Terms of Service

1. Agreement and operator

These Terms are an agreement between the person or organization accepting them (“Customer”, “you”) and Andrew Marc, carrying on business as SR&ED Copilot (“Provider”, “we”) for use of SR&ED Copilot (the “Service”). If you use the Service for an organization, you represent that you can bind it. If you do not agree, do not use the Service.

The Privacy Policy, Data Processing Addendum, and any accepted order form are part of these Terms. A signed agreement controls over conflicting self-service terms.

2. What the Service does

The Service can help authorized users:

• capture and organize manual or integration-sourced R&D evidence;
• identify documentation gaps and prepare review checklists;
• draft T661 narrative text with evidence citations using selected AI providers;
• organize potential expenditure information and rough credit estimates;
• route drafts through internal or accountant review; and
• export available project, narrative, evidence, and preparer-review binder materials.

Features can change during early access. We will not materially reduce a paid core workflow without notice where reasonably practicable, but no roadmap item is part of the agreement unless it appears in a signed order form.

3. Safe beta use

Customer agrees to use safeguards appropriate for an early-stage service:

• approve the Service through its security, privacy, legal, tax, and records owners;
• start with a low-sensitivity project and manual entry before connecting workplace systems;
• minimize and redact evidence, and never submit passwords, keys, tokens, payment-card data, or unnecessary regulated information;
• keep authoritative source records and regular exports outside the Service;
• test the export and offboarding path before relying on a workflow; and
• have a qualified accountant or SR&ED adviser review all material before filing.

4. Accounts and access

• You must provide accurate information, be at least 18, and use the Service for a legitimate organization.
• Each person must use a named account, protect their credentials, and promptly report suspected compromise.
• Authenticator-app MFA is available and should be enabled for users with access to sensitive evidence; enterprise SSO and automated provisioning are not part of the self-service Service.
• The account owner controls invitations and roles and is responsible for prompt workforce offboarding.
• You are responsible for activity under your accounts except to the extent caused by Provider's breach of these Terms.

5. Fees, billing, and cancellation

Prices, currency, billing period, taxes, trial or pilot access, and any refund right are the terms displayed at checkout or in an accepted order form. Stripe processes payment details. Recurring subscriptions continue until cancelled. Cancellation takes effect at the end of the paid period unless checkout or an order form says otherwise. Failed payment may lead to suspension after reasonable notice.

Cancelling billing is not a deletion request. Export before cancellation and send deletion requests to privacy@sredcopilot.ca.

6. Customer content and confidentiality

Customer keeps ownership of Customer content. Customer gives Provider a limited right to host, copy, transmit, transform, display, and otherwise process that content only to provide, secure, support, and improve the Service as described in the agreement and Customer's instructions. Provider does not obtain ownership of Customer content and will not use it to train Provider-owned AI models.

Provider will limit access to Customer content to persons and disclosed providers who need it for those purposes and are subject to appropriate confidentiality obligations. Customer must have the rights, notices, consents, and other authority needed to provide the content, including employee and contractor information.

7. Data processing, AI, and integrations

The DPA governs Customer Personal Information. The current providers and activation conditions appear in the Subprocessor Register. The Service does not guarantee Canadian-only processing.

When a user requests AI generation, the relevant project context, selected evidence, and instructions are sent to the selected provider. A customer-supplied API key changes the credential, not the data destination. Integrations operate under scopes approved by the Customer. An organization owner can disable external AI, require customer-supplied keys, and restrict permitted providers. During integration disconnect, an owner chooses whether to keep matching imported evidence or permanently purge it and its citation links.

8. Human review and professional responsibility

All generated or calculated material is a draft. It may contain:

• incorrect, incomplete, or unsupported factual statements;
• missing or inaccurate evidence citations;
• language that overstates uncertainty, experimentation, or advancement;
• incomplete expenditure categories or tax assumptions; and
• errors caused by incomplete, reconstructed, or misleading source evidence.

Customer is responsible for technical validation, source verification, professional eligibility and tax analysis, filing decisions, and submissions to CRA. The Service cannot turn weak reconstructed records into contemporaneous evidence or replace records that never existed.

9. Acceptable use

You must not:

• use the Service unlawfully or to create or support false or fraudulent claims;
• misrepresent reconstructed material as contemporaneous evidence;
• submit content you lack authority to process or violate privacy, employment, intellectual-property, export-control, or confidentiality obligations;
• probe, bypass, disrupt, overload, reverse engineer, or gain unauthorized access to the Service except through an authorized written testing program;
• transmit malware or credentials; or
• resell the Service without written permission.

