Privacy Policy

This Privacy Policy explains how Foundero Inc. (“Foundero”, “we”, “us”) collects, uses, discloses, and protects your personal information when you use foundero.ai and our incorporation services (the “Service”).

Foundero helps you incorporate a business in Ontario. We are a document-preparation and filing-assistance service. We are not a law firm and do not provide legal advice.

By using the Service, you consent to the practices described here.

Account information: name, email address, password (hashed), and authentication identifiers.

Incorporation information (you provide this to generate and file your corporate documents):

• Director / officer / shareholder full legal names
• Residential or service addresses
• Date(s) where required by the filing
• Share ownership and corporate structure details
• Social Insurance Number (SIN): if and when we offer to register a sole proprietorship for a Business Number or GST/HST account, we will collect your SIN only where the Canada Revenue Agency requires it for that registration. In that case, we will treat your SIN as pass-through data — transmitted over TLS and held only in short-lived encrypted storage while we complete the CRA registration, then permanently deleted. We would never write it to our database, logs, or email, and would keep only an audit record that it was used and destroyed — never the number itself.

Payment information: processed by Stripe. We do not store your full card number; we receive only a token and limited transaction metadata.

Government-issued identifiers received on your behalf: after incorporation, the Ontario Business Registry issues a Company Key (a confidential 9-digit credential granting authority over your corporation). We handle this with heightened safeguards (see §7).

Usage / technical data: IP address, device/browser type, and pages visited, for security and service operation.

We use your personal information to: (a) create and secure your account; (b) generate your corporate documents; (c) submit filings to the Ontario Business Registry on your behalf under your authorization; (d) process payment; (e) send transactional notices about your incorporation; (f) provide support; (g) meet legal/record-keeping obligations. We do not sell your personal information.

We collect, use, and disclose personal information with your consent, which you give by providing the information and using the Service for the purposes above. You may withdraw consent (see §8), subject to legal/contractual limits — note that withdrawing consent mid-incorporation may make us unable to complete your filing.

We use the following third-party processors to operate the Service. Each receives only the data needed for its function.

Note: ServiceOntario / OBR is a government registry we file with, not a commercial processor — but it is listed for transparency because your data is transmitted there.

Some processors above store or process data in the United States. PIPEDA permits this but requires we tell you: while data is in another country, it may be accessible to that country's courts/law enforcement under their laws. We use processors that contractually commit to protecting your data. Your core account and incorporation data is stored in Canada (Supabase, ca-central-1 region); cross-border processing is limited to the third-party processors identified above, each of which we engage under data-processing terms requiring a level of protection comparable to what PIPEDA requires.

We use encryption in transit (TLS) and at rest, access controls, and least-privilege practices.

Company Key — heightened handling: your Company Key is encrypted at rest, never sent in plain text by email, and access-logged on every read. This is a confidential credential; treat it like a password.

You may: (a) access the personal information we hold about you; (b) request correction of inaccurate data; (c) withdraw consent (subject to §4 limits); (d) request deletion of your data, subject to legal record-keeping requirements (e.g., we may need to keep certain financial records for six years to meet Canada Revenue Agency requirements). To exercise these, contact our Privacy Officer (§11). We respond within 30 days as required by PIPEDA.

We keep personal information only as long as needed for the purposes above, or longer where the law requires. In practice, that means keeping it while your account is active, and afterward for any period the law sets — for example, the Canada Revenue Agency's six-year record-keeping rule for financial records. After that, we securely delete or anonymize it.

We use cookies and similar technologies that are necessary to run the Service — for example, to keep you signed in and to protect your session. We may also use limited, aggregated analytics to understand how the Service is used so we can improve it. Where the law requires consent for non-essential cookies, we will ask for it. You can manage cookies through your browser settings, though disabling essential cookies may prevent parts of the Service from working.

Privacy Officer: support@foundero.ai

Written correspondence: please reach our Privacy Officer at the email address above.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

When we file your registration with the government, the official email address on the filing is our filings inbox (filings@foundero.ai). Government notices about your registration are delivered there, and we pass them on to you at the email address on your account. This lets us track government correspondence and deadlines on your behalf.

We may update this policy. Material changes will be notified by email or in-app. The “last updated” date reflects the current version.