Privacy Policy

1. Introduction and Scope

Ridgewood Tax Services ("we," "us," or "our") is a tax preparation service operated in Quebec. This Privacy Policy explains how we collect, use, disclose, and protect your personal information in accordance with Quebec's Law 25 (Act respecting the protection of personal information in the private sector) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

This policy applies to all information collected through our website (ridgewood.tax), our online forms (forms.ridgewood.tax), and all related services.

2. Privacy Officer

Our Privacy Officer is responsible for ensuring compliance with privacy legislation and handling all privacy-related inquiries:

For any questions or requests concerning your personal information, please contact our Privacy Officer at the email address above. We will respond within 30 days of receiving your request.

3. Information We Collect

We collect personal information necessary to prepare and file your income tax return. This includes:

3.1 Identity Information

• Full legal name
• Date of birth
• Social Insurance Number (SIN)
• Mailing address
• Email address
• Phone number
• Marital status

3.2 Financial Documents

• Employment income (T4, RL-1 slips)
• Investment income (T5, T3, RL-3 slips)
• Tuition fees (T2202, RL-8)
• Self-employment income and expenses
• Rental income and expenses
• Deduction receipts (RRSP, medical expenses, charitable donations)
• Direct deposit banking information (optional)

3.3 Payment Information

• Credit card information (securely processed by Stripe)

3.4 Uploaded Documents

• Tax documents submitted via forms.ridgewood.tax
• Electronic signature data via our secure signing portal

3.5 Technical Information

• IP address and browser type (for security purposes)
• Form submission timestamps

4. How We Use Your Information

We use your personal information solely for the following purposes:

• Tax Preparation: To prepare your federal (T1) and Quebec provincial (TP1) income tax returns
• Document Extraction: Local AI processing to extract information from your tax documents
• Electronic Filing: To electronically file your returns with the Canada Revenue Agency (CRA) and Revenu Québec via the EFILE system
• Communication: To contact you about your return, request missing documents, or provide updates
• Payment Processing: To process your payment through our secure payment provider (Stripe)
• Electronic Signatures: To obtain your authorization via our secure signing portal before filing
• Legal Compliance: To meet our obligations under tax and privacy legislation

We do not use your information for marketing purposes, and we do not sell, rent, or trade your personal information to third parties.

5. Data Storage and Security (Law 25 Compliance)

5.1 Local AI Processing

Our document extraction system uses a locally-hosted AI model (Ollama llama3.2-vision:11b). This means:

• Your tax documents never leave our Canadian servers
• No data is sent to external AI providers (OpenAI, Google, etc.)
• All processing is performed on our Quebec infrastructure

5.2 Workflow Automation

Our automated processes are managed via n8n, a self-hosted platform on our Canadian infrastructure.

5.3 Data Storage

• Database: Hosted in Montreal, Canada (Supabase ca-central-1 region)
• Website Hosting: Cloudflare with Canadian data residency
• Encryption: All data is encrypted in transit (TLS/SSL) and at rest

5.4 Security Measures

• End-to-end encryption for all communications
• Strict access controls limiting who can view your information
• Documents stored on encrypted systems
• Regular audits of our security practices

6. Third-Party Service Providers

We use the following third-party service providers, all selected for their compliance with the highest security standards:

• Stripe: Payment processing (PCI-DSS compliant). Stripe never transmits your complete card information to us.
• Cloudflare: Website hosting and attack protection
• Supabase: Database hosted in Montreal (ca-central-1 region)

These providers only have access to information strictly necessary to provide their services and are contractually required to protect your data.

7. Who Has Access to Your Information

Access to your personal information is strictly limited to:

• Giovanni Qualizza, Licensed Tax Preparer: Preparer who prepares and files your return (EFILE number: U2457, Excinis Accounting Services Inc.)
• Ridgewood Tax operations team: For client communication and support
• CRA and Revenu Québec: When filing your return (with your authorization via T183/TP-1000.TE)

We do not share your information with any other third parties except as required by law.

8. Data Retention

We retain your personal information for seven (7) years from the date of filing, as required by the Canada Revenue Agency for tax records.

After this mandatory retention period, you may request the deletion of your information. We will then proceed with the secure deletion of all your data.

You may request earlier deletion of your information, subject to our legal retention obligations.

9. Your Rights Under Law 25

Quebec's Law 25 grants you the following rights regarding your personal information:

• Right of Access: You may request a copy of all personal information we hold about you
• Right of Rectification: You may request correction of inaccurate or incomplete information
• Right of Deletion: You may request deletion of your information (subject to the 7-year legal retention requirements)
• Right to Withdraw Consent: You may withdraw your consent at any time (note: this may prevent us from completing your tax return)
• Right to Portability: You may request your information in a commonly used and structured format

To exercise any of these rights, contact our Privacy Officer at info@ridgewood.tax. We will respond within 30 days.

10. Consent

By using our services and submitting your information through our forms, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy.

For sensitive information such as your Social Insurance Number, we obtain your explicit consent before collection.

11. Data Breach Notification

In the event of a data breach that poses a risk of significant harm, we will:

• Notify affected individuals as soon as feasible
• Report the breach to the Commission d'accès à l'information du Québec
• Take immediate steps to contain and remediate the breach
• Document the incident and our response

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on our website with a new "Last updated" date. We encourage you to review this policy periodically.

13. Contact Information

For Privacy Inquiries:

For Tax Preparation Services:

Website: ridgewood.tax