Legal

Privacy Policy

Last updated August 20, 2026

Clevertech ("we," "our," or "us") operates clevertech.ca and related APIs, dashboards, and tools. This policy explains what we collect, why, the legal grounds we rely on, who we share it with, and the rights you have. DLS Magician at dls.clevertech.ca has a separate policy.

1. Information we collect

We collect personal information, technical data, and usage data. Sources are you, your device, and processors we use to run the service.

1.1 Personal information you provide

• Account: name, email, hashed password (if you sign up with email), OAuth identifiers, optional profile photo from Google or Microsoft.
• Billing: subscription tier, billing cycle, Stripe customer and subscription IDs, transaction history. Card numbers are collected by Stripe, not stored by us.
• Support: name, email, subject, and message from the contact form or email to support.
• API credentials: API keys we issue to your account (we store hashes, not plaintext keys after creation).

1.2 Technical data (automatic)

• IP address, approximate location derived from IP, browser and OS, device type.
• Request headers, timestamps, and security signals (including Cloudflare Turnstile on forms).
• Error traces and performance data from Sentry.

1.3 Usage data (automatic)

• Pages viewed, time on page, clicks, referring URL, and landing-variant assignment.
• API calls: endpoint, city, status code, latency, and daily usage against your plan.
• PostHog product analytics, including pageviews and session recordings with text inputs and images masked.

1.4 Sources

• You: forms, account signup, OAuth consent, support email, API use.
• Your browser and device: cookies, logs, analytics.
• Processors: Google or Microsoft (OAuth profile), Stripe (payment status), Cloudflare (bot checks), PostHog (usage), Resend (outbound email).
• Public data: municipal and government datasets we index are not your personal information. We do not treat published assessment, permit, or registry records as customer data.

We do not require sensitive categories (health, biometrics, government ID numbers) and ask you not to send them in support messages.

2. Purpose

We use this information to:

• Create and authenticate accounts, issue API keys, and deliver the API and dashboards (contract).
• Process subscriptions, overage packs, invoices, and taxes (contract and legal obligation).
• Answer support and privacy requests (consent or legitimate interest).
• Keep the service secure: rate limits, fraud and abuse prevention, error diagnosis (legitimate interest).
• Understand how the site is used and improve it, including A/B tests of the homepage (legitimate interest; you can object).
• Comply with law, including bookkeeping and responding to lawful requests.

We do not use your data for advertising networks, remarketing, or selling lists.

3. Legal basis

For Canadian PIPEDA, we collect, use, and disclose personal information with your knowledge and consent except where the law allows otherwise (for example, to investigate a breach of agreement or to protect us from fraud). For people in the EEA or UK, GDPR/UK GDPR bases are:

• Contract (Art. 6(1)(b)): accounts, API access, paid plans.
• Legitimate interests (Art. 6(1)(f)): security, logs, product analytics, A/B tests, improving the service. You may object.
• Consent (Art. 6(1)(a)): optional marketing email if we ever send it (we do not send promotional mail from the contact form). You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): tax, accounting, and compliance records.

California residents: we process personal information as described in this policy. We do not sell or share it for cross-context behavioral advertising as those terms are used in the CCPA/CPRA.

4. Sharing, processors, and transfers

We do not sell, rent, or trade personal information. We share it only with processors who help us run the service, when the law requires it, to protect rights and safety, or with your direction.

• Railway — application hosting. Privacy
• Cloudflare — CDN, TLS, Turnstile bot checks, and optional Web Analytics. Privacy
• Stripe — payments. Privacy
• Resend — transactional and support email. Privacy
• PostHog — product analytics and session replay (US). Privacy
• Sentry — error and performance monitoring. Privacy
• Google and Microsoft — if you sign in with OAuth. Google, Microsoft
• HubSpot — CRM contact records if that integration is enabled. Privacy
• Map tile providers (OpenStreetMap and related CDNs) when dashboards show a map.

