Last updated: March 2026
SR&EDgpt ("we," "us," or "our") provides an AI-powered platform that helps Canadian companies prepare Scientific Research and Experimental Development (SR&ED) tax incentive claims. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our website, platform, and services (collectively, the "Service").
We are committed to protecting your privacy and complying with applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.
Account Information: Name, email address, company name, job title, and province of operation when you register, contact us, or join our waitlist.
Claim Data: R&D project descriptions, employee salaries, subcontractor costs, materials consumed, and other financial and technical details you provide to prepare your SR&ED claim.
Usage Data: Browser type, operating system, IP address, device identifiers, pages visited, features used, timestamps, and interaction patterns collected automatically when you use the Service.
Payment Information: Payment details are processed by our PCI-compliant third-party payment processor (Stripe). We do not store credit card numbers, bank account details, or other sensitive payment credentials on our servers. We may retain transaction IDs and billing records for accounting purposes.
Communications: Records of your communications with us, including support requests, feedback, and correspondence sent via our contact form or email.
Waitlist Data: If you join our waitlist, we collect your email address and company name solely to notify you about product updates and launch availability. Waitlist data is not shared with third parties and will be deleted within 30 days of your request. You may unsubscribe or request deletion at any time by emailing hello@sredgpt.com.
We process your personal information on the following legal bases:
We use your information to:
We will never use your identifiable claim data to train our AI models. Only fully anonymized and aggregated data patterns may be used for model improvement.
Our platform uses artificial intelligence operating within a RAG (Retrieval-Augmented Generation) and Knowledge Base architecture to generate technical narratives, eligibility assessments, and claim documentation.
We implement technical and organizational measures to protect your information:
While we use commercially reasonable safeguards, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
You may request deletion of your claim data at any time by emailing hello@sredgpt.com or through your account dashboard. We will complete deletion within 30 days of your request. Claim data not subject to a deletion request is retained for up to 30 days following your last login, after which it is permanently deleted.
We retain the following for legitimate business purposes:
We do not sell, rent, or trade your personal information. We may share information only in the following limited circumstances:
All third-party service providers are contractually bound to protect your data and use it only for the purposes we specify.
Under PIPEDA and applicable provincial privacy laws, you have the right to:
To exercise any of these rights, contact us at hello@sredgpt.com. We will respond to your request within 30 days.
We use the following types of cookies and similar technologies:
You can manage cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Service.
In the event of a data breach that poses a real risk of significant harm, we will:
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child, we will promptly delete it.
Your stored data (account information, documents, and records) is hosted within Canada. However, during claim generation, limited data may be transmitted to third-party AI service providers (such as Anthropic) whose servers are located in the United States. This data is transmitted securely via encrypted connections, used solely for processing your claim, and is not retained by these providers beyond the processing session.
We ensure that any cross-border data transfers are subject to appropriate contractual safeguards and data processing agreements that provide a level of protection consistent with PIPEDA. We also use Google Analytics, operated by Google LLC in the United States, which may process anonymized usage data outside Canada under Google's data processing terms.
We may update this Privacy Policy from time to time. Material changes will be communicated by posting the updated policy on our website with a revised "Last updated" date and, where appropriate, via email notification at least 30 days before taking effect. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.
If you have questions about this Privacy Policy, our data practices, or wish to exercise your privacy rights, contact us:
You may also file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.