Skip to main content
Demo mode, registration is bypassed for review. Not production behavior.

Legal

Privacy Policy

How YBAWS Inc. (operating as Capital Toolkit) handles personal information you share with us.

Draft, pending final legal review. The terms below reflect our current operating practices and our PIPEDA obligations. They will be reviewed and amended by Canadian privacy counsel prior to public launch. If you have questions in the meantime, write to privacy@capitaltoolkit.com.

Effective Date: May 1, 2026. Last Updated: May 22, 2026.

YBAWS Inc.(“Capital Toolkit,” “we,” “us,” or “our”) is committed to protecting your privacy and handling personal information responsibly in full compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario and Canadian laws.

1. Who we are and accountability

Capital Toolkit is a Canadian platform that helps businesses organize and prepare financing application packages, primarily under the Canada Small Business Financing Program (CSBFP) and related programs. Our Privacy Officer is Sean Cavanagh, CPA. For any privacy questions or requests, contact privacy@capitaltoolkit.com. Mailing address available upon request.

2. Information we collect

We collect only what is necessary:

  • Contact and account information: name, email, phone, business details.
  • Application and financial information: tax returns (T1/T2), financial statements, bank statements, credit reports, ownership structure, personal net worth, supporting documents, and related details for financing applications.
  • Usage and technical data: IP address, browser info, access logs (for security and improvement).
  • Other: communications with us and any information you voluntarily provide.

3. How we use your information

  • To provide the platform services.
  • To prepare and submit application packages with your authorization.
  • To communicate with you and authorized third parties (lenders, your professionals).
  • To improve our services, ensure security, and comply with legal obligations.
  • To produce anonymized, aggregated research and reporting about the Canadian small-business financing landscape (for example, the State of CSBFP Lending annual report). Individual files are never identifiable in any published material; minimum sample-size thresholds are applied before any category or figure is published. You may opt out of inclusion in aggregate research at any time by emailing privacy@capitaltoolkit.com.

We do not sell your data, use it for marketing or advertising, or earn referral commissions from lenders.

4. Sharing your information

We share only with your explicit authorization or as required:

  • Lenders or financial institutions you specifically authorize.
  • Professionals you engage (CPA, lawyer, broker).
  • Service providers under strict contracts (for example, hosting, email, database providers like Supabase, AWS, Vercel, and Resend), all subject to PIPEDA-equivalent protections.
  • As required by law (court order, regulatory request).

Data may be stored in the United States or other jurisdictions; we use contractual safeguards to maintain PIPEDA-level protection.

5. Security safeguards

We implement reasonable and appropriate measures for sensitive financial data:

  • Encryption in transit (TLS/HTTPS) and at rest.
  • Time-limited, signed document links.
  • Passwordless authentication where possible; immutable audit logs for all access.
  • Strict least-privilege internal access (logged).
  • Regular security reviews and incident response processes.

In the event of a breach posing a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada (and applicable provincial authorities) promptly.

6. Retention

We retain data only as long as necessary:

  • Engaged client records: up to 7 years (or as required by professional or tax regulations).
  • Other data: as needed for the purpose or legal obligations, then securely deleted or anonymized.

7. Your rights (PIPEDA)

You have the right to:

  • Access your personal information.
  • Request correction of inaccuracies.
  • Withdraw consent (subject to legal or contractual limits).
  • Request deletion (subject to retention obligations).
  • Complain to the Office of the Privacy Commissioner of Canada.

To exercise these rights, email privacy@capitaltoolkit.com. We respond within 30 days (or as permitted by law). Quebec residents have additional rights under Law 25 (for example, data portability and automated decision explanations).

8. Cookies and tracking

We use only essential technical cookies. No tracking or advertising cookies without consent.

9. Changes to this policy

Material changes will be posted here with a new effective date and, where feasible, notified by email.

10. Contact

privacy@capitaltoolkit.com