Some processors are in the United States or other countries. Transfers from Canada follow PIPEDA's accountability rules: we remain responsible for personal information we send to agents. For EEA/UK users, processors use Standard Contractual Clauses or another approved mechanism where required.

5. Cookies and trackers

Cookies are small files on your device. We use:

• Strictly necessary: access_token (httponly session after sign-in), security/CSRF cookies on authenticated forms, Cloudflare Turnstile signals on the support form.
• Analytics: PostHog first-party cookies for pageviews, feature use, and session replay. Heatmaps and recordings mask form text and images.

We do not use advertising or targeting cookies and do not share cookie data with ad networks.

5.1 Opt-out

• Browser controls: Chrome, Firefox, Safari, Edge.
• Email [email protected] and we will record an analytics opt-out against your account or IP where we can identify you.
• Global Privacy Control / “Do Not Sell or Share” signals: we do not sell or share personal information for advertising. We do not currently change analytics behaviour for DNT because there is no common standard; we will update this if one is adopted.

Blocking strictly necessary cookies may prevent sign-in and the support form from working.

6. Retention

• Accounts and API usage: while the account is open, then as long as needed for billing, security, and legal holds.
• Stripe and tax records: generally seven years, as required for Canadian bookkeeping.
• Support form and email: typically 90 days after we close the thread, unless we need it longer for an open issue or legal reason. A copy may remain in our email system during active correspondence.
• Logs and error events: typically 30–90 days, longer if needed to investigate abuse.
• Analytics: according to our PostHog project settings, then aggregated or deleted.
• Landing cookie: 90 days.

You can ask us to delete personal information we do not need to keep. We will say if a legal exception applies.

7. Security

We use measures appropriate to the sensitivity of the information, including:

• TLS in transit; HSTS on HTTPS.
• HttpOnly, Secure, SameSite cookies for sessions.
• Hashed passwords and hashed API keys.
• Content Security Policy, rate limits, and Turnstile on public forms.
• Access limited to people and systems that need it to operate the service.

No internet transmission is guaranteed secure. If we become aware of a breach that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

8. Your rights

Depending on where you live, you may request:

• Access to the personal information we hold about you.
• Correction of inaccurate information.
• Deletion of information we no longer need (including CCPA deletion, subject to legal exceptions).
• Portability of information you provided, in a reasonable electronic format.
• Objection or restriction of processing based on legitimate interests, and withdrawal of consent where we rely on consent.
• California: know, delete, correct, and opt out of sale/share. We do not sell or share personal information. We will not discriminate against you for exercising these rights. You may use an authorized agent with proof of authority.

Email [email protected]. We will verify the request (typically by email) and respond within 30 days, or tell you if we need more time as allowed by law. EEA/UK users may lodge a complaint with their supervisory authority. Canadians may complain to the Office of the Privacy Commissioner of Canada.

9. Children

The service is built for developers, surveyors, and organizations. It is not directed at children under 16, and we do not knowingly collect personal information from children under 13. If you believe we have, contact us and we will delete it.

10. Contact

Clevertech
Privacy: [email protected]
Support: [email protected] or clevertech.ca/support
Website: clevertech.ca

Privacy mail is the contact for PIPEDA inquiries and for EEA/UK data-protection questions (we have not appointed a separate DPO).

11. Updates

We will post changes on this page and update the “Last updated” date. Material changes (new purposes, new categories of personal information, or a new use that is not reasonably expected) will also be noted on the site or emailed to the address on your account when we can. Continued use after the effective date means you accept the updated policy. Prior versions are available on request.

12. Jurisdiction

We are based in Canada. This policy is governed by the laws of Canada, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial private-sector laws. If you are in the EEA or UK, GDPR or UK GDPR also apply to our processing of your personal data. If you are a California resident, the CCPA/CPRA apply as described above. Where those regimes conflict, we apply the law that governs that processing.