CUSMA Certification of Origin

Privacy Policy

Last updated 27 August 2026

What happens to the details you type

Nothing leaves your device. The form, the preview and the PDF are all produced by JavaScript running in your browser, using a PDF library served from this site rather than from anyone else's. Your entries are held in the page's memory while you work and are gone when you close the tab.

That is enforced as well as intended. This site sends a Content-Security-Policy header containing connect-src 'self', which means your browser will refuse to transmit anything from this page to any other domain, even if a bug or a future mistake on our part tried to. The form itself has no submit action and no submit button, so pressing Enter does not send it anywhere either.

What is stored on your device

Exactly one item, in your browser's local storage, under the key cusma.unlock.v1. It is created only when you unlock the download — before that, nothing is stored at all. It holds three fields:

via

Either stripe or code, depending on how you paid.

detail

If you paid by card, the Stripe checkout session id for your purchase (a string beginning cs_). If you paid by e-Transfer and were sent an unlock code, that code.

at

The date and time the unlock happened.

That record is what makes the "unlimited re-downloads on this device" part of the purchase work. It stays on your device, is never transmitted to us, and is not shared between devices or browsers. You can delete it at any time by clearing site data for origincert.ca in your browser settings; doing so will lock the download again on that device.

We use no cookies, no session storage and no other browser storage of any kind.

The ?paid= address after payment

When Stripe finishes a payment it returns you to this site at an address containing ?paid= followed by your Stripe checkout session id. That identifier is not secret, but it is specific to your purchase, so it is worth saying plainly what happens to it:

• The page sends it to /api/verify on this site, which asks Stripe one question — was this session actually paid — and receives one answer. That step exists because a declined card would otherwise have unlocked the download.
• That request is not written to any log or database by us. Nothing about your purchase is stored on our side. The endpoint deliberately does not ask Stripe for, or pass back, your email address, your name or the amount.
• The identifier is then removed from the address bar, so it does not sit in your browser history or get copied if you share the link, and it is saved into the local record described above.

Our robots.txt also asks search engines not to index any address containing ?paid=.

Analytics

No analytics data is collected about you. We have added no Google Analytics, no Plausible, no error-reporting service, no session recording, and no advertising or social pixels. Nothing we wrote loads anything from a third party.

One honest complication, because you would find it if you viewed the page source and we would rather say it first. Cloudflare, our host, inserts a small Cloudflare Web Analytics tag into the HTML at its edge, before the page reaches you. We did not put it there and it does not run: this site's Content-Security-Policy permits scripts only from our own domain, so your browser refuses to load it and it reports nothing. If you open your browser's developer console you can see it being blocked.

The result is that no analytics run and no visit data reaches Cloudflare Analytics — but the tag is genuinely present in the markup, and "we run no analytics" on its own would have been too tidy a description of that.

Payments

Payments are processed by Stripe. Card details are entered on Stripe's own hosted checkout page, not on this site, and we never see or store them. Stripe holds the record of your purchase and issues the receipt; we hold no purchase record of our own. Stripe's handling of your information is governed by its own privacy policy.

If you pay by Interac e-Transfer instead, you send the transfer and email us the confirmation. In that case we do see your email address, your name as it appears on the transfer, and whatever you write to us. See Email below.

Hosting

This site is static files hosted on Cloudflare Pages. Like any web host, Cloudflare processes the requests your browser makes and in doing so handles technical information such as your IP address, the time of the request and your browser's user-agent string. That is a normal function of serving a website and is not something we collect, analyse or retain separately.

Email

[email protected] is delivered by Cloudflare Email Routing and replies are sent through Resend. If you write to us, your email address, your message and any attachment pass through those services and sit in our mailbox. We keep support correspondence only as long as it is useful for handling the matter you wrote about, along with anything we are required to keep for tax records where a payment is involved.

How long anything is kept

• Your certificate details: not kept at all. They exist only in your browser while the tab is open.
• The unlock record: on your device, until you clear it.
• Payment records: held by Stripe under their retention policy, not by us.
• Emails: in our mailbox, as described above.

Your rights

In Canada, personal information held by private-sector businesses is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA). Because this site holds essentially nothing about you, there is usually nothing to request or correct — but if you have emailed us, or bought a certificate, you may ask what we hold, ask us to correct it, or ask us to delete it. Write to [email protected] and we will respond within two business days.

You can also complain to the Office of the Privacy Commissioner of Canada if you are not satisfied with how we have handled your information.

Changes

If this policy changes, the date at the top changes with it. It describes what the site actually does; if the site changes, this page is meant to change on the same day.

Who we are

OriginCert is operated by Jason Tsang, a sole proprietor based in Toronto, Ontario, Canada. Contact: [email protected].