Privacy Policy
This policy explains how FirmStead (“FirmStead”, “we”) collects, uses and protects personal information through the firmstead.app website and the FirmStead software service (the “Service”). We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Quebec, the Act respecting the protection of personal information in the private sector (Law 25).
1. Two different roles
This website. When you visit firmstead.app or write to us, we decide what is collected and why.
The Service. Companies that subscribe to FirmStead (our “customers”) enter information about their own projects, employees, vendors and clients. For that information we act as a service provider on our customer’s behalf: the customer decides what is collected and why, and requests about it should go to that company first. We will help them answer.
2. What we collect
- When you contact us: your name, email address, phone number, company name and anything you choose to tell us.
- Account information: name, email address, role and password (stored only as a one-way hash) for people our customers invite.
- Content in the Service: projects, estimates, documents, photos, messages, emails, time records and other material our customers and their users add.
- Technical information: server logs and error reports (for example IP address, browser type and the request that failed), used to keep the Service secure and working.
This website uses no advertising or analytics cookies and does not track you across other sites.
3. How we use it
- To reply to your enquiry and arrange a demonstration.
- To provide, secure, support and improve the Service.
- To send service messages, such as password resets and notices about changes to these terms.
- To meet legal, tax and accounting obligations.
We do not sell personal information, and we do not use our customers’ content to train artificial intelligence models.
4. Service providers and where data is stored
We rely on a small number of providers to run the Service. Each receives only what it needs for its task and is bound by contract to protect it:
- Render — application hosting and database (United States).
- Cloudflare — file storage, domain and incoming email.
- MXroute — sending email from the Service.
- Anthropic — processing for the optional AI features, when a user uses them.
- Sentry — error reporting.
- Geoapify / OpenStreetMap — address suggestions while typing.
- Integrations a customer chooses to connect, such as Google (Gmail), Dialpad or Telegram.
As a result, personal information may be stored or processed outside your province and outside Canada, mainly in the United States, where it may be accessible to authorities under local law. Before such transfers we assess whether the information will receive adequate protection, as Quebec law requires.
5. How long we keep it
We keep enquiry emails for as long as needed to follow up, and no longer than two years without further contact. Customer content is kept for the duration of the subscription and deleted or returned within 90 days after it ends, unless the law requires us to keep it longer. Backups are overwritten on a rolling schedule.
6. Security
Data is encrypted in transit, each customer company is isolated from the others, access is limited by role, and passwords are never stored in readable form. No system is perfectly secure; if a confidentiality incident creates a risk of serious injury, we will notify affected people and the relevant authorities as the law requires.
7. Your rights
You may ask to access or correct your personal information, withdraw consent, or ask us to stop using it or delete it where the law allows. People in Quebec may also ask for information about how decisions are made by automated means and for their information in a structured, commonly used format. We answer within 30 days.
8. Contact and complaints
Our person in charge of the protection of personal information can be reached at alex.kournitsky@gmail.com. If you are not satisfied with our answer, you may contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.
9. Changes
We will post any change to this policy on this page with a new date, and tell customers directly about significant changes.