Privacy Policy

Phaseview Inc. ("Phaseview," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you use our website at phaseview.ca and associated services (collectively, "the Service").

This policy complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).

By using the Service, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. If you do not agree, you must not use the Service.

Information You Provide

When you create an account or use the Service, we collect information you voluntarily provide:

• Email address
• Username and display name
• Password (stored using industry-standard cryptographic hashing -- we never store plain-text passwords)
• Organization name and role (if applicable)
• Forum posts, comments, and community contributions
• Support requests and correspondence

Information Collected Automatically

When you access the Service, we automatically collect:

• IP address and approximate geographic location
• Browser type, version, and operating system
• Device information and screen resolution
• Pages visited, features used, and time spent on the Service
• Search queries and map interactions (search queries are used solely for delivering results and improving the Service, and are not shared with third parties)
• Referral URLs and navigation paths

Payment Information

If you subscribe to a paid plan, payment information (credit card numbers, billing address) is collected and processed directly by our payment processor, Stripe, Inc. We do not store your full payment card details on our servers. We receive only a transaction reference, last four digits of your card, and billing status from Stripe.

We use the information we collect for the following purposes:

Service Operation

• Authenticate your identity and manage your account
• Process your search queries and deliver relevant environmental data
• Provide geospatial analysis, mapping, and visualization features
• Enable community forum participation
• Process payments and manage subscriptions

Communication

• Send essential service notifications (account verification, password resets, security alerts)
• Notify you of material changes to the Service or these policies
• Respond to your support requests and inquiries

Improvement and Analytics

• Analyze usage patterns to improve the Service
• Identify and fix technical issues
• Develop new features based on user needs
• Generate aggregate, de-identified statistics

We may create de-identified or aggregated data from personal information by removing identifying details. Such de-identified data is not considered personal information and may be used for any lawful business purpose, including industry analysis, service benchmarking, and sharing aggregated analytics or usage trends with third parties. We take reasonable measures to ensure de-identified data cannot reasonably be used to identify individuals. Any data shared externally will be in aggregate or de-identified form and will not identify individual users.

Automated Processing

The Service uses automated processing to classify environmental report types, extract metadata from documents, and generate geospatial analyses. These automated processes operate on publicly available regulatory data and do not make decisions that produce legal or similarly significant effects on individual users. No automated profiling is used for access, pricing, or eligibility decisions.

Legal and Safety

• Comply with applicable laws and regulations
• Enforce our Terms of Service
• Detect, prevent, and address fraud or security threats
• Protect the rights, property, and safety of our users and the public

Under PIPEDA and PIPA, we process your personal information based on:

• Consent: You consent to our data practices when you create an account and accept this Privacy Policy
• Contractual necessity: Processing required to provide the Service and fulfill our Terms of Service
• Legitimate interests: Improving the Service, preventing fraud, and ensuring security
• Legal obligations: Complying with applicable Canadian laws and regulations

You may withdraw your consent at any time by closing your account, subject to legal and contractual restrictions. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

We do not sell, trade, or rent your personal information to third parties, and we do not share personal information with third parties for their own advertising or marketing purposes. We may share aggregated, de-identified usage data and analytics with third parties for research, benchmarking, or business purposes. Such data does not identify individual users.

We may share information in the following limited circumstances:

Service Providers

We use trusted third-party services to operate the platform. These providers process data on our behalf under contractual obligations to protect your information:

• Supabase -- Cloud database hosting and authentication. Your account data and application data are stored on Supabase infrastructure.
• Mapbox -- Interactive mapping and geospatial services. Map interaction data (viewport, coordinates) and your IP address are transmitted to Mapbox for tile rendering and map display.
• Stripe -- Payment processing. Payment card information is collected and processed directly by Stripe and is subject to Stripe's Privacy Policy.

Organization Accounts

If your account is part of an organization subscription, the organization administrator may have visibility into account activity such as login status, feature usage, and subscription tier. Organization administrators do not have access to your search queries, analysis results, or passwords.

