Privacy notice

We collect only what the service needs to work. There are no accounts, no passwords, and no profiles.

Information you give us:

• The property address you enter. This is the input for your report, together with the coordinates and property records that resolve from it. When it refers to an identifiable person's home, we treat it as personal information.
• The email address you provide for report delivery, link recovery, and letting you know if your report changes while it is still valid. We store it in our database to send those emails, and we look it up by a keyed hash of the address; an email waiting to be sent carries your email address until it is sent or fails, and a paid order whose report is still being prepared carries it until that work ends.
• Your name, entered on Stripe's payment page. We print it on the copy of your contract that Alberta's Internet Sales Contract Regulation requires us to send you (section 5(2)(b)). It is kept in the stored text of that email for the period in Retention below, and at Stripe under its own rules.
• Optional marketing consent. A separate, clearly optional checkbox. Leaving it unticked never affects your purchase or delivery.

Payment. Payments are handled by Stripe on Stripe-hosted pages. Your card number goes directly to Stripe; we never see or store it. We receive the transaction outcome and the records Stripe provides (amount, time, a payment reference), and the name and email address you enter on Stripe's page.

Records we create:

• Order records (what you bought, when, and the price shown to you).
• Consent and terms-acceptance records: the exact version of the wording you accepted, a cryptographic fingerprint (SHA-256) of that wording, the time, and a keyed hash of your IP address. This is the evidence that a contract was formed — we keep it so we can honour the contract, answer disputes, and prove what you were shown.
• Delivery and recovery logs keyed to a hashed form of your email address.
• Security logs used for rate-limiting and abuse prevention. Network addresses in these logs are stored as keyed hashes, not in raw form.

Cookies. We use only functional cookies — session, consent, and security cookies set by our infrastructure — never advertising or cross-site tracking cookies. Map tiles on report pages load from a mapping provider's servers, which, like any web request, see your browser's IP address.

What we do not collect: browsing profiles, advertising identifiers, or any personal information beyond what is listed above. Your report is built from public datasets (for example, City of Calgary open data and Statistics Canada publications); we do not send your personal information to those publishers — their data is loaded into our own systems on a schedule, and your address is matched against it there.

We collect and use personal information for a short list of purposes, identified at or before the time of collection:

1. To produce and deliver your report — the address is the subject of the assessment; the email is how the report and your contract copy reach you, how you recover your link, and how we may let you know if the data or rules behind your report change while it is still valid.
2. To process payment and prevent fraud — through Stripe.
3. To keep the service safe and reliable — rate-limiting, abuse prevention, security monitoring, and error monitoring — personal information other than order, property and report identifiers and the product purchased is scrubbed before error reports leave our systems.
4. To meet legal obligations — tax and accounting records, and the emailed copy of your contract required by Alberta's consumer-protection rules.
5. To keep proof of what you agreed to — journals of consent and terms acceptance.
6. To send occasional marketing email — only if you separately opted in. The marketing checkbox is optional, never a condition of purchase, and every email includes an unsubscribe link that works in one click.

We do not sell personal information, and we do not use it for advertising profiles.

Your information is stored primarily in Canada. Specific functions are performed by the service providers below.

We remain responsible for personal information we pass to the providers above for processing, and the law requires us to use contractual or other means to give it a comparable level of protection while they process it (PIPEDA, Schedule 1, clause 4.1.3). Public open-data pipelines (City of Calgary, Statistics Canada, Bank of Canada) process public records about properties and the economy — they do not receive your personal information and are therefore not listed as processors.

Some of the providers above store or process personal information outside Canada — primarily in the United States, and in the European Union for error monitoring. Some Canada-region services are operated by US-headquartered companies, and traffic to our site passes through global network infrastructure. While information is outside Canada, it is subject to the laws of the country where it is held, and courts, law enforcement and regulators there may be able to compel access to it under those laws. That is true of any service that uses international providers; we say it plainly rather than bury it.

