Privacy Policy

Last updated: October 22, 2026

Privacy officer

Privacy officer: Rahul Sharma - the person accountable for personal information at ComplyTrackr. Contact: privacy@complytrackr.com.

What we collect

• Account information: your email address and password (stored as a one-way hash).
• Business profile: the business details you enter (structure, province, tax accounts) to compute your compliance deadlines.
• Documents: files you upload (e.g. registration letters, filed returns).
• Device push tokens: if you use our mobile app, a push notification token so we can send deadline reminders.

How we use it

Your information is used solely to operate ComplyTrackr: computing your deadlines, sending reminders you opted into, and letting your team collaborate. We do not sell your data, and we do not share it with third parties except:

• Resend (transactional email delivery) and Firebase Cloud Messaging (push notifications) — only the minimum data needed to deliver your messages.
• When required by law.

Cookies

ComplyTrackr uses only essential, first-party cookies needed to sign you in and keep your account secure. We do not use advertising, analytics, or third-party tracking cookies, and no third party places cookies through this site.

• Session cookie: keeps you signed in and remembers which business you are working in, including during two-factor sign-in. It expires when you close your browser.
• Remember-me cookie (90 days): set only if you check "Keep me logged in" (or use biometric sign-in in our mobile app), so this device can sign you in without your password on each visit. Logging out ends it.
• Trusted-device cookie (30 days): set only if you check "Remember this device" during two-factor sign-in, so that device can skip the authenticator code next time. Your password is always still required.

All three cookies are httpOnly, are used only on ComplyTrackr, and are never used to track you across other websites. ComplyTrackr also stores interface preferences (such as your dashboard layout and calendar view) in your browser's local storage on your device only; they are not sent to us. If you block cookies in your browser settings, sign-in will not persist and device remembering will not work.

Data retention and deletion

Your data is retained while your account is active. You can schedule your account for deletion at any time from Security settings. Deletion comes with a 30-day recovery window: log in within 30 days to restore your account and everything in it. After 30 days, your profile, businesses, documents, and push tokens are permanently deleted.

Security

Passwords are hashed with PBKDF2. Data is transmitted over HTTPS. Server volumes are encrypted at rest.

Contact

Questions about this policy: info@zaalzo.com.