Privacy Policy

Last updated: February 27, 2026 — Effective immediately

1. Data Controller

1000144294 ONTARIO INC, a corporation incorporated under the Ontario Business Corporations Act, R.S.O. 1990, c. B.16, operating as Ontario Permit & Compliance Snapshot ("the Company," "we," "us," "our"), is the data controller responsible for your personal information.

Privacy Officer: Jackie Davies
Email: [email protected]

2. PIPEDA Compliance Framework

We are committed to complying with the ten fair information principles set out in Schedule 1 of PIPEDA:

1. Accountability: We are responsible for personal information under our control and have designated a Privacy Officer.
2. Identifying Purposes: We identify the purposes for which personal information is collected at or before the time of collection.
3. Consent: We obtain your knowledge and consent for the collection, use, or disclosure of personal information, except where inappropriate or as permitted by law.
4. Limiting Collection: We limit the collection of personal information to that which is necessary for the identified purposes.
5. Limiting Use, Disclosure, and Retention: We do not use or disclose personal information for purposes other than those for which it was collected, except with your consent or as required by law. We retain personal information only as long as necessary.
6. Accuracy: We keep personal information as accurate, complete, and up-to-date as necessary for the purposes for which it is to be used.
7. Safeguards: We protect personal information with security safeguards appropriate to the sensitivity of the information.
8. Openness: We make readily available specific information about our policies and practices relating to the management of personal information.
9. Individual Access: Upon request, we inform you of the existence, use, and disclosure of your personal information and give you access to that information.
10. Challenging Compliance: You may challenge our compliance with these principles by contacting our Privacy Officer.

3. Information We Collect

3.1 Account Information

When you create an account through our authentication provider, we collect:

• Full name
• Email address
• Account preferences (including marketing consent status under CASL)

3.2 Property and Project Information

When you use the intake form to request a Report, we collect:

• Property street address, municipality, and postal code
• Municipal roll number and/or parcel identifier (if provided)
• Lot dimensions (frontage, depth, area)
• Property type (urban/rural), waterfront status, and proximity to regulated areas
• Proposed construction scope, use, and sizing details
• Timeline and urgency information
• Additional notes or context you provide

3.3 Uploaded Documents

You may optionally upload property-related documents to enhance Report accuracy. Supported document types include:

• Surveys and site plans (lot dimensions, setbacks, building footprints, easements)
• Zoning certificates (official zoning designations, permitted uses)
• Open permit records (existing permits and their status)
• Conservation authority letters or maps (regulated areas, environmental constraints)
• Title searches (ownership, easements, restrictive covenants)
• Septic inspection reports (system condition, compliance)
• Committee of adjustment decisions (approved variances, conditions)
• Geotechnical reports (soil conditions, bearing capacity)
• Development charges estimates
• Other supporting documentation

Document Processing: Uploaded documents are processed by AI to extract relevant data points (e.g., lot dimensions, setback distances, zoning designations). Data extracted from uploaded documents is labeled as "Document-Verified" in your Report to distinguish it from AI-estimated values. This label indicates the data was sourced from your documents — it does not constitute professional verification.

Storage and Retention: Uploaded files are stored in encrypted cloud storage (Amazon S3) and are automatically deleted within 30 days of upload. Files are accessible only to the AI processing system during Report generation and are not shared with third parties. See Section 7 for complete retention details.

File Limits: Maximum 10 files per report, 10 MB per file. Accepted formats: PDF, JPG, PNG.

3.4 Payment Information

Payment processing is handled entirely by Stripe, Inc. We do not collect, store, or have access to your full credit card number, CVV, or card expiration date. We retain only:

• Stripe Customer ID (for linking payments to your account)
• Stripe Payment Intent ID (for transaction tracking)
• Transaction amount and currency
• Payment status

3.5 Indemnity Acceptance Records

When you accept the click-wrap indemnity agreement before each purchase, we log:

• Your user ID
• Timestamp of acceptance
• Your IP address at the time of acceptance
• The version of the indemnity agreement accepted

This information is collected for the legitimate purpose of maintaining a legal record of your informed consent and is retained indefinitely as required for legal compliance.

3.6 Technical and Usage Information

• Browser type and version
• IP address (anonymized for analytics)
• Pages visited and features used
• Referring URL
• Device type and operating system

We use privacy-respecting analytics (Umami) that do not use cookies for tracking and comply with PIPEDA's consent requirements.

4. Purposes of Collection and Use

We collect and use your personal information for the following identified purposes:

5. AI Processing of Your Information

Your property and project information is processed by artificial intelligence to generate your Report. This involves:

• Transmission of your project details to our AI service provider for analysis against general Ontario regulatory context;
• If you uploaded documents: transmission of those documents to the AI service provider for data extraction and cross-referencing with your project details;
• Generation of a structured feasibility report based on the AI's analysis, with data points sourced from uploaded documents labeled as "Document-Verified";
• No human review of your individual project data or uploaded documents during the automated report generation process.