Our controls for this:

1. Notice at collection. Each form where you enter an address or an email address before checkout carries a short notice about our service providers outside Canada, with a link to this notice. Before you pay, the checkout step asks you to agree to this notice and links to it; this notice names these providers.
2. This document. This page is the versioned, standing description of the data flows, the providers, the regions, the retention periods, and your rights. When it changes, its version changes.
3. Alberta notice. As required by Alberta's Personal Information Protection Act, section 13.1: some of our service providers are outside Canada; you may obtain written information about our policies and practices with respect to those providers by contacting us (see Contact below); and you can ask us the same way how those providers collect, use, disclose or store personal information on our behalf.

Access and correction. You may ask what personal information we hold about you, how it is used, and to whom it has been disclosed, and you may ask us to correct it (Alberta PIPA sections 24–25; PIPEDA Schedule 1, Principle 9 — Individual Access). We respond within 45 days from the day we receive your written request — the time limit in Alberta's Personal Information Protection Act, section 28 — or sooner where federal privacy law (PIPEDA) applies to your request and sets a shorter time limit. If the law that applies to your request allows us more time and we need it, we tell you why, when to expect our response, and that you can ask the privacy commissioner to review the extension.

Withdrawing consent. You may withdraw consent at any time, subject to legal and contractual limits; we will tell you what the practical consequences are. Withdrawing marketing consent is one click — every marketing email carries an unsubscribe link, and unsubscribing never affects a report you have bought.

Deletion — how it actually works here, stated plainly. Our purchase and audit records are append-only by design: once written, they are never silently edited. That design is what lets us prove, years later, exactly what you bought, what you were shown, and what our systems did — protection that works in your favour in a dispute as much as ours. That is true of those records only: when you ask us to delete your email address, we delete it, within the limits set out below.

Backups: what we delete on a deletion request stays in our database backups until those backups are deleted automatically, within 16 days. If we ever have to restore our database from a backup, we repeat the deletions made since that backup was taken.

You can start a deletion request by writing to us at info@suitescore.ca. We act on our own systems, and we reply by email within 30 days of receiving your request. Our service providers hold their own copies; we do not control their deletion clocks and will not pretend otherwise. Short-lived ones, such as delivery queues and model-provider caches, expire under the providers' own terms — on their schedule, not ours. Others, such as records at our payment provider, are kept under that provider's own rules. Once we act on your request, our reply names what we deleted and what we keep of what you asked us to remove, and why. It also says what expires on someone else's schedule, and names any copy your request could not reach. For our retention periods, it points you to the table in Retention below.

Honest limits. Some records survive a deletion request for a time: records the law requires us to keep (tax records), paid report and order records for the period in Retention below, evidence of the consents you gave, records needed for an active dispute, delivery records kept for the card-payment dispute period, and records under a legal hold. A deletion request also does not remove two kinds of records. These are free reports, with the address you checked, and the links between a hashed form of your email address and your reports. Retention below says how long we keep them. Alberta PIPA expressly permits retention needed for legal or business purposes even after consent is withdrawn (section 35(3)).

Complaints. Contact us first (see Contact). If you are not satisfied with our response, you may complain to the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.

Alberta's PIPA allows us to keep personal information only as long as we reasonably need it for legal or business purposes, and then requires us to destroy it or render it non-identifying (section 35). Current periods — and where a kind of record has no set period and is not deleted automatically, we say so:

This notice is versioned, and the version is load-bearing: when you accept our terms at checkout, your consent record stores the version identifier and a SHA-256 fingerprint of the exact wording you saw — so there can never be a dispute about which text you accepted. We do not edit a published version in place: any change becomes a new version with a new effective date, and past orders keep pointing at the version they were made under. The wording behind any version you accepted can be reproduced on request.

The current version appears on this page and at checkout. The current text is a working draft (texts@afed70240813+right.contract@42de0cf5979a); version 1.0 · effective [DATE] will be published here following legal counsel review.

Write to us to: request access to or correction of your personal information; obtain written information about our policies and practices regarding service providers outside Canada (Alberta PIPA sections 6(3) and 13.1(3)); ask questions about how those providers collect, use, disclose or store personal information for us; or make a deletion request.

If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.