1001502179 Ontario Inc., operating as MySubSheet ("MySubSheet," "we," "us," or "our"), respects your privacy and is committed to protecting the information entrusted to us by our customers and their subconsultants.

This Privacy Policy explains how we collect, use, disclose, and protect information when you use our software platform and related services (the "Service"). MySubSheet is based in Toronto, Ontario, Canada, and is intended for business use.

Our role. For information about your own firm and account, we act as the organization responsible for it. For personal information about your subconsultants, we act as your service provider (a processor acting on your behalf): we handle it only on your instructions and only to provide the Service, and you remain the party responsible to your subconsultants for it. This Policy, together with our Terms of Service, sets out the data-processing terms that apply to your use of the Service unless a separate signed agreement says otherwise.

1. Information we collect

Access requests. When you request access to MySubSheet through our website, we collect the information you submit — your name, your organization's name, your email address, and your selected plan. Submitting the form indicates your acceptance of this Privacy Policy and our Terms of Service.

Account information. When you create an account, we collect your name, email address, business name, and login credentials. You may also provide your business address directly, at any time, in Settings.

Payment information. No credit card is required to start on the Solo plan. If you upgrade to a paid plan, subscription payments are processed by our third-party payment provider, Stripe. Stripe collects and handles your payment card details directly under its own terms and privacy policy; we do not collect or store your full card numbers. Current pricing is described in our Terms of Service, which also explain how pricing may change over time.

Requirements, project, and subconsultant information. To provide the Service, we collect the information you enter directly into MySubSheet, including your base and project-specific insurance requirements, your list of projects, and your subconsultants' contact information (such as name, email address, and business name). MySubSheet does not connect to or read from your accounting, CRM, or project-management software — this information comes directly from you.

Documents your subconsultants upload. When you send a request, your subconsultant is emailed a one-time code to access a secure portal where they can upload the requested certificate of insurance or other compliance document. We store the documents they upload, along with whatever information those documents happen to contain (for example, insurer name, policy number, coverage limits, additional-insured status, and expiration dates), and the status of each request (pending, submitted, approved, rejected, or held). We do not read, extract, interpret, or act on the contents of these documents ourselves — see Section 3.

Because a document is uploaded as a file, we do not control and cannot anticipate everything it may contain. You and your subconsultants should not include personal information beyond what is reasonably necessary for insurance and compliance purposes — see Section 7.

Your review and approval activity. We record the comparisons and decisions you make when reviewing a submission — for example, which submissions you approved or rejected, and when — so your compliance matrix and history stay accurate and auditable.

Technical information. We automatically collect certain technical information, including IP address, browser type, device information, usage activity, and log information. We use browser storage to remember your display preferences.

Analytics information. We use Umami, a cookieless, privacy-focused analytics tool, to understand how visitors interact with our marketing website, including how visitors arrive, pages visited, and general usage patterns.

2. How we use information

We use information to: provide, operate, and improve the Service; send the automated requests and reminders you configure; maintain your compliance matrix and records; give your subconsultants secure, one-time-code access to the portal so they can submit documents; process your subscription; provide customer support; maintain security and prevent abuse; monitor performance; comply with legal obligations; and communicate service updates.

Where we use information to improve the Service, we do so using aggregated or de-identified usage data — for example, which features are used and where errors occur. We do not use the contents of your uploaded documents for product development.

3. Artificial intelligence

We do not use artificial intelligence to read your documents or make compliance decisions. We do not use AI or machine learning to read, extract, interpret, summarize, score, or make any determination about the contents of any document you or your subconsultants upload, or about whether any coverage is adequate, sufficient, valid, or compliant. No automated system decides whether a submission meets your requirements. Every comparison and approval decision is made by a person at your firm, and every record in your account reflects a decision you made or information you or your subconsultants entered or uploaded directly. No decision with legal or similarly significant effects about any individual is made by automated means.

