Privacy Policy

1. Who we are

This Privacy Policy explains how InfraLedgers ("we", "us") collects, uses and discloses personal information in connection with the InfraLedgers service (the "Service"). We handle personal information in accordance with applicable Canadian privacy law.

2. Information we collect

Account information: name, email address, password (stored in hashed form by our authentication provider), job title and other profile details you provide.

Organization and project information: organization name, logo, business contact details, project details, team membership and roles.

Customer Data: records, files and contacts that users enter into projects, which may include names, email addresses and business contact information of project participants.

Billing information: subscription status, plan and billing contact details. Payment card details are collected and processed by our payment processor, Stripe; we do not store full card numbers.

Usage and technical information: sign-in events, audit records of actions taken in the Service, notification activity, and standard technical data such as browser type and IP address used to operate and secure the Service.

3. How we use information

To provide and operate the Service, including authentication, permissions, notifications and record distribution; to send service and transactional emails (such as invitations, verification and record notifications); to process subscriptions and payments; to maintain audit history; to secure the Service and prevent misuse; to provide support; and to comply with legal obligations.

We do not sell personal information. We do not use Customer Data for advertising.

4. Customer Data and organizations

Organizations that use the Service control the project information their users enter, decide who has access, and are responsible for having appropriate authority to share personal information of their project participants with us. If your information appears in an organization's project and you have questions, please contact that organization first; we will assist them in responding.

5. Service providers

We use third-party service providers to operate the Service: Lovable (application hosting, database, file storage, authentication and email delivery, on infrastructure that includes Supabase, Amazon Web Services and Cloudflare) and Stripe (payment processing). These providers process information on our behalf and only as needed to provide their services. [OWNER/LEGAL TO CONFIRM PROVIDER LIST]

The Service's database and stored files are hosted in the United States. Personal information may also be processed in other countries by our service providers, and is therefore stored or processed outside your province and outside Canada, where it may be subject to the laws of those jurisdictions.

6. Disclosure

Information you enter into a project is shared with the people your organization authorizes, including external collaborators on records issued to them. We may otherwise disclose personal information to service providers as described above, where required by law, to protect the rights and safety of users or the Service, or in connection with a business transfer subject to this Policy.

7. Security

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information, including access controls, organization and project isolation, private file storage and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Retention

We retain personal information for as long as needed to provide the Service and for legitimate business and legal purposes. Formal project records and their audit history are intentionally preserved while an organization's account is active. [OWNER/LEGAL TO CONFIRM RETENTION PERIODS]

9. Your choices and rights

You may access and update your profile information in the Service. Subject to applicable law, you may request access to or correction of your personal information, or withdraw consent where applicable, by contacting info@infraledgers.com. You can adjust notification preferences in your settings.

10. Cookies and local storage

The Service uses browser storage and similar technologies that are necessary to keep you signed in and remember preferences such as theme.

Advertising measurement: our website uses the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company / LinkedIn Corporation) to measure the effectiveness of our LinkedIn advertising, including whether ad visitors go on to start a paid subscription. LinkedIn may set cookies and receive your browser and device information, pages visited, IP address and, if you are signed in to LinkedIn, associate that activity with your LinkedIn account under LinkedIn's own privacy policy. When a new organization completes its first paid subscription we send LinkedIn only a conversion signal — no names, email addresses, payment details or project data.

In Canada (including Quebec), the EU/EEA, the UK and Switzerland, and wherever we cannot determine your region, the LinkedIn tag loads only after you click Accept in our cookie notice. Elsewhere, including the United States, it loads by default unless you opt out or your browser sends a Global Privacy Control signal, which we treat as an opt-out. You can accept, reject or withdraw at any time using the "Cookie settings" link in the website footer; your choice and the time you made it are stored in your browser. You can also opt out through LinkedIn's ad settings.

11. Changes

We may update this Policy and will post the updated version with a new effective date.

12. Contact

Privacy questions or requests: info@infraledgers.com. [PRIVACY OFFICER NAME/TITLE]