This policy states what we collect, why, and the choices you have.
What we collect.
- Account information: name, business email, company name, role, billing address.
- Operational data you upload: invoices, signed purchase orders, forecast cash flows, forward contracts, counterparty names. This is your business data. Do not upload personal information you are not entitled to share.
- Usage information: pages viewed, features used, IP address, device and browser metadata, error logs.
- Billing information: processed by Stripe. PolicyFX does not store full card numbers.
Why we collect it.
- To deliver the service you subscribed to.
- To send transactional email through Resend: security alerts, billing notices, coverage summaries.
- To improve the platform through aggregated, de-identified analytics.
- To meet legal, accounting, and audit obligations.
Where it is stored.
Operational data is hosted in Supabase, region ca-central-1 (Montreal). It is encrypted in transit with TLS 1.2 or higher and encrypted at rest. Row-level security blocks cross-tenant access at the database layer. See "PIPEDA and data residency" for detail.
How long we keep it.
Account and operational data is kept for the life of the subscription plus thirty days, then deleted or anonymized. Billing records are kept for seven years to meet Canadian tax requirements.
Your rights under PIPEDA.
You may request access to the personal information we hold, correction of inaccurate information, and withdrawal of consent, subject to your subscription terms.
Send requests to info@policyfx.ca. We answer within thirty days.
Breach notification.
If a breach creates a real risk of significant harm, we notify affected users and the Office of the Privacy Commissioner of Canada, as PIPEDA requires.
Children.
The service is not intended for anyone under eighteen.
Contact.
Privacy Officer, PolicyFX Inc.
info@policyfx.ca