Privacy Policy

We collect personal information in the following categories:

• Identity data — full name, username, profile photo
• Contact data — email address, phone number
• Professional data — job title, role, organization name
• Usage data — login timestamps, feature usage, IP address, device type
• Operational data — work order notes, asset descriptions, location data, vendor contact information
• Communication data — messages submitted through the platform, support ticket content
• Website form data — details you enter in our demo-request, newsletter and vendor forms (such as email, company and number of sites), the page you submitted from, and your marketing-email preference
• Website usage data — page views and performance measurements on this website, and, only if you accept analytics, the browsing and interaction data described in Section 8

We collect only the information necessary to provide the Concoct platform and related services. We do not sell personal information to third parties.

We use personal information to:

• Provide and operate the Concoct platform and managed services
• Authenticate users and manage account access
• Support maintenance management workflows on your behalf
• Respond to support requests and provide customer service
• Send transactional communications (work order notifications, reports, billing)
• Send marketing communications where you have provided consent (unsubscribe anytime)
• Comply with legal and regulatory obligations
• Improve and develop our platform and services

Your data is processed and stored in Canada and the United States via our infrastructure sub-processors. Where data is stored in the US, Concoct ensures appropriate safeguards are in place as required by PIPEDA and applicable law. Information stored or processed in the United States is subject to US law and may be accessible to US courts and authorities.

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Your organization's data is isolated from other tenants at the database level using row-level security — no other customer can access your data.

We engage the following sub-processors to deliver the Concoct platform. Each is bound by data protection obligations consistent with this policy:

We will provide 30 days advance notice of any material changes to our sub-processor list.

We retain personal information for as long as your account is active or as needed to provide services. Upon cancellation or termination of your subscription:

• Your data is retained for 90 days to allow you to export it
• All personal information is deleted within 30 days after the 90-day retention period
• We will provide written confirmation of deletion upon request
• Certain data may be retained longer where required by law

We implement the following technical and organizational measures to protect your information:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security enforcing tenant isolation at the database level
• Role-based access controls and multi-factor authentication capability
• Audit logging of sensitive operations
• Regular security assessments
• Background checks on employees with access to production data

In the event of a personal information breach affecting your data, we will notify you without undue delay and within 72 hours where feasible.

As a Canadian resident, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request correction of inaccurate or incomplete information
• Erasure — request deletion of your personal information
• Withdraw consent — where processing is based on consent, withdraw it at any time
• Complain — file a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, contact us at privacy@concoct.ca. We will respond within 30 days.

The Concoct platform uses cookies and similar technologies for authentication, session management, and analytics. We use Google Analytics to understand platform usage in aggregate. You may disable cookies in your browser settings, but some features of the platform may not function correctly without them.

On this marketing website, analytics and marketing tools load only after you choose "Accept" in the cookie banner. They are Google Analytics (usage statistics), Microsoft Clarity (which records how visitors interact with pages, such as clicks and scrolling; text you type into our forms is masked from these recordings), and HubSpot (which associates your visit with any form you submit). You can change your choice at any time using the cookie preferences link in the footer.

If you withdraw consent, we stop loading these tools from your next page view. Cookies they already set expire on their own schedule, and you can delete them at any time in your browser settings.

The following run on every visit because the website needs them or they do not identify you:

• Cookie preference — your banner choice, stored in your browser's local storage
• Sign-in cookie — set only if you sign up, to keep you signed in (Supabase)
• Vercel Analytics and Speed Insights — cookie-free page-view and performance measurement
• Cloudflare Turnstile — bot protection on our forms, which processes your IP address and browser signals

Submitting a form sends what you entered to HubSpot so we can respond, whether or not you accepted analytics. Requesting a demo or applying as a vendor does not sign you up for marketing email: we use those details only to respond to you. We send marketing email only to people who ask for it, by subscribing to our newsletter or ticking a marketing-email checkbox on a form. Every marketing email identifies Concoct and includes an unsubscribe link, and we act on unsubscribe requests within 10 business days.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice at least 30 days before the changes take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

Questions, access requests, or complaints about this policy should be directed to our Privacy Officer: