Privacy Policy

Effective date: May 21, 2026 Last updated: May 21, 2026

This Privacy Policy explains how Amiron Ventures Inc. ("FileSimple," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with filesimple.ca, the FileSimple web application, and related services (the "Service").

We are committed to handling personal information responsibly and in accordance with the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA"), the Act respecting the protection of personal information in the private sector (Quebec) ("Quebec Privacy Act," as amended by Law 25), the Personal Information Protection Act (Alberta), the Personal Information Protection Act (British Columbia), and other applicable privacy laws.

1. Who we are and how to contact our Privacy Officer

The data controller responsible for your personal information is:

Amiron Ventures Inc. Registered office: Winnipeg, Manitoba, Canada

Privacy Officer: Email: privacy@filesimple.ca Mail: Privacy Officer, Amiron Ventures Inc., Suite 1200, 220 Portage Ave, Winnipeg, Manitoba R3C 0A5, Canada

You may contact the Privacy Officer for any privacy-related question, to exercise a right described in section 9, or to make a complaint.

2. What personal information we collect

We collect the following categories of personal information.

2.1 Account information

When you create an account, we collect your name, email address, password (stored as a salted hash, never in plain text), phone number (optional), and your role in the corporation you administer.

2.2 Corporate records

To prepare and submit filings, we collect and store information about the corporations you administer, much of which is personal information about identifiable individuals. This includes:

Directors and officers: legal name, residential or business address, date of appointment, date of birth where required by registry rules, and consent-to-act forms
Shareholders: legal name, address, number and class of shares held
Individuals with significant control (ISC): legal name, date of birth, residential address, jurisdiction of tax residence, citizenship, the nature and degree of control, and the date control was acquired or ceased
Registered office and records office addresses
Other minute book contents you choose to maintain in the Service, including resolutions and consents

Some of this information — for example, federal ISC particulars and director names — may be required by law to be disclosed to the applicable corporate registry, and in some cases made publicly available by that registry.

2.3 Payment information

When you pay for our Service, we collect billing name, billing address, and the last four digits of your payment card. Full card numbers are processed and stored by Stripe; we do not see or retain them.

2.4 Communications

We collect the content of your communications with us (support emails, chat messages, phone calls if applicable) and metadata about those communications.

2.5 Technical and usage information

When you use the Service we automatically collect: IP address, device type and operating system, browser type and version, pages viewed, links clicked, timestamps, and referring URLs. We use cookies and similar technologies as described in section 6.

2.6 Information you provide voluntarily

If you respond to a survey, request marketing materials, or upload supporting documents, we collect that information.

We do not knowingly collect personal information from children. The Service is intended for business use by adults.

3. Why we collect personal information (purposes)

We collect, use, and disclose personal information only for the following identified purposes:

To provide the Service: create and administer your account; pre-fill, prepare, and submit filings; generate documents and registers; transmit information to government registries on your behalf or your authorized direction
Billing and payment: process payments, issue receipts and invoices, prevent fraud, manage chargebacks
Customer support: respond to inquiries, troubleshoot, and improve service quality
Compliance reminders and service communications: send filing deadline reminders, registry status updates, security notices, and product updates
Legal and regulatory compliance: comply with applicable law, respond to lawful requests from authorities, enforce our Terms, and protect our rights, your rights, or the rights of others
Security and fraud prevention: detect and prevent unauthorized access, abuse, and security incidents
Service improvement and analytics: understand how the Service is used and improve it, in aggregated or de-identified form wherever feasible
Marketing — only with your consent: send promotional communications about FileSimple. You can withdraw consent at any time by clicking unsubscribe in any marketing email or contacting our Privacy Officer.

We will not use your personal information for any new purpose that is materially different from those above without obtaining your consent or as otherwise permitted by law.

4. Legal basis and consent

In Canada, personal information may generally be collected, used, and disclosed only with the consent of the individual, subject to limited statutory exceptions.