10. Service security and incidents

Provider will maintain the measures in the DPA and describe material current gaps on the Security & Data Handling page. After validating that a security incident may have affected Customer data, Provider will notify Customer without unreasonable delay and targets an initial notice within 72 hours, unless law or a signed agreement requires sooner.

Operational targets are published in Service Commitments. They are not an SLA or service-credit program unless expressly incorporated into a signed agreement.

11. Continuity, export, and retention

• Customer may use available exports while its account has the required access.
• Customer must maintain original evidence and required books and records outside the Service.
• Provider will target 30 days notice before materially discontinuing the Service where reasonably practicable.
• After termination, Customer has 30 days to request an available export unless security, legal, payment, or technical constraints prevent it.
• After the export period, Provider may delete Customer content subject to the Privacy Policy, backup rotation, legal holds, and signed terms.

New workspaces default to an 84-month advisory retention-planning window. It flags older evidence and does not silently delete it. No planning window replaces the customer's CRA or corporate retention schedule or guarantees against all data loss.

12. Suspension and termination

Provider may suspend access needed to address a security threat, unlawful use, non-payment, or a material breach. Where safe and lawful, Provider will give notice, explain the basis, and allow a reasonable opportunity to cure. Immediate action may be required to protect customers or the Service.

Either party may terminate as permitted by the subscription or order form. Sections that by their nature should survive, including ownership, confidentiality, payment, disclaimers, liability, dispute, and permitted retention, remain effective.

13. Business transfers

Where legally and commercially practicable, Provider will target at least 30 days notice before a transaction transfers control of Customer content. Before the effective transfer, Customer may stop submitting data, export available records, terminate future use, and request deletion. A successor must assume the applicable agreement or establish another lawful basis before continuing the covered processing.

14. Intellectual property

Provider owns the Service, software, design, and documentation other than Customer content. Subject to payment and these Terms, Provider grants Customer a limited, non-exclusive, non-transferable right to use the Service internally during the subscription. Feedback may be used without identifying Customer or disclosing Customer confidential information.

To the extent Provider has rights in an output generated specifically from Customer content, Provider grants those rights to Customer. This does not guarantee that an AI output is unique, protectable, non-infringing, accurate, or suitable for filing.

15. Warranties and disclaimers

Provider warrants that it will provide the Service substantially as described and comply with its express confidentiality and data-processing obligations. Otherwise, to the extent permitted by law, the early-access Service is provided “as is” and “as available”.

Provider does not warrant uninterrupted operation, error-free AI output, eligibility, any ITC amount, CRA acceptance, recovery of every record, or fitness for Customer's regulatory or contractual requirements.

16. Liability

To the extent permitted by law, neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or lost profits, business, goodwill, or anticipated tax credits. Provider is not responsible for claim rejection, penalties, or filing decisions except to the extent directly caused by Provider's breach of an express obligation in these Terms.

Each party's aggregate liability arising from the Service is limited to fees paid or payable for the Service in the 12 months before the event. This limit does not apply to fraud, wilful misconduct, payment obligations, infringement or misappropriation of the other party's intellectual property, or liability that cannot lawfully be limited. The disclaimers do not cancel Provider's express confidentiality, incident-notification, DPA, or export-window obligations.

17. Indemnity

Customer will defend Provider against a third-party claim to the extent it results from Customer's unlawful content, intentional misuse of the Service, or material violation of another person's rights. This obligation does not cover claims caused by Provider's breach, negligence, or misconduct. The party seeking indemnity must give prompt notice, allow reasonable control of the defence, and cooperate; no settlement may admit fault or impose non-monetary obligations on the other party without consent.

18. Changes

Provider may update these Terms. Material changes will be posted and, where reasonably practicable, emailed at least 14 days before taking effect. Changes will not retroactively remove accrued rights. If Customer objects, its remedy is to stop future use and cancel before the effective date, subject to export and retention terms.

19. Governing law and general terms

These Terms are governed by the laws of Province of Nova Scotia, Canada, excluding conflict rules. Courts located in Nova Scotia have jurisdiction unless applicable law requires otherwise. If a provision is unenforceable, it will be limited to the minimum extent necessary and the rest remains effective. Failure to enforce a provision is not a waiver. Neither party may assign the agreement without consent, except in a bona fide business reorganization or sale subject to Section 13.

20. Contact

Legal: legal@sredcopilot.ca
Support: support@sredcopilot.ca
Operator: Andrew Marc, carrying on business as SR&ED Copilot, based in Halifax, Nova Scotia, Canada