Privacy Policy

1. Introduction

Civic Reserve ("we", "our", or "us") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our reserve fund planning platform and services. This policy complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

2. Information We Collect

2.1 Personal Information

We collect personal information that you voluntarily provide when you:

• Register for an account (name, email address, phone number, organization name)
• Request a quote or service (property details, contact preferences)
• Make a payment (billing information, processed securely through Paddle as our Merchant of Record)
• Communicate with us (correspondence, support inquiries)
• Upload documents or reports to the platform

2.2 Property and Building Information

As part of our reserve fund planning services, we collect detailed information about condominium properties, including building components, maintenance history, photographs, and financial data related to reserve funds. This information is essential for providing accurate depreciation reports and reserve fund studies.

2.3 Technical Information

We automatically collect certain information when you use our Service:

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, time spent, features used)
• Cookies and similar tracking technologies
• Log files and analytics data

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing and maintaining our reserve fund planning services
• Processing payments and managing subscriptions
• Preparing reserve fund studies and depreciation reports
• Communicating with you about services, updates, and support
• Improving our platform and developing new features
• Ensuring security and preventing fraud
• Complying with legal obligations and regulatory requirements
• Analyzing usage patterns to enhance user experience

4. Legal Basis for Processing (PIPEDA Compliance)

We process your personal information based on:

• Consent: You provide explicit consent when creating an account or requesting services
• Contract Performance: Processing is necessary to fulfill our service agreement with you
• Legal Obligations: Compliance with provincial condominium regulations and financial reporting requirements
• Legitimate Interests: Improving our services, security, and fraud prevention

5. Information Sharing and Disclosure

We do not sell your personal information. We may share your information with:

5.1 Service Providers

• Clerk: Authentication and user management
• Paddle: Payment processing as Merchant of Record (PCI-DSS compliant, handles tax and compliance)
• AWS: Cloud hosting and document storage (Canadian data centers)
• Supabase: Database hosting and management
• Resend: Transactional email delivery

5.2 Professional Partners

Licensed engineers, architects, and inspectors who conduct site assessments and prepare technical components of reserve fund studies. These professionals are bound by confidentiality agreements.

5.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental regulation, or if necessary to protect our rights, property, or safety.

6. Data Storage and Security

6.1 Data Location

Your data is primarily stored in Canadian data centers (AWS ca-central-1 region) to comply with Canadian data residency requirements. Some service providers may process data internationally, but we ensure appropriate safeguards are in place.

6.2 Security Measures

• Industry-standard encryption for data in transit (TLS/SSL) and at rest (AES-256)
• Regular security audits and vulnerability assessments
• Role-based access controls and authentication
• Secure document storage with access logging
• Regular backups and disaster recovery procedures
• Employee training on data protection and confidentiality

6.3 Data Retention

We retain your personal information for as long as necessary to provide services and comply with legal obligations. Reserve fund studies and related documents are typically retained for 7 years in accordance with professional standards and regulatory requirements. You may request deletion of your data, subject to legal retention requirements.

7. Your Privacy Rights

Under PIPEDA and applicable provincial laws, you have the right to:

• Access: Request copies of your personal information we hold
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your data (subject to legal obligations)
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to certain processing activities
• Withdraw Consent: Withdraw consent for optional data processing
• Complaint: File a complaint with the Privacy Commissioner of Canada

To exercise these rights, contact us at privacy@civicreserve.ca. We will respond within 30 days as required by PIPEDA.

8. Cookies and Tracking Technologies

8.1 Types of Cookies We Use

• Essential Cookies: Required for authentication and platform functionality
• Analytics Cookies: Help us understand how users interact with our platform
• Preference Cookies: Remember your settings and preferences

8.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling essential cookies may affect platform functionality. We do not use third-party advertising cookies.

9. Third-Party Links

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

10. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately.

11. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users and relevant authorities as required by PIPEDA within 72 hours of becoming aware of the breach. Notifications will include the nature of the breach, potential consequences, and mitigation steps.

12. International Data Transfers

While we primarily use Canadian data centers, some service providers may process data in the United States or other jurisdictions. We ensure appropriate safeguards such as Standard Contractual Clauses and data processing agreements to protect your information during international transfers.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Material changes will be communicated via email or prominent notice on our platform at least 30 days before taking effect. Continued use of the Service after changes indicates acceptance of the updated policy.

14. Contact Information

For privacy-related inquiries, requests, or complaints, please contact:

15. Consent

By using Civic Reserve, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. For sensitive information requiring explicit consent, we will obtain your express permission before processing.