For account creation and the core Service: by creating an account and using the Service, you provide express consent for us to collect, use, and disclose your personal information for the purposes described in section 3.
For sensitive information (such as ISC particulars and dates of birth): we collect with express consent and only as required to deliver the Service.
For marketing communications: we obtain separate, express opt-in consent.
For information about third parties (for example, your co-directors, officers, shareholders, or ISC individuals): you represent that you have the authority to provide their personal information to us for the purposes described in this Policy, and that you will inform them, where appropriate, of how their information will be handled.

You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent for core processing will result in our inability to provide the Service.

5. Who we share personal information with

We share personal information only as described in this section.

5.1 Government registries and authorized partners

We transmit filings and supporting personal information to federal, provincial, and territorial corporate registries in accordance with your instructions. For jurisdictions where we use a registry partner (an authorized intermediary that interfaces with the registry on our behalf), we share the necessary information with that partner for the sole purpose of completing your filing.

Registries may make some of this information publicly available in accordance with their statutory mandate. In particular, federal ISC information collected under the Canada Business Corporations Act is, since the coming into force of the relevant amendments, subject to a public-disclosure regime maintained by Corporations Canada. Provincial public-disclosure rules vary.

5.2 Service providers

We use a small number of vetted service providers ("processors") to operate the Service. They may access personal information only to perform services for us, under written agreement, and subject to confidentiality and security obligations:

Processor	Function	Location of processing
Amazon Web Services (ca-central-1)	Cloud hosting, storage, compute	Canada (Montreal)
Stripe Payments Canada, Ltd.	Payment processing	Canada / United States
Our email service provider	Transactional and (with consent) marketing email	Canada / United States
Our analytics provider	Product analytics	Canada / United States, depending on provider
DocuSign Canada, Inc. (or equivalent e-signature provider)	E-signature workflows	Canada / United States, depending on signing flow

A current list of our processors is available on request to the Privacy Officer.

5.3 Collaborators you invite

If you invite a collaborator to your account, we share with them the corporate records and personal information you authorize them to access. You are responsible for the appropriateness of those invitations.

5.4 Legal and protective disclosures

We may disclose personal information without your consent where permitted or required by law: to comply with a subpoena, warrant, court order, or other lawful request; to investigate suspected fraud or breach of the Terms; to protect the rights, property, or safety of FileSimple, our users, or others; or in connection with the investigation of a security incident.

5.5 Business transactions

If we are involved in a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, personal information may be transferred as part of that transaction. We will require the recipient to honour this Policy or notify you of any material change.

5.6 We do not sell personal information.

6. Cookies and similar technologies

We use cookies and similar technologies to operate the Service, remember your preferences, keep you signed in, measure usage, and improve security. Some cookies are strictly necessary; others (such as analytics cookies) are used only with your consent where required.

You can manage cookies through your browser settings. Disabling strictly necessary cookies will affect core functionality of the Service.

7. Where your personal information is stored and processed

We store the core of your personal information on Amazon Web Services infrastructure located in Canada (Montreal, ca-central-1 region).

Some of our service providers (notably Stripe for payments, our email provider, our analytics provider, and DocuSign for certain e-signature workflows) may process limited personal information in the United States. When this occurs:

The information processed outside Canada is limited to what is necessary for the function.
We have written agreements with these providers requiring a level of protection comparable to what is required under Canadian law.
Information processed outside Canada or Quebec may be subject to the laws of the foreign jurisdiction, including lawful access by foreign authorities. In particular, information processed in the United States may be subject to the Clarifying Lawful Overseas Use of Data Act (CLOUD Act), the Foreign Intelligence Surveillance Act, and related authorities.

Quebec residents: Under section 17 of the Quebec Privacy Act, we conduct a privacy impact assessment before communicating personal information outside Quebec and confirm that adequate protection is in place. You may contact the Privacy Officer for information about cross-border transfers affecting your personal information.

8. How long we keep personal information

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, to comply with legal, accounting, and regulatory requirements, to resolve disputes, and to enforce our agreements.