No training on your data. We do not use your data, or your subconsultants' data, to train any AI model, and we do not permit our service providers to do so. Our infrastructure providers may apply automated techniques within their own systems for routine operational purposes such as spam filtering, fraud detection, and abuse prevention; this is separate from the Service's handling of your documents and involves no evaluation of your compliance data. If we ever introduce a feature that uses AI to process your documents or compliance data, we will update this Policy and give reasonable advance notice before it applies to your account.

4. Information provided by your subconsultants

Subconsultants access the portal using a one-time code sent to the email address you provide — they do not create an account or set a password with us. Through the portal, a subconsultant can upload the documents you've requested and view the status of open requests. We do not otherwise collect information about your subconsultants beyond what you provide to us and what they submit through the portal.

Because access is granted by a code sent to an address you supply, the accuracy of that address matters: anyone with access to that mailbox may be able to reach the request and its documents. You are responsible for entering correct addresses and for confirming they belong to the intended recipient (see Section 7).

5. How we share information

We do not sell your information or your subconsultants' information, and we do not share it for cross-context behavioral advertising or targeted advertising as those terms are used under U.S. state privacy laws. We do not disclose it for any purpose other than those described below.

Service providers. We share information only with the third-party providers needed to run the Service, which currently include: Amazon Web Services (hosting and database, in Canada; see Section 8), Stripe (payment processing), our email-delivery provider, and Umami (website analytics). These providers only receive the information necessary to perform their services, are bound by contract to protect it, and may not use it for their own purposes.

Business transfers. If MySubSheet is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. We will require that it remain protected in accordance with this Privacy Policy, and we will notify you if it becomes subject to a materially different policy.

Legal requirements. We may disclose information where required by law, or where reasonably necessary to protect our rights, our security, or our users. Where we are legally permitted to do so, we will make reasonable efforts to notify you before disclosing information you have entrusted to us in response to a legal demand.

Changes to providers. We may update our service providers from time to time; material changes will be reflected in this Policy.

Third-party sites. Our website and Service may link to third-party sites (such as Stripe); those sites are governed by their own privacy policies, not this one.

6. Data security

We use reasonable technical and organizational measures designed to protect your information, including: encryption in transit (TLS 1.2 or higher) and at rest (AES-256, the default for our AWS database and storage services); access controls and least-privilege limits on who can access data, including multi-factor authentication on internal and administrative systems; audit logging of account and data-change activity; one-time email code (OTP) verification for portal access, so subconsultants never need a password with us; hosting with a major cloud provider (AWS) in Canada; continuous backups with point-in-time recovery, including backup encryption and periodic recovery testing; ongoing vulnerability management and dependency patching; and separation of our production and non-production environments. Our personnel are subject to security training and confidentiality obligations, and we maintain an incident-response process with defined timelines. We restrict access to personal information to those who need it to operate the Service.

These measures describe our current practices and may evolve as the Service and the threat landscape change; we will maintain protections that are at least equivalent in effect. No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security. If a breach affecting your information occurs, we will notify you and any regulators as required by applicable law, and without undue delay. To report a security concern, contact us at luke@mysubsheet.com.

7. Your responsibilities

You are responsible for ensuring you have the right to provide us with information relating to your subconsultants, and to contact them, consistent with applicable law, including Canada's Anti-Spam Legislation (CASL) and the U.S. CAN-SPAM Act where those laws apply, and applicable privacy laws. You are responsible for providing your subconsultants with any notice, and obtaining any consent, that applicable privacy law requires for the collection and handling described in this Policy.

You are responsible for the accuracy of the requirements, projects, records, and email addresses you enter, including confirming that each address belongs to the intended recipient. You are responsible for determining, independently of MySubSheet, whether any submitted document reflects adequate, sufficient, or compliant coverage.

Information that should not be uploaded. The Service is designed for insurance and compliance documents. You should not upload, or invite your subconsultants to upload, personal information beyond what is reasonably necessary for that purpose — in particular government identification numbers (such as Social Insurance or Social Security numbers), financial account credentials, health information, biometric data, or information about individuals under 18. If such information is submitted, you are responsible for removing it, and we will remove it on request.

