Privacy Policy

Notation Tool ("Notation Tool," "we," "us," or "our") operates the website at notationtool.ca and the associated web application (collectively, the "Service"). This Privacy Policy explains what personal information we collect from users of the Service, how we use it, with whom we share it, how long we retain it, and the rights you have under Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA).

By accessing or using the Service, you confirm that you have read and understood this Privacy Policy. If you do not agree with how we handle personal information, please do not use the Service.

1. Who this policy applies to

This policy applies to: (a) brokerage owners or principals who apply for access through the public application form; (b) brokers and brokerage staff who create accounts to use the Service; and (c) visitors to notationtool.ca.

This policy does notapply to the personal information of insurance consumers (the brokerage's clients). Information entered into questionnaire forms during a client call is held in your browser session only and is not transmitted to our servers unless you explicitly save it to your history. See "Submission notes" below.

2. Information we collect

Account information

• Name (first and last)
• Preferred first name (optional)
• Email address
• Authentication credentials (managed by our identity provider, Clerk; we do not see or store passwords)
• Profile photo (if you upload one)
• Role within your brokerage (Account Manager, Service, Sales, Default)

Brokerage application information

• Brokerage name
• Number of locations and approximate number of brokers
• Applicant work email and phone number
• City
• Application status and review history

Usage information

• Submissions you save to your history (form type, label, client name, and the generated note). Note content and client names are encrypted at rest.
• Forms you upload to your brokerage's shared Forms Library
• Custom quick-access links and checklists configured by your brokerage owner
• Feedback submissions, if you send any

Technical information

• IP address (used for rate limiting on the public application form and for security)
• Browser type and basic device information
• Log data generated by our hosting provider (Vercel) and authentication provider (Clerk)

Information we do NOT collect or store

• Personal information of insurance consumers entered into in-progress questionnaire forms (held in browser session only until you save or discard).
• Payment card numbers (when paid billing is introduced, it will be handled by a PCI-compliant third-party processor).
• Biometric data or location data beyond IP-level geolocation.

3. How we use information

• To create and manage your account and verify your brokerage's eligibility
• To provide, maintain, and improve the Service
• To communicate with you about your account, application status, invitations, and important Service updates
• To enforce our Terms of Service and detect fraud or abuse (including rate limiting and origin checks)
• To meet legal, regulatory, and reporting obligations

4. Legal basis for processing

We collect and use personal information based on your consent, the necessity of performing the Service you have requested, our legitimate interest in operating and securing the Service, and our legal obligations under Canadian law.

5. Third-party service providers

We use the following providers to operate the Service. Each provider has its own privacy practices; we encourage you to review them.

• Clerk, authentication, session management, account profile
• Supabase, database hosting for brokerage records, members, invites, applications, saved submissions, forms, and feedback
• Vercel, application hosting and edge delivery
• Resend, transactional email (application status notifications, invitations)
• Google Maps, address autocomplete on certain questionnaire forms

We do not sell personal information to advertisers or data brokers.

6. Where information is stored

The primary database holding your account, brokerage, and submission data is hosted by Supabase in the Canada (Central) region (Montreal), chosen to align with PIPEDA expectations around data residency.

Certain third-party services that the application depends on operate from the United States or global edge networks, including:

• Clerk (authentication), account credentials and session data are processed on Clerk's infrastructure, primarily in the United States.
• Vercel (application hosting and edge delivery), request routing and server-side rendering may occur in regions outside of Canada.
• Resend (transactional email), outbound email messages are sent through Resend's infrastructure, primarily in the United States.
• Google Maps, address autocomplete requests are sent to Google's servers as you type in supported address fields.

Information transmitted to or processed outside of Canada may be subject to the laws of the jurisdiction in which it is stored or transmitted, including lawful access by foreign authorities. We continue to evaluate options for further reducing reliance on non-Canadian providers.

7. How long we keep information

• Active accounts: while your brokerage's subscription is active.
• Brokerage applications: retained for audit and re-application purposes; archived rather than deleted unless requested.
• Saved submissions: until you delete them, or your account is closed.
• Backups and logs: retained for a reasonable period for security, debugging, and disaster recovery.

You may request deletion of your personal information by contacting us at the address below.

8. Security

We use industry-standard measures to protect personal information, including encryption in transit (HTTPS), encryption at rest for sensitive submission content, server-side authorization checks, rate limiting on public endpoints, role-based access within brokerages, and the security controls of our identity provider. No method of electronic storage is 100% secure, and we cannot guarantee absolute security.

9. Your rights

Under PIPEDA and applicable provincial privacy laws, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Withdraw consent to our processing (which may end your access to the Service)
• Request deletion of your account and associated data
• Lodge a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, contact us at support@notationtool.ca.

Provincial privacy laws

Residents of Quebec, British Columbia, and Alberta may have additional or different rights under their respective provincial privacy legislation (Quebec Law 25, British Columbia's Personal Information Protection Act, and Alberta's Personal Information Protection Act). We will honour applicable provincial rights on request and in accordance with the law.

10. Privacy Officer and accountability

Notation Tool has designated a Privacy Officer responsible for our compliance with PIPEDA and this Privacy Policy. You can reach the Privacy Officer at support@notationtool.ca for any questions, access or correction requests, or complaints about how we handle personal information.

11. Data breach notification

If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, in accordance with PIPEDA's breach notification requirements. We also maintain a record of all breaches of security safeguards as required by law.

12. Cookies and local storage

The Service uses cookies set by our authentication provider to keep you signed in. We also use your browser's local storage to save draft form content, theme preferences, and quick-access settings so the Service works smoothly between sessions. No tracking or advertising cookies are used. You can clear cookies and local storage from your browser settings at any time; doing so will sign you out and discard local drafts.

13. Children

The Service is intended for use by licensed insurance brokers and brokerage staff and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated by email or by an in-app notice. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

15. Contact

Questions about this Privacy Policy or about how we handle personal information can be sent to:

Notation Tool, Privacy
Email: support@notationtool.ca