General retention guidelines:

Account and corporate records: for the life of your account, plus a reasonable archive period (we currently target seven (7) years) to support potential audit, tax, or regulatory requests
Filing history and supporting documents: seven (7) years from the filing date, consistent with general Canadian corporate and tax record-keeping practice
Billing records: seven (7) years to comply with Canadian tax law
Support communications: typically two (2) years
Marketing preferences: until you withdraw consent or your account is closed
System logs: typically 12 months

After the applicable retention period, we delete or anonymize the information. Where deletion is technically infeasible (for example, in archival backups), the information is isolated and protected from further use until deletion is possible.

9. Your rights

Subject to the applicable Canadian privacy legislation, you have the following rights with respect to your personal information:

9.1 Access

You have the right to request access to the personal information we hold about you, and to information about how it has been used and to whom it has been disclosed.

9.2 Correction

You have the right to request that we correct inaccurate or incomplete personal information.

9.3 Withdrawal of consent

You may withdraw consent to our processing at any time, subject to legal and contractual restrictions. Withdrawing consent for core processing means we may no longer be able to provide the Service.

9.4 Deletion (de-indexing and "right to be forgotten")

In Quebec, you have the right under the Quebec Privacy Act to request that we cease disseminating your personal information, that we de-index hyperlinks to it, or that we destroy it, in the circumstances set out in that Act. Comparable rights apply, in more limited form, under PIPEDA. You may exercise this right by contacting the Privacy Officer.

Note that we may be required to retain certain personal information that has already been transmitted to a registry, because public records held by the registry are outside our control.

9.5 Portability

To the extent required by the Quebec Privacy Act, you have the right to receive computerized personal information you have provided to us in a structured, commonly used technological format, or to have it transmitted to another person or body.

9.6 Automated decision-making

We do not currently use the Service to make decisions about you based exclusively on automated processing of personal information. If we begin doing so, we will inform you and provide the disclosures required by section 12.1 of the Quebec Privacy Act.

9.7 How to exercise these rights

Send a written request to privacy@filesimple.ca. We will respond within 30 days of receiving a complete request, or as soon as reasonably practicable, and in any event within the timeframes required by applicable law. We may need to verify your identity before responding.

If you are not satisfied with our response, you may file a complaint with the Privacy Officer first, and then with the appropriate regulator:

Office of the Privacy Commissioner of Canada — priv.gc.ca
Commission d'accès à l'information du Québec (Quebec residents) — cai.gouv.qc.ca
Office of the Information and Privacy Commissioner of Alberta (Alberta residents) — oipc.ab.ca
Office of the Information and Privacy Commissioner for British Columbia (BC residents) — oipc.bc.ca

10. Security

We use administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, loss, or destruction:

Encryption: AES-256 at rest, TLS 1.3 in transit
Access controls: role-based access, least-privilege principles, multi-factor authentication for administrative accounts
Network security: segmented production environments, monitoring, and logging
Vendor management: written data-processing agreements with all processors
Employee training and confidentiality obligations
Incident response plan and breach register consistent with the requirements of PIPEDA and the Quebec Privacy Act

No system is perfectly secure. If you believe your account has been compromised, please contact us immediately at support@filesimple.ca.

10.1 Breach notification

If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the appropriate regulator(s) as required by applicable law, and maintain a record of the incident in our breach register.

11. Children

The Service is intended for business use by adults. We do not knowingly collect personal information from individuals under 18. If we learn that we have collected personal information from a child, we will delete it.

12. Privacy by design

We design the Service with privacy in mind. By default, we collect only the personal information necessary to deliver the Service, restrict access to that information within our organization, and apply confidentiality and security obligations to all personnel and processors.

13. Changes to this Policy

We may update this Policy from time to time. If we make a material change, we will notify you by email or through the Service before the change takes effect. The "Last updated" date at the top of this Policy reflects the most recent version. Your continued use of the Service after a change means you accept the updated Policy.

14. Language

This Policy has been drawn up in English at the request of the parties. La présente politique a été rédigée en anglais à la demande des parties. A French version is available on request to Quebec residents.

15. Contact

For any privacy question, request, or complaint:

Privacy Officer Amiron Ventures Inc. Email: privacy@filesimple.ca Mail: Suite 1200, 220 Portage Ave, Winnipeg, Manitoba R3C 0A5, Canada