Privacy policy

Who we are

Billsera (181 Mill Street, Toronto, Ontario) runs billsera.ca and is responsible for the personal information described here.

We have a Privacy Officer who is accountable for how we handle personal information. For any privacy question or request, email them at hello@billsera.ca.

What we collect

When you send a form: your name and email, and, if you choose to give them, your phone or WhatsApp number, province, the package you're interested in, your timeline and a message. Partners also give their firm, what kind of firm it is and roughly how many clients need a company each year. We also record whether you ticked the box for updates.
When you become a client: government ID, proof of address, who owns and controls the company, where the starting funds come from, and details about your business. We collect these after the call, through a secure upload link or our identity-verification provider, never by email or chat.
To stop spam: Cloudflare Turnstile checks that a real browser sent the form. We also use your IP address to limit repeat submissions. We keep it only as a scrambled (salted hash) value and delete it after one day.
Analytics: how people use the site. Session recordings and analytics cookies only if you accept them. See "Analytics and cookies" below.

Why we use it

To reply to your enquiry and book your call.
To send the partner pack, or one email when we open in the UK.
To deliver the services you buy: filings, registrations, account applications, your website and, if you choose a monthly plan, your bookkeeping.
To verify your identity, check who owns the company and screen owners against sanctions lists before we file anything. Banks and payment providers expect this, and the law requires some of it.
To send occasional updates, only if you ticked the box. Every update has a way to stop them.
To keep the site secure and stop abuse.

We don't sell personal information, and we don't use it for advertising.

Who we share it with

We share only what each one needs to do its job:

Supabase: our database, hosted in Canada.
Vercel: hosts this website.
Resend: sends our emails.
Telegram: alerts our team to a new enquiry with your first name and a reference number only.
Cloudflare Turnstile: the spam check on our forms.
PostHog: website analytics.
When you're a client: the government registries and tax authorities we file with, the banks and payment providers you apply to, our partner accountant (CPA), our identity-verification provider and our e-signature provider.
If a partner (for example, your immigration lawyer) introduced you, we share progress updates on your setup with them.

Where it's stored

We store Canadian clients' information in Canada. UK waitlist sign-ups are stored in Canada too for now. Once we open in the UK, UK clients' information will be stored in a separate project in the UK.

Some of the providers above, including Vercel, Resend and PostHog, may process information in the United States. While it's there, it's covered by local law, and authorities there may be able to access it.

How long we keep it

Enquiries and waitlist sign-ups that don't become clients: 24 months after we last hear from you, then deleted.
Client files: as long as the law requires us to keep them (for example, 7 years for UK identity-verification records), then deleted.
Spam-check values: one day.

How we protect it

Identity documents only come in through an encrypted upload link, never by email, Telegram or WhatsApp.
Information is encrypted in transit and at rest.
Only staff whose role needs it can see client information, and every access to client documents is logged.

Your choices and rights

You can ask to see the personal information we hold about you, correct it, or withdraw your consent. Withdrawing consent may mean we can't keep working with you. Email hello@billsera.ca and we'll reply within 30 days. You can stop updates at any time.

If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). UK residents can complain to the Information Commissioner's Office (ico.org.uk).

Analytics and cookies

We use PostHog to see how people use the site and where they get stuck in our forms, so we can make it easier to use.

By default it runs without cookies: nothing is stored on your device, and we only count visits. We record the pages you view, the site that sent you, your browser and device type, your approximate location (country and city, estimated from your IP address), and when a form is opened, started or sent.

If you click Accept in the cookie banner, PostHog also sets analytics cookies so it can recognise your visits, and records your sessions: a replay of how you moved around and clicked on the site. What you type into forms is always hidden in these recordings, so we never see your name, email, phone number or message there.

If you click No thanks, or don't choose, nothing changes: no cookies, no recordings. You can change your choice at any time with "Cookie settings" at the bottom of every page. If your browser sends a Do Not Track or Global Privacy Control signal, we record nothing at all.

We don't use this data for advertising and don't sell it. PostHog stores it on servers in the United States. We also keep a small record of your cookie choice, so we don't ask again on every page.

Changes

If we change this policy, we'll post the new version here with its date. Last updated: October 17, 2026.