Privacy Policy

1. Who we are and what this policy covers

NextiaTax is operated by Nextia AI (“Nextia,” “NextiaTax,” “we,” “us,” or “our”). This Policy applies to the NextiaTax web and mobile applications, marketing website, support, billing, and related communications.

We manage personal information under the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and, where applicable, substantially similar provincial laws in Alberta, British Columbia, and Quebec. Our privacy contact acts as the person responsible for privacy inquiries and can be reached at [email protected].

2. Information we collect

Account and identity information

Name, email address, user identifier, preferred language, authentication metadata, account roles, workspace memberships, invitations, and optional phone number.

Business and bookkeeping information

Business profile details; receipts, invoices, bills, and attachments; transaction, category, tax, project, vendor, payment, and currency information; notes; imports; exports; and review history. Documents may contain personal information about you or other people.

AI and document-processing information

Uploaded document content, extracted text and fields, assistant questions and answers, feedback, token and usage counts, confidence signals, and links to records used to generate an answer.

Billing information

Plan, billing interval, subscription status, Stripe customer and subscription identifiers, invoices, payment status, and limited payment metadata supplied by Stripe. We do not receive or store your full payment-card number.

Bank-connection information

If bank feeds are enabled, we may receive account identifiers, institution information, balances, transaction data, connection status, and an encrypted provider access token. Plaid handles the bank-authentication flow; NextiaTax does not receive your bank username or password.

Support, notifications, and device information

Support requests and replies, communication preferences, consent records, notification history, mobile push tokens, app platform and version, and optional WhatsApp opt-in information.

Technical and usage information

IP address, device and browser details, request and security logs, timestamps, diagnostic events, feature usage, error and performance telemetry, and audit records. The marketing website also uses limited browser storage as described in our Cookie & Local Storage Policy.

3. Information we do not intentionally store

• Your NextiaTax password or third-party sign-in password—authentication is handled by Microsoft Entra External ID.
• Your complete payment-card number or card security code—payment entry is handled by Stripe.
• Your online-banking username or password—bank authentication is handled by Plaid when bank feeds are enabled.

4. How we collect information

We collect information directly from you and workspace members; automatically when you use the service; from files and records you import; and from providers such as Microsoft Entra, Stripe, Plaid, mobile push platforms, and integration partners you choose to use.

5. Why we use information

• create and secure accounts and enforce workspace permissions;
• store, extract, categorize, organize, search, summarize, and export bookkeeping records;
• provide the AI assistant and document-reading features;
• calculate usage, apply plan limits, process billing, and prevent fraud;
• deliver support, service notices, billing messages, email, optional WhatsApp, and mobile push notifications;
• monitor reliability, diagnose errors, maintain audit trails, and protect users and systems;
• improve features using aggregated, de-identified, or appropriately protected information; and
• comply with law, enforce agreements, and establish or defend legal claims.

We do not use Customer Content to advertise to you based on the contents of your financial records. We do not sell personal information.

6. Consent and your choices

We seek meaningful consent by explaining the important information collected, purposes, providers, and reasonably foreseeable consequences. Some processing is necessary to provide the service you request; if you withdraw consent for necessary processing, we may be unable to continue the affected feature or account.

Optional channels such as WhatsApp and mobile push have separate controls. Marketing messages, if introduced, will follow Canada’s anti-spam rules and include an unsubscribe method. Transactional, security, billing, and account messages may still be sent when needed to provide the service.

7. AI, extraction, and automated processing

NextiaTax uses Microsoft Azure AI services to extract text and fields from documents, suggest categories, and generate assistant responses. Results may be inaccurate, so the product is designed for human review. NextiaTax does not use these tools to make a solely automated decision that determines your legal rights, tax liability, access to credit, employment, or eligibility for a government benefit.

Microsoft’s current Azure documentation states that prompts, completions, and customer data for models sold by Azure are not made available to other customers or model providers and are not used to train foundation models without the customer’s permission or instruction. Service processing and abuse-monitoring practices remain subject to Microsoft’s applicable terms.

8. When we share information

We may disclose information:

• to members and administrators of the same workspace according to their roles;
• to service providers listed on our Sub-processors page, under contractual or other safeguards;
• when you direct us to connect an integration, invite an accountant, or export information;
• to comply with a valid legal process or protect rights, safety, and security;
• in connection with a financing, merger, reorganization, or sale, subject to confidentiality and applicable law; or
• with your consent or as otherwise permitted by law.

9. Canada hosting and cross-border processing

NextiaTax’s core application database and customer-file storage are configured in Canadian Azure regions. This does not mean every processing activity stays in Canada. Identity, payment, content-delivery, email, mobile push, support, and some AI deployment types may process or store limited information in the United States or other jurisdictions.

Information processed outside Canada may be subject to the laws and lawful-access processes of that jurisdiction. We remain accountable for personal information under our control and use contracts and other measures intended to provide appropriate protection.

10. Retention

We keep personal information only as long as reasonably needed for the purposes described in this Policy, including while an account is active and for appropriate periods afterward for backup recovery, security, fraud prevention, billing, tax, dispute, audit, and legal obligations.

Different records have different retention needs. Deleting an item in the product may first mark it as deleted before permanent removal from active systems and backups. Account-deletion requests are reviewed because business records may be shared with other workspace members and some audit, transaction, or billing information may need to be retained or de-identified.

11. Security and privacy incidents

We use administrative, technical, and physical safeguards appropriate to the sensitivity of financial and identity information, including encryption in transit and at rest, server-enforced access controls, secrets management, logging, and audit trails. No system is perfectly secure.

We assess privacy incidents and, where required, notify affected individuals and the appropriate privacy regulator when a breach creates a real risk of significant harm or meets another applicable reporting threshold.

12. Your privacy rights

Subject to applicable law and identity verification, you may:

• request access to personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• download available account and business data;
• request deletion or de-identification where appropriate;
• withdraw consent for optional processing;
• request information about our use of service providers and cross-border processing; and
• where Quebec law applies, request that eligible information be provided in a structured, commonly used technological format.

Some requests may be limited by another person’s privacy, shared-workspace rights, technical feasibility, legal privilege, or retention obligations. Contact [email protected] to make a request or challenge our compliance.

13. Complaints

Please contact us first so we can investigate. You may also contact the Office of the Privacy Commissioner of Canada or, where applicable, the privacy regulator in Alberta, British Columbia, or Quebec.

14. Children

NextiaTax is a business product and is not directed to children. You must be at least the age of majority where you live to create an account.

15. Changes to this Policy

We may update this Policy as our practices, providers, or legal obligations change. We will post the revised version and update the date above. We will provide additional notice if a change is material and seek consent where required.

16. Contact the privacy lead

Email [email protected]. Before public launch, this Policy should also identify the confirmed legal entity and business mailing address.