Your data

    Delete your Canada Compliance account

    You can delete your account and the personal information tied to it at any time, from the web app or the mobile app. This page explains how, what is removed, what we are required to keep, and what to do if you can no longer sign in.

    1. Delete from inside the app

    1. Sign in at canadacomplianceai.ca or in the Canada Compliance app.
    2. Open Dashboard → Account settings.
    3. Under “Danger zone”, choose “Request account deletion” and confirm.
    4. Your account is scheduled for deletion 30 days later. Until then you can cancel from the same screen.

    Signed in already? Go to Account settings.

    2. Request deletion without signing in

    If you have lost access to your account, email privacy@canadacomplianceai.ca from the address on the account, with the subject “Account deletion request”. We verify that the request comes from the account holder before acting on it, and we respond within 30 days as required under PIPEDA. Organization administrators can also remove a member from their organization in the dashboard.

    3. What is deleted

    When the 30-day grace period ends, the following is permanently deleted and cannot be recovered:

    • Your sign-in credentials, multi-factor devices and profile (name, email, avatar).
    • Your organization memberships and roles.
    • Compliance records created under your user: tasks, breach register entries, consent records and receipts, transfer assessments, self-assessment answers and scores.
    • Compliance reports generated under your user.
    • Data-export requests and any export files still in storage.
    • Your organization and its workspace, if you are its only member.

    You receive an email confirmation once the deletion has run. Want a copy of your data first? Use “Export my data” on the same Account settings screen; exports stay downloadable for 30 days.

    4. What we keep, and why

    RecordReason and period
    Payment and invoice recordsKept for 7 years to meet Canada Revenue Agency record-keeping requirements. Held by our payment processor, Stripe.
    Records created by other members of your organizationVendors, agreements, incidents, policies and the organization’s audit history are the organization’s compliance records and stay with it. Your identity, IP address and device details are removed from the audit history.
    Support correspondenceKept for 3 years for quality assurance and legal defence, as set out in the Privacy Policy.

    Full retention periods are listed in section 5 of our Privacy Policy. Retained records are not used to contact you or to market to you.

    5. Why there is a 30-day grace period

    Compliance records are hard to rebuild, so deletion is scheduled rather than immediate. During the 30 days your account keeps working and you can cancel the request with one click. A reminder email is sent before the deletion runs.

    6. Questions

    Privacy questions: privacy@canadacomplianceai.ca. Anything else: Support.