrypted at rest using industry-standard AES-256 encryption and are never shared with or exposed to other users.
• When a firm disconnects a Google account, TaxGrit revokes its access with Google and stops accessing the account. Stored email data is retained only while the account is active and is deleted upon account closure, unless retention is required by law. You may request deletion of connected-account data at any time by contacting privacy@taxgrit.com.

If invoices or payments are displayed in the app:

• Payments are processed by trusted third-party payment processors
• TaxGrit does not store full credit or debit card numbers
• Financial information is handled securely by compliant payment providers

TaxGrit does not sell personal data, and our policy does not allow for the sale of Google user data to third parties.

We may share information only in the following limited circumstances:

• With secure service providers (cloud hosting, authentication, storage) under strict confidentiality obligations
• When required by law, court order, or legal process

TaxGrit does not share personal or tax-related data with the Canada Revenue Agency or any government authority.

For details on how we handle data accessed through connected Google or Microsoft accounts, see “Third-Party Integrations and Google User Data” above.

We use industry-standard safeguards to protect your data, including:

• Encrypted data storage
• Secure authentication and access controls
• PIN, password, and optional two-factor authentication
• Continuous monitoring for unauthorized access

• Data is retained only while an account is active
• Users may delete documents or close their account at any time
• Firms may disconnect any linked Google or Microsoft email or calendar account at any time, which revokes our access to that account
• Upon account deletion, data is permanently removed unless retention is legally required

Users have the right to:

• Access and review their personal data
• Correct or update inaccurate information
• Download or export their data
• Delete their data or account
• Contact support for privacy-related requests

TaxGrit is not intended for children under the age of 13. We do not knowingly collect personal information from children.

TaxGrit complies with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA).

We may update this Privacy Policy from time to time. Any changes will be reflected by updating the “Last updated” date. Users are encouraged to review this policy periodically.

For questions or requests related to privacy or data protection:

Email: privacy@taxgrit.com

Website: https://www.taxgrit.com