Privacy notice

This notice explains what Canadian Codes collects, why, who processes it on our behalf, and your choices. It addresses our obligations under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws.

What we collect

Account. When you sign in with Google we receive your name, email address, and Google account identifier. If you use email sign-in, we process your email address plus short-lived challenge, rate-limit, and verification metadata. Codes are stored only as keyed cryptographic checks and expire after 10 minutes. We do not receive or store your Google password.

Your questions and answers. The questions you ask, the answers generated, the citations returned, and the jurisdiction you set are stored so your chat history works across sessions.

Billing. Subscription plan, status, renewal date, and Stripe customer and subscription identifiers. We never see or store your full card number.

Operational. Monthly question counters, rate-limit counters, shared-chat links you create, and standard technical logs such as IP address, request time, and error traces.

Support communications. If you email support, we receive the sender and reply address, subject, message content, and any attachments you include so we can investigate and respond.

Why we use it

To provide and secure the Service: authenticating you, retrieving relevant code excerpts, generating and displaying answers, keeping your history, enforcing plan limits and rate limits, processing payments, preventing abuse, and diagnosing faults. We do not sell your personal information, and we do not use your questions to train our own models.

AI processing

Your question and recent conversation context are sent to our AI providers to search for relevant material and generate an answer. Do not enter sensitive personal information, such as health details, financial information, or government identifiers, into prompts. Chat content is stored in your history until you delete it.

Service providers

We rely on the following processors, each handling only what their function requires: Google (sign-in), Stripe (payments and billing), Supabase (database and document corpus), Upstash (chat history, usage and rate-limit counters), Anthropic (answer generation), OpenAI (text embeddings), ImprovMX (inbound support forwarding), Resend (transactional email delivery), and Vercel (hosting and analytics).

Storage outside Canada

These providers may store and process data in the United States and other countries. While it is outside Canada, personal information may be accessible to foreign courts, law enforcement, and regulators under the laws of that jurisdiction. By using the Service you consent to this transfer. We use providers that offer contractual protections comparable to those required under Canadian law.

Retention

Account and chat data are kept while your account is open and are deleted when you delete your data from the Settings page. Usage counters expire at the end of each monthly period. Billing records are retained by Stripe for the periods required by tax, anti-fraud, and financial recordkeeping law, and remain after account deletion for that reason. Technical logs are retained for a short operational window. Support correspondence is generally kept only while needed to handle the request and for up to 12 months afterward, unless a longer period is required for security, a legal obligation, or an active dispute.

Your rights

You may access, export, correct, or delete your information. Export and deletion are self-serve from the Settings page; for anything else, email us. You may withdraw consent and stop using the Service at any time, subject to records we must keep by law. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.

Security

Access is protected by Google authentication or single-use email codes, transport encryption, abuse controls, and server-side access controls; payment credentials are handled entirely by Stripe and never reach our servers. No system is perfectly secure, and we cannot guarantee absolute security of information transmitted to or stored by the Service.

Cookies

We use cookies that are necessary to operate the Service, primarily to keep you signed in and to remember interface preferences such as theme and sidebar state. We also collect aggregate, privacy-preserving usage analytics about page performance. We do not use advertising cookies or cross-site tracking.

Children

The Service is intended for professional and adult use and is not directed at children. We do not knowingly collect personal information from children.

Changes

We may update this notice. Material changes will be reflected in the “last updated” date above, and where the change materially affects how we handle your information we will make reasonable efforts to notify account holders.

Contact

For privacy requests or questions, email support@canadiancodes.ca. We respond to access and deletion requests within 30 days.