Who operates this website
Herman the CPA operates Herman the CPA in Ontario, Canada. Herman is responsible for privacy inquiries; Apogee Ventures provides technical maintenance. Privacy questions, access/correction requests, complaints and deletion requests: [email protected].
Information we collect
Inquiries collect your name, email and message so we can respond. They are saved in Cloudflare D1; Resend handles the email notification. An inquiry does not subscribe you to marketing. Please do not include tax identifiers, banking credentials or confidential client files.
Authentication and providers
Cloudflare hosts the site and protects administrator access. Supabase verifies administrator identity and multifactor authentication. Authentication cookies support these sessions.
Media and browser preferences
Embedded video and reel players, including YouTube, Vimeo, Instagram and TikTok, load automatically when their page is opened and connect your browser to the provider. Providers apply their own data practices; original-platform links are also available. Practice progress and reading preferences may be stored locally in your browser.
Processing locations
Service providers may process information outside Canada, where it may be subject to foreign law. Resend reports United States processing for email content and delivery records. Provider-managed records and backups follow the applicable service arrangements; changing website settings does not change those arrangements.
Retention and requests
For routine inquiries that do not become professional client records, our operating policy is to remove website copies within 90 days after resolution. Spam and fictional tests are reviewed for removal within 30 days of classification. Redundant website notification content is removed within 30 days after confirmed notification and reconciliation; necessary delivery metadata may be retained for up to 12 months. Failed or uncertain notifications are reviewed after 7 days and are not silently deleted. Operator-created backups use a maximum 30-day rolling window. Routine administrative/security logs use a maximum 12-month period where needed. Professional files, information needed for access or complaint recourse, legal holds and incident evidence follow their applicable obligations. Records of every privacy breach are kept for at least 24 months after determination. Disposal is controlled by an authorized operator. Provider-managed backups and email-service records follow their verified service arrangements; mailbox copies are handled separately. Copies preserved under a hold remain restricted until the obligation ends. Completed deletion is reapplied after a restore.
Operating schedule version 1, adopted 2026-10-16.
Contact the privacy address above to ask about your information, correct it, withdraw consent where applicable, request deletion or raise a complaint. We verify identity proportionately and preserve information where necessary for legal obligations, professional records or recourse. Access requests are normally answered within 30 calendar days; any permitted extension is explained within the original period. You may also complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.