Privacy

Last updated: 14 October 2026

TaxXML.ca is a free tool from AVANZA Business Automation. It turns a spreadsheet into XML for certain Canada Revenue Agency (CRA) information returns. This notice describes what the site actually does with information. It is written for people using the site in Canada.

Spreadsheet and slip data stay in your browser

Choosing an NR4, T4, T1204, or T5018 file does not upload that file to a TaxXML server. There is no TaxXML account and no TaxXML database of slips.

• The file is read in your browser and parsed there. Names, addresses, amounts, social insurance numbers (SIN), and business numbers (BN) stay in that browser tab while you work.
• The XML file is built in the browser and downloaded to your computer. TaxXML does not send it to the CRA. You submit it yourself if you use Internet File Transfer (IFT).
• Closing the tab clears the spreadsheet and the generated XML from memory. That does not clear the filing details described below.

After the page and its scripts have loaded, the conversion itself does not need a network connection. The first visit does, because the page, fonts, and libraries are downloaded then.

Filing details saved on this device

Step 3 filing details are saved in this browser’s localStorage under the key taxxml_filing_details, so you do not have to retype them on a later visit. The site writes them when you change a saved field or leave it. They are not sent to AVANZA.

What is saved:

• Transmitter business number, transmitter name, submission reference ID, language, contact name, phone, and email
• Payer or employer account number, organization name, address, city, province, postal code, contact name, and phone
• T4 dental benefit code (Box 45), when that field is on the form

When those details are restored, the last character of the submission reference ID is advanced (for example, A becomes B) so a later download is less likely to reuse the same reference.

What is not saved in localStorage: the spreadsheet, the generated XML, the taxation year, the report type (original, amendment, or cancel), and the T5018 fiscal-period end date.

You can remove the saved details with the Clear link on the filing step, or by clearing site data for taxxml.ca in your browser. Anyone who uses the same browser profile can see the saved fields.

What leaves the browser

Your slips, SIN, BN, and Step 3 filing details are not included in the requests below. Other traffic does leave the browser.

GitHub Pages. The site is static files hosted on GitHub Pages. Loading a page, stylesheet, image, or sample CSV template means GitHub receives an ordinary request for that file, including your IP address and browser. Those requests do not contain your spreadsheet.

Google Analytics 4. Pages load Google’s tag from www.googletagmanager.com with measurement ID G-E2F5Q3RZVH. Besides pageviews, the converter sends a few usage events: return_selected, file_opened, file_parse_error, step_reached, validation_failed, validation_passed, xml_downloaded, and start_fresh. They carry only the return type, the step number, an error count, a general error category, and, for validation_failed, the name of the first field that failed (one of the converter’s own column or form-field names, such as sin or tx-email; anything else, including your own column headers, is sent as other). They never include spreadsheet cells, the values you type into filing fields, your column headers, file names, SINs, names, or amounts. Google can receive the page address, rough location, device and browser details, and a client identifier stored in cookies (such as _ga). Google’s policy is at policies.google.com/privacy.

Google Fonts. Pages request the IBM Plex Sans and IBM Plex Mono fonts from fonts.googleapis.com and fonts.gstatic.com. Your browser sends that request, including your IP address, to Google.

SheetJS. The converter page loads the SheetJS library from cdn.sheetjs.com (xlsx-0.20.3). That is a script download. The spreadsheet is parsed on your device after the library loads. It is not uploaded to that CDN. The Privacy and Terms pages do not load SheetJS.

Lucide. The converter page loads icons from unpkg.com/lucide. That is a script download from the unpkg CDN. It does not receive your spreadsheet or filing details. The Privacy and Terms pages do not load Lucide.

Stripe. The site does not embed a Stripe script. If you follow “buying me a coffee”, your browser opens Stripe’s donation page at donate.stripe.com. Payment details are entered on Stripe’s site, not on TaxXML. AVANZA does not receive your card number through this site. Stripe’s policy is at stripe.com/privacy.

Links you choose to open. Links to the CRA IFT sign-in page and to AVANZA’s websites go to those sites only if you click them. TaxXML does not pass your XML file along with the click.

Cookies

TaxXML’s own pages do not set cookies. Google Analytics, loaded as described above, uses cookies under Google’s default setup. The filing details in localStorage are stored by the browser, and they are not cookies.

How long information is kept

Slip data in memory lasts until you close the tab or start over. Saved filing details stay in localStorage until you clear them or your browser removes them. TaxXML has no copy of either. Google, GitHub, Stripe, and the CDNs named above keep their own logs under their own policies.

Children

The tool is for people preparing Canadian information returns. It is not directed at children.

Changes

If the site starts handling information differently, this page will be updated. The date at the top is the latest revision.

Contact

TaxXML.ca does not publish an email address. Questions about this notice can be sent through AVANZA Business Automation at avanza-automation.com. See also the Terms.