8. Where your data is stored

Your data is hosted on Amazon Web Services in the Canada (Central) region, located in Montreal, Canada. Some service providers, such as our payment processor and analytics provider, may process limited information outside Canada, primarily in the United States; where they do, that information remains protected by contract. Information stored in or transferred to another country may be accessible to courts, law enforcement, and authorities in that country under its laws.

9. Data retention and deletion

We retain information only for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. While your account is active, we retain your compliance records and uploaded documents so they remain available to you.

Export before you delete. Deletion is permanent and cannot be reversed. Because compliance and insurance records are often needed later — for audits, claims, or limitation periods — you should download anything you may need, or contact us for a full export, before requesting deletion or closing your account. You are responsible for retaining your own records; the Service is not a system of record for that purpose.

To request deletion of your account data, and your subconsultants' data, an account owner or admin can submit a written request to luke@mysubsheet.com. We will confirm receipt of the request and give you an opportunity to cancel it before deletion is carried out. Once we receive your request, we will process it and permanently delete the remaining data from our active systems within 30 days, except anything we are required to keep by law or reasonably need to retain to establish or defend legal claims or to prevent fraud or abuse. Residual copies in encrypted backups are purged on our normal backup cycle, within 90 days of active-system deletion, and are not used for any other purpose in the meantime.

10. Your rights

Subject to applicable law, you may:

• request access to the personal information we hold about you;
• request correction of inaccurate information;
• request deletion of your information;
• request a copy of your information in a portable format;
• withdraw consent (which may limit our ability to provide the Service); and
• make a complaint to a privacy regulator.

We do not discriminate against anyone for exercising these rights.

If you are a subconsultant of one of our customers, the firm that invited you is responsible for your information, and we act on its instructions — please direct requests to that firm. We will assist our customers in responding, and will forward requests we receive directly. To make a request about your own MySubSheet account, contact us at luke@mysubsheet.com. We may need to verify your identity before responding, and we will respond within the timeframes required by applicable law. If you are not satisfied with our response, Canadian users may contact the Office of the Privacy Commissioner of Canada or their provincial regulator, and U.S. users may have additional rights and complaint avenues under the law of their state.

11. Canadian and U.S. privacy law

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable Canadian privacy laws, which may include provincial laws such as Quebec's Law 25 and the personal information protection legislation of Alberta and British Columbia, depending on where you and your subconsultants are located. Our Privacy Officer is accountable for our compliance with this Policy and can be reached at luke@mysubsheet.com.

Most information we process about U.S. business contacts relates to individuals acting in a commercial or employment capacity, which is exempt from several U.S. state privacy laws. California is an exception: the California Consumer Privacy Act applies to business-contact information, so California residents may exercise the rights described in Section 10 with respect to information we hold. Where other applicable U.S. state privacy law grants rights over information we hold, we honor those rights for the information they cover; contact us at luke@mysubsheet.com to make a request.

12. Children

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from children, and information about individuals under 18 should not be submitted to the Service. If you believe a child has provided us information, contact us and we will delete it.

13. Our emails to you

We may send you service and transactional emails necessary to operate your account (such as login, security, and billing notices). These are operational rather than marketing communications. If we send marketing emails, they will comply with applicable law, including CASL and CAN-SPAM, and include a way to unsubscribe. You cannot opt out of essential service emails while you have an active account.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. For material changes — including any change to the purposes for which we use information, the providers we share it with, or where it is stored — we will give at least 30 days' notice by email to the address on your account before they take effect, so you can review them or close your account. We will not apply a materially different use to information already collected without a lawful basis for doing so.

15. Contact us

If you have questions about this Privacy Policy, contact us at luke@mysubsheet.com, 1001502179 Ontario Inc. (o/a MySubSheet), Toronto, Ontario, Canada.