Cookies and privacy
Last updated: 30 September 2026.
The short version
- You can use the tools without an account. Nothing you type is saved unless you sign in and choose Save.
- To sign in, you give us your email address. We email you a one-time link. There is no password.
- We use your email to sign you in. We don't sell it, we don't show ads, and the sign-in email has no marketing in it.
- One essential cookie keeps you signed in for up to 30 days. We use no advertising cookies.
- Analytics stays off unless you choose Accept on the banner. We never send what you type into a tool.
- You can download your data or delete your account yourself, any time, from your account page. Deleting is immediate and can't be undone.
- We follow the principles of Canada's privacy laws in practice (PIPEDA, and Law 25 in Quebec). Privacy questions: hello@cyberimmune.com.
What we collect
- Your email address, only if you sign in. We use it to send you the sign-in link.
- What you choose to save. When you sign in and choose Save, we store the name you give it and the figures you typed into that tool, with the date. We don't store the result. We work it out again when you open the item.
- Basic technical data. When you load a page, our hosting keeps short-lived technical logs, such as the page requested, the time and your browser type. These logs may include your IP address.
- Cleaned error reports. If something breaks, the site can send a report with technical details only, such as the error type, the page type, the site version and the browser family. We remove personal data and anything you typed before a report leaves your browser.
- Feedback, if you use the feedback button: what you write, and your email address only if you choose to give it. Please don't put names, account numbers or real invoice amounts in feedback.
- Analytics events, only if you accept (see below).
We do not collect what you type into a tool unless you sign in and choose Save. We do not use advertising identifiers or ad pixels.
Why we use it
- To sign you in.
- To save your work and show it to you again.
- To keep the service working: fixing errors, preventing abuse and answering your feedback.
- With your OK, to see which tools get used so we can improve them.
What we don't do
- We don't sell your information.
- We don't show ads.
- We don't send marketing in the sign-in email. It contains your sign-in link and nothing else.
- We don't use advertising cookies, and we don't track you across other sites.
Cookies and similar storage
Essential (always on). These are needed for the site to work, so they are not optional.
- Sign-in. A session cookie keeps you signed in for up to 30 days on that browser. It is removed when you sign out.
- Language and preferences. We remember your language and similar settings.
- Your banner choice. We remember whether you chose Accept or Decline.
- Bot check. The sign-in and feedback forms use a bot check to tell people from automated programs. It is not used on the calculators, and the calculators never wait for it.
While you wait for your sign-in email, what you typed stays on the page in memory only. It is not written to your browser's storage or to our servers until you choose Save.
Optional (only after you accept). If you accept, we use PostHog to count how the tools are used. PostHog may store a small identifier in your browser to tell visits apart. If you decline, or ignore the banner, analytics stays off and the tools work the same. You can change your mind any time with Cookie choices in the footer.
What the analytics measure
After you accept, we record simple events, such as: a tool page was viewed, a tool was started, a result was shown, a copy, export or save button was selected, an account was created, the feedback button was opened, the language was switched, which kind of input error was shown (the type, never the value), and an entry was added or deleted in a list tool. Each event carries only general details: which tool, your language, whether you are on a phone, tablet or desktop, and the site version.
We do not turn on autocapture, session recording or heatmaps. We do not send what you type, your results, or your email address. Analytics is switched off on our test and preview versions of the site.
Where your data is kept and who handles it
We use these services to run Canada Business Kit. Some of them are outside Canada.
| Service | What it does for us | Where |
|---|---|---|
| Supabase | Sign-in, your account and your saved items | |
| An email sending service (Resend was chosen on 2026-09-30; not yet set up) | Sends your sign-in link, so it sees your email address and the message | Its account data is stored in the United States. |
| Vercel | Hosts the site and keeps short-lived technical logs | |
| Cloudflare Turnstile | Bot check on the sign-in and feedback forms | |
| PostHog | Analytics, only if you accept | Its US cloud |
| Sentry | Cleaned error reports | Outside Canada |
How long we keep things
- Sign-in link: works once and expires after 15 minutes.
- Your session: up to 30 days, or until you sign out.
- Your email and saved items: until you delete them, or delete your account.
Your choices
- Save or delete an item. You choose what to save. You can rename or delete any saved item.
- Download my data. On your account page, choose Download my data. You get one JSON file with your email address and everything you saved.
- Delete my account. On your account page, choose Delete my account, then type DELETE to confirm. Your account, your email address and everything you saved are deleted right away, and you are signed out. You can't undo this. The tools keep working without an account.
- Cookie choices. Change your analytics choice any time from the footer.
- Questions or requests. Write to us at hello@cyberimmune.com. That is also our contact for privacy questions.
Feedback
If you use the feedback button, we store what you write. The box that lets us contact you about your report starts unticked. Nothing you typed into a tool is attached to a report automatically.
Canadian privacy law
Two sets of rules shape how organisations in Canada handle personal information:
- PIPEDA (the Personal Information Protection and Electronic Documents Act) is the federal privacy law for private-sector organisations.
- Law 25 is Quebec's update to its privacy rules for private-sector organisations.
We follow the principles behind them in practice:
- We tell you what we collect and why. That is this page.
- We use it only for that.
- You can see it, download it and delete it yourself, from your account page.
- We take care to keep it safe.
For questions or requests about your personal information, write to hello@cyberimmune.com. That is our contact for privacy questions.
Who we are
Canada Business Kit is a product of CyberImmune.
CyberImmune
18 King St E, Suite 1400
Toronto, ON M5C 1C4, Canada
Canada Business Kit is a CyberImmune product and is not affiliated with the Government of Canada.
Changes to this page
If we change what we store or measure, we will update this page.