Legal
Privacy Policy
How YBAWS! Inc. (operating as Capital Toolkit) handles personal information you share with us.
Effective Date: May 1, 2026. Last Updated: August 16, 2026.
YBAWS! Inc. (“Capital Toolkit,” “we,” “us,” or “our”) is committed to protecting your privacy and handling personal information responsibly in full compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario and Canadian laws.
1. Who we are and accountability
Capital Toolkit is a Canadian platform that helps businesses organize and prepare financing application packages, primarily under the Canada Small Business Financing Program (CSBFP) and related programs. Our Privacy Officer is Sean Cavanagh, CPA. For any privacy questions or requests, contact privacy@capitaltoolkit.com. Mailing address available upon request.
2. Information we collect
We collect only what is necessary:
- Contact and account information: name, email, phone, business details.
- Application and financial information: tax returns (T1/T2), financial statements, bank statements, credit reports, ownership structure, personal net worth, supporting documents, and related details for financing applications.
- Usage and technical data: IP address, browser info, access logs (for security and improvement).
- Other: communications with us and any information you voluntarily provide.
3. How we use your information
- To provide the platform services.
- To prepare and submit application packages with your authorization.
- To communicate with you and authorized third parties (lenders, your professionals).
- To operate the platform, ensure security, and comply with legal obligations.
- To maintain and improve our methodology and models using de-identified and aggregated data that does not identify you or your business. Your individual information is used to run the service and produce your deliverables; improvement of the methodology and models uses de-identified data.
- To produce anonymized, aggregated research and reporting about the Canadian small-business financing landscape (for example, the State of CSBFP Lending annual report). Individual files are never identifiable in any published material; minimum sample-size thresholds are applied before any category or figure is published. You may opt out of inclusion in aggregate research at any time by emailing privacy@capitaltoolkit.com.
We do not sell your data, use it for marketing or advertising, or earn referral commissions from lenders.
Your information is yours. You keep ownership of the financial records, documents, and information you submit, and of the deliverables we produce for you. Our methodology is ours. The way Capital Toolkit works, the questions we ask and how they are structured, sequenced, and related to your engagement, the module workflows, and our models, scoring logic, and software, is the proprietary property of YBAWS! Inc. Using the service does not give you any rights to it.
Legal compliance and notice. We comply with lawful local, provincial/state, and federal orders. If we are legally required to disclose your individual information, or if it is exposed in a security incident, we will notify you, unless the law prohibits us from doing so (for example, under a sealed court order).
4. Sharing your information
We share only with your explicit authorization or as required:
- Lenders or financial institutions you specifically authorize.
- Professionals you engage (CPA, lawyer, broker).
- Service providers under strict contracts (for example, hosting, email, and database providers like Supabase, AWS, Vercel, and Resend, and AI processors like Anthropic), all subject to PIPEDA-equivalent protections. See our sub-processors list for the complete, current list and what each one does.
- As required by law (court order, regulatory request).
Data may be stored in the United States or other jurisdictions; we use contractual safeguards to maintain PIPEDA-level protection.
5. Security safeguards
We implement reasonable and appropriate measures for sensitive financial data:
- Encryption in transit (TLS/HTTPS) and at rest.
- Time-limited, signed document links.
- Passwordless authentication where possible; immutable audit logs for all access.
- Strict least-privilege internal access (logged).
- Regular security reviews and incident response processes.
In the event of a breach posing a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada (and applicable provincial authorities) promptly.
6. Retention
We retain data only as long as necessary:
- Engaged client records: up to 7 years (or as required by professional or tax regulations).
- Other data: as needed for the purpose or legal obligations, then securely deleted or anonymized.
7. Your rights (PIPEDA)
You have the right to:
- Access your personal information.
- Request correction of inaccuracies.
- Withdraw consent (subject to legal or contractual limits).
- Request deletion (subject to retention obligations).
- Complain to the Office of the Privacy Commissioner of Canada.
To exercise these rights, email privacy@capitaltoolkit.com. We respond within 30 days (or as permitted by law).
8. Quebec residents (Law 25)
In addition to the rights above, Quebec residents have specific rights under Law 25, including data portability and the right to be informed about automated decision-making that concerns them.
Capital Toolkit may use automated systems, including a conversational assistant (“Tool Master”), to provide information based on what you tell it. These systems do not make decisions that produce legal effects or otherwise significantly affect you: they answer questions and provide general information, and any application, eligibility, or compliance determination is made by a person, not an automated system. If we ever introduce automated decision-making with a legal or similarly significant effect, we will tell you in advance and explain how to request a human review.
9. Cookies and tracking
We use only essential technical cookies. No tracking or advertising cookies without consent.
10. Changes to this policy
Material changes will be posted here with a new effective date and, where feasible, notified by email.