Important: We do not use your individual project data to train, fine-tune, or improve AI models. Only aggregated, fully anonymized, and de-identified patterns may be used to improve overall service quality. Your specific property address, project details, and uploaded documents are never used for model training.

6. Disclosure of Personal Information

We disclose your personal information only to the following categories of recipients, and only to the extent necessary for the identified purposes:

We do not sell, rent, or trade your personal information to any third party.

6.1 Cross-Border Transfers

As noted above, some of our service providers are located in the United States. In accordance with PIPEDA, we ensure that your personal information receives a comparable level of protection when transferred outside of Canada. We use contractual safeguards and select service providers with robust privacy and security practices.

Please be aware that personal information transferred to the United States may be subject to access by U.S. government authorities under applicable U.S. law, including the USA PATRIOT Act.

6.2 Legal Disclosure

We may disclose your personal information without your consent where required or permitted by law, including:

• To comply with a subpoena, court order, or other legal process;
• To respond to a request from a law enforcement agency or regulatory authority;
• To protect the rights, property, or safety of the Company, our users, or the public;
• In connection with a merger, acquisition, or sale of all or a portion of our assets (with notice to you).

7. Data Retention

8. Your Rights Under PIPEDA

Under PIPEDA, you have the following rights regarding your personal information:

8.1 Right of Access

You have the right to request access to the personal information we hold about you. We will respond to your request within 30 days, as required by PIPEDA. There is no fee for a standard access request.

8.2 Right to Correction

You have the right to request correction of any inaccurate or incomplete personal information we hold about you. If we disagree with your request for correction, we will note your request on file.

8.3 Right to Deletion

You may request deletion of your personal information at any time. A self-serve data deletion tool is available in your dashboard. Upon deletion:

• Your uploaded files and report content will be permanently deleted;
• Your account information will be removed;
• Payment records retained by Stripe will not be affected (retained for compliance);
• Indemnity acceptance logs will be retained (legal obligation).

8.4 Right to Withdraw Consent

You may withdraw your consent for the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect our ability to provide the Service to you.

8.5 Right to Complain

If you are not satisfied with our response to your privacy concern, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada:

• Website: www.priv.gc.ca
• Toll-free: 1-800-282-1376
• Address: 30 Victoria Street, Gatineau, Quebec K1A 1H3

9. Marketing Communications and CASL Compliance

In compliance with Canada's Anti-Spam Legislation (CASL), S.C. 2010, c. 23:

• Express consent required: We only send commercial electronic messages (marketing emails) with your express opt-in consent.
• Transactional messages exempt: Emails related to service delivery (report delivery, receipts, account notifications, security alerts) are sent without separate consent as they fall within CASL's transactional message exemption.
• Easy unsubscribe: Every marketing email includes a clear and prominently displayed unsubscribe mechanism that is functional for at least 60 days.
• Dashboard control: You can manage your marketing preferences at any time through your account dashboard.

10. Data Security

We implement security safeguards appropriate to the sensitivity of the personal information we collect, including:

• Encryption in transit: All data transmission uses HTTPS/TLS encryption;
• Encryption at rest: Uploaded files and sensitive data are stored with encryption;
• Access controls: Role-based access controls limit who can access personal information;
• Secure authentication: OAuth-based authentication with session management;
• Payment security: PCI DSS compliance through Stripe (we never handle raw card data);
• Regular reviews: Periodic security assessments of our systems and practices;
• Data minimization: We collect only the minimum information necessary for the identified purposes.

10.1 Breach Notification

In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm, we will:

• Notify the Privacy Commissioner of Canada as required by PIPEDA;
• Notify affected individuals as soon as feasible;
• Keep a record of the breach as required by law.

11. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete that information promptly.

12. Cookies and Tracking

We use minimal cookies necessary for the operation of the Service:

• Session cookies: Essential for authentication and maintaining your logged-in state. These are strictly necessary and do not require consent under PIPEDA.
• Analytics: We use Umami, a privacy-respecting analytics tool that does not use cookies for tracking, does not collect personal information, and is fully PIPEDA-compliant.

We do not use third-party advertising cookies, social media tracking pixels, or cross-site tracking technologies.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated through a prominent notice on the website or by email. We encourage you to review this policy periodically.

14. Contact Our Privacy Officer

For privacy inquiries, access requests, correction requests, complaints, or to exercise any of your rights under PIPEDA, please contact:

Privacy Officer
1000144294 ONTARIO INC
Operating as: Ontario Permit & Compliance Snapshot
Email: [email protected]

We will acknowledge receipt of your inquiry within 5 business days and provide a substantive response within 30 days, as required by PIPEDA.