Other Disclosures

• Legal requirements: When required by law, court order, subpoena, or government request
• Safety and rights: To protect the rights, property, or safety of Phaseview, our users, or the public
• Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets, with notice to affected users
• With your consent: In any other circumstance where you have given explicit consent

We implement administrative, technical, and physical safeguards to protect your information:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Secure password storage using industry-standard cryptographic hashing (currently Argon2id) with OWASP-recommended parameters
• Role-based access controls and authentication systems
• Regular security assessments and software updates
• Monitoring for unauthorized access attempts and anomalous activity
• Database backups with encryption

While we take reasonable measures to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. If we become aware of a security breach affecting your personal information, we will notify you and the appropriate authorities as required by law.

Under PIPEDA and PIPA, you have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your account and associated personal data (please note that while your active profile is deleted within 30 days, residual data may remain in encrypted backups for up to 90 days as detailed in Section 8)
• Data portability: Request your account profile information and user-submitted content in a structured, machine-readable format
• Withdrawal of consent: Withdraw your consent to data processing at any time
• Opt-out: Opt out of non-essential communications

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days as required by PIPEDA. We may need to verify your identity before processing your request.

Filing a Complaint

If you believe your privacy rights have been violated, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (1-800-282-1376) or the Office of the Information and Privacy Commissioner of Alberta (780-422-6860).

We use cookies and similar technologies for the following purposes:

Essential Cookies

Required for the Service to function. These manage authentication, session state, and security. You cannot opt out of essential cookies while using the Service.

Functional Cookies

Remember your preferences and settings (map view, analysis parameters, display options) to provide a personalized experience.

Analytics Cookies

Help us understand how users interact with the Service so we can identify issues and improve functionality. Analytics data is aggregated and does not identify individual users.

Managing Cookies

You can control cookies through your browser settings. Disabling non-essential cookies may affect certain features of the Service. Most browsers allow you to:

• View and delete existing cookies
• Block all or specific cookies
• Set preferences for certain websites
• Receive notifications when cookies are set

Do-Not-Track Signals

Some browsers transmit a "Do-Not-Track" (DNT) signal. There is currently no universally adopted standard for how online services should respond to DNT signals. As such, the Service does not currently respond to DNT signals. We will update this policy if a uniform standard is established.

We retain your personal information only for as long as necessary to:

• Provide the Service and maintain your account
• Comply with legal, regulatory, and contractual obligations
• Resolve disputes and enforce our agreements
• Maintain security and fraud prevention records

Retention Periods

• Active accounts: Data retained for the duration of your account
• Deleted accounts: Personal information removed within 30 days, except where retention is required by law. Encrypted backups containing residual data may persist for up to 90 days before being overwritten in the normal backup rotation cycle.
• Server logs: Retained for up to 90 days for security and troubleshooting
• Payment records: Retained as required by Canadian tax and financial regulations
• Forum content: May be retained in anonymized form after account deletion to preserve community discussions

The Service is not intended to collect sensitive personal information such as government identification numbers, financial account numbers (other than payment information processed by Stripe), health information, or biometric data. Please do not submit such information through the Service, including in forum posts, support requests, or profile fields.

Phaseview is based in Alberta, Canada. Your personal information is primarily stored and processed in Canada. However, our third-party service providers may process data in other jurisdictions (including the United States) which may have different privacy laws than your country of residence.

Where personal information is transferred outside of Canada, we ensure that appropriate safeguards are in place through contractual obligations with our service providers that require them to protect your information to a standard consistent with Canadian privacy law. Please be aware that personal information stored in or transmitted through foreign jurisdictions may be accessible to law enforcement and national security authorities of those jurisdictions under their local laws.

By using the Service, you consent to the transfer and processing of your information in Canada and other jurisdictions where our service providers operate. You may contact our Privacy Officer for more information about our policies and practices with respect to service providers outside Canada.

We comply with Canada's Anti-Spam Legislation (CASL). We will only send you commercial electronic messages with your express or implied consent.

• Transactional messages (account verification, password resets, billing notifications) are sent as necessary to operate the Service
• Service announcements about material changes or new features are sent based on your existing relationship with us
• Promotional or marketing communications are only sent with your express opt-in consent
• Every commercial message includes an unsubscribe mechanism that is honoured within 10 business days

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Provide at least 30 days' notice before changes take effect
• Notify registered users via email or prominent notice on the Service

Your continued use of the Service after the effective date of changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you should discontinue use of the Service and request account deletion.