Privacy Policy

PRIVACY POLICY — /legal/privacy

Applicable law: PIPEDA federally; Quebec Law 25 where Quebec residents are served; Alberta and BC PIPA; CASL for commercial electronic messages.

1. Scope and controller. Who determines the purposes; contact for the privacy officer.
2. What we collect.
   • Account: name, email, phone, password credential, language, preferences.
   • Project: measurements, photographs of your property, drawings, site notes, addresses.
   • Marketplace: orders, delivery and pickup addresses, fulfilment preferences.
   • Payment: handled by the payment provider; we do not store full card numbers. Tokens and last-four only.
   • Communications: messages, call notes, email correspondence.
   • Technical: IP address, device and browser data, first-party analytics events.
   • Supplier: business identity, verification documents, payout details, tax details.
3. Why we collect it. Provision of services; fulfilment; fraud prevention; accounting and tax obligations; support; service improvement; marketing only with consent.
4. Legal basis / consent. Express consent is required for marketing communications (CASL), with a real withdrawal mechanism.
5. Photographs and project imagery. Photographs a customer uploads are used to scope and price their project. They are private to that project by default and are used publicly (for example in the gallery) only with the customer's separate, recorded, revocable consent.
6. Sharing. With the supplier fulfilling an order (only what fulfilment requires); with the payment provider; with the accounting system; with carriers; with service providers under contract; where legally required; on a business transfer.
7. Cross-border transfers. Where a data processor is located outside Canada, PIPEDA accountability and Quebec Law 25 disclosure obligations apply.
8. Retention. Data is retained per category, including to meet CRA record-keeping obligations.
9. Your rights. Access, correction, withdrawal of consent, deletion where applicable, complaint to the OPC or the provincial regulator. Implemented at /account/privacy.
10. Security. Encryption in transit and at rest; access control; tenant isolation; breach notification.
11. Children. The service is not directed to children.
12. Cookies. See Cookies and Tracking (policy 3).
13. Changes and contact.