CUSMA Certification of Origin

Privacy Policy

Last updated 11 October 2026

What happens to the details you type

Nothing leaves your device. The form, the preview and the PDF are all produced by JavaScript running in your browser, using a PDF library served from this site rather than from anyone else's. Your entries are held in the page's memory while you work, and saved to your own browser's local storage as a draft so that paying or closing the tab does not lose them. Neither copy is ever sent anywhere — see What is stored on your device below.

That is enforced as well as intended. This site sends a Content-Security-Policy header containing connect-src 'self', which means your browser will refuse to transmit anything from this page to any other domain, even if a bug or a future mistake on our part tried to. The form itself has no submit action and no submit button, so pressing Enter does not send it anywhere either.

What is stored on your device

Two items, both in your browser's local storage, and neither of them ever leaves your device.

1. Your draft certificate, under the key cusma.draft.v1

As you fill in the form, what you have typed is saved here so that it survives paying, closing the tab, or a browser crash. Before this existed, paying took you to Stripe and back, and the form you came back to was empty — the certificate had to be typed again. This is the fix for that.

It holds the same information the certificate does: your reference number, the certifier, exporter, producer and importer details you entered, the goods and their HS codes, any blanket period, and the signatory name, title and date. It is written as you type and replaced each time you change something.

It does not exist until you actually type something. Loading this page, reading it and leaving stores nothing at all; and if you empty the form again, the item is deleted rather than left behind as a blank one.

It stays on your device and is never transmitted to us. The connect-src 'self' rule described above applies to it exactly as it applies to everything else on this page — your browser would refuse to send it to us even if we wrote code that tried. You can erase it at any time with the Start a new certificate button on the form, or by clearing site data for origincert.ca in your browser settings.

2. Your unlock record, under the key cusma.unlock.v1

Created only when you unlock the download. It holds three fields:

via

Either stripe or code, depending on how you paid.

detail

If you paid by card, the Stripe checkout session id for your purchase (a string beginning cs_). If you paid by e-Transfer and were sent an unlock code, that code.

at

The date and time the unlock happened.

That record is what makes the "unlimited re-downloads on this device" part of the purchase work. It stays on your device, is never transmitted to us, and is not shared between devices or browsers. You can delete it at any time by clearing site data for origincert.ca in your browser settings; doing so will lock the download again on that device.

Those two local-storage keys are the whole of it. We use no cookies, no session storage, and no other browser storage of any kind.

The ?paid= address after payment

When Stripe finishes a payment it returns you to this site at an address containing ?paid= followed by your Stripe checkout session id. That identifier is not secret, but it is specific to your purchase, so it is worth saying plainly what happens to it:

• The page sends it to /api/verify on this site, which asks Stripe one question — was this session actually paid — and receives one answer. That step exists because a declined card would otherwise have unlocked the download.
• That request is not written to any log or database by us. Nothing about your purchase is stored on our side. The endpoint deliberately does not ask Stripe for, or pass back, your email address, your name or the amount.
• The identifier is then removed from the address bar, so it does not sit in your browser history or get copied if you share the link, and it is saved into the local record described above.

Our robots.txt also asks search engines not to index any address containing ?paid=.

Analytics

We collect anonymous visit statistics with Cloudflare Web Analytics. Cloudflare, our host, adds a small script to each page that reports which page was viewed, the site you came from, your browser and device type, your country, and how quickly the page loaded. It sets no cookies, stores nothing in your browser, and does not build a profile of you. We see totals, such as how many people viewed a guide, not individual visitors.

It does not read the form. The script does not collect anything you type into the certificate form. Parties, goods, HS codes, origin criteria and signatures still never leave your browser.

That is the only analytics on the site. We have added no Google Analytics, no Plausible, no error-reporting service, no session recording, and no advertising or social pixels. This site’s Content-Security-Policy lets scripts load only from our own domain and from Cloudflare’s analytics address, so nothing else from outside can run.

Payments

Payments are processed by Stripe. Card details are entered on Stripe's own hosted checkout page, not on this site, and we never see or store them. Stripe holds the record of your purchase and issues the receipt; we hold no purchase record of our own. Stripe's handling of your information is governed by its own privacy policy.

If you pay by Interac e-Transfer instead, you send the transfer and email us the confirmation. In that case we do see your email address, your name as it appears on the transfer, and whatever you write to us. See Email below.

Hosting

This site is static files hosted on Cloudflare Pages. Like any web host, Cloudflare processes the requests your browser makes and in doing so handles technical information such as your IP address, the time of the request and your browser's user-agent string. That is a normal function of serving a website and is not something we collect, analyse or retain separately.

Email

[email protected] is delivered by Cloudflare Email Routing and replies are sent through Resend. If you write to us, your email address, your message and any attachment pass through those services and sit in our mailbox. We keep support correspondence only as long as it is useful for handling the matter you wrote about, along with anything we are required to keep for tax records where a payment is involved.

How long anything is kept

• Your certificate details: never kept by us. Saved on your own device as a draft, until you clear it or press “Start a new certificate”.
• The unlock record: on your device, until you clear it.
• Payment records: held by Stripe under their retention policy, not by us.
• Emails: in our mailbox, as described above.

Your rights

In Canada, personal information held by private-sector businesses is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA). Because this site holds essentially nothing about you, there is usually nothing to request or correct — but if you have emailed us, or bought a certificate, you may ask what we hold, ask us to correct it, or ask us to delete it. Write to [email protected] and we will respond within two business days.

You can also complain to the Office of the Privacy Commissioner of Canada if you are not satisfied with how we have handled your information.

Changes

If this policy changes, the date at the top changes with it. It describes what the site actually does; if the site changes, this page is meant to change on the same day.

Who we are

OriginCert is operated by Jason Tsang, a sole proprietor based in Toronto, Ontario, Canada. Contact: [email protected].