Privacy Policy

ActuTrack LTD is an Alberta-incorporated business providing a hosted, multi-organization ERP platform. This Policy covers personal information collected and processed in connection with our website, subscriptions, account administration, support communications, security operations and hosted customer workspaces.

For business accounts and billing, ActuTrack determines many purposes for processing personal information. For content placed in a customer's workspace, the customer generally determines its business purposes and authorized users; ActuTrack supplies the hosting/processing service subject to agreement and applicable law. This allocation does not remove rights or duties imposed by law on either party.

Canadian privacy laws potentially applicable to activities include Alberta's Personal Information Protection Act (PIPA), and the federal Personal Information Protection and Electronic Documents Act (PIPEDA) in commercial interprovincial/international contexts. Additional laws may apply for customers and individuals in other jurisdictions.

We may process account names, business email addresses, associated organization identifiers, roles and access status; authentication and session metadata; subscription plan, invoice and limited transaction references; customer-support correspondence and ticket details; security, application-use and error logs; device/browser and network metadata; and business records, files and photographs that a customer decides to upload.

Workspace records can include a customer's contact persons, supplier representatives, employee assignments, estimates, jobs, billing details and other business operational content. Customers should avoid submitting passwords, complete payment-card data or unrelated sensitive information to support messages.

Information is supplied by users and their organizations, generated when the service operates, or received from connected providers. We use it to deliver and secure accounts, enforce permissions, operate modules, manage subscriptions, provide technical support, reconcile payments, respond to legal requests, prevent fraud and maintain reliable systems. Optional marketing communications require any applicable permissions and unsubscribe controls.

We limit collection, use and retention to identified reasonable purposes and any other purpose allowed or required by law. If an additional purpose requires consent, we will provide the required information and seek that consent.

Customer administrators may see organization records and user actions according to configured roles. Customer organizations are responsible for notices and permissions for individuals whose information they enter. Requests concerning customer-controlled records may be referred to that organization, while we provide appropriate assistance where required.

ActuTrack does not grant unrelated customers access to one another's workspaces as a business purpose. We use access-control measures intended to separate organizations, but cannot claim absolute security.

Relevant providers include Lovable Cloud for the hosted application, authentication, database and file storage; Zoho Mail for support communications; Resend for invitation-email delivery; and Backblaze B2 for offsite file-backup storage. Stripe is intended for subscription or connected payment processing; live payment activation remains deferred. A configured integration is not evidence that every future use or paid service is active.

Resend may process invitation recipients, message content, private claim codes, scheduling and delivery metadata. Resend states that stored email data is held in the United States; choosing an email sending region does not establish a different storage country. Zoho stores support correspondence; the Main intake imports limited message metadata for staff triage, not a full automatic copy of every message into a ticket.

Providers receive information relevant to authorized tasks, subject to appropriate protections. Payment details entered into a Stripe-hosted interface are handled by the processor; ActuTrack uses the limited references and status information necessary for the enabled integration.

Verification still required for this draft: The complete legal-entity, country, purpose, data-category and contract schedule for Main hosting, support mail, backup and relevant infrastructure providers has not been finalized. This preview must not be treated as the completed foreign-service-provider notice.

Processing outside Canada can expose information to laws and lawful government access in the recipient country. Resend's published storage location is the United States. The exact countries relevant to ActuTrack's other providers, backups, support access and subcontractors must be established from applicable account settings and contracts; they cannot be inferred from a general hosting-region name or a supplier's head office.

ActuTrack's completed service-provider policies must identify relevant countries and purposes and explain how individuals can obtain that information and contact the responsible Privacy Officer through support@actutrack.com. Required notice must be provided at the relevant collection or transfer stage. The remaining country verification is a genuine factual limit of this non-effective draft, not an invitation to consent to unknown transfers.

Application code uses browser storage for authentication/session persistence, selected language, pending invitation continuity and stale-page recovery. It also defines a sidebar preference cookie with a seven-day lifetime. Some local-storage entries persist until cleared by the application, sign-out or browser controls; they must not all be described as session cookies.

Host-provided visitor analytics is enabled for the published application. The hosting dashboard reports visits, pages, referral sources, approximate visitor countries and device categories. The application also includes error-reporting hooks that can report an error and route context when the relevant host reporting service is present. The underlying analytics events, cookies or other identifiers, providers and retention periods still require a complete inventory. We do not claim that no tracking occurs or that all necessary consent has been obtained. Where consent or choices are legally required, they must be provided before the relevant optional processing. Browser controls may affect service operation.

An AI Support Agent has been proposed but is not yet released. We do not present future AI features as currently processing customer conversations. Before enabling any provider-backed AI support, we will document any conversation and workspace data sent to that provider, purposes, retention and training settings, human escalation, accuracy limitations and access controls; obtain required permissions and update this Policy and the DPA where applicable. No AI access to protected workspace records is authorized by this draft.

We apply technical and organizational controls designed to protect confidentiality, integrity and availability, including authentication, roles, access checks, secured server-side functions, logging and backup procedures. We assess security incidents and maintain procedures to respond. No system is immune from loss or unauthorized access, and safeguards must be appropriate to the sensitivity of the information.

Where available, a support agent's special workspace access requires the user's organization approval within the designated scope and duration, and sensitive corrections can require dual approval. Support email alone does not authorize access.

Where Alberta PIPA applies and a breach presents a real risk of significant harm to an individual, ActuTrack will report it to Alberta's Information and Privacy Commissioner without unreasonable delay as required, and notify individuals as required by law or a Commissioner's direction. Where PIPEDA applies, reportable breaches must be reported to the federal Privacy Commissioner and affected individuals must be notified as required. Where PIPEDA applies, records of every breach of security safeguards under that regime must be retained for at least 24 months after determining that the breach occurred.

Security-incident communications to business customers are governed by applicable law and the DPA/service arrangements; no unsupported instant-notification guarantee is made by this draft.

Personal information is retained for reasonable service, customer-instruction, security and legal purposes and disposed of securely when no longer required. Specific categories differ and are governed by the approved Data Retention, Export & Deletion Policy and signed agreements. Locked or immutable backups may expire under their established schedule rather than being individually erased immediately. A restoration procedure must account for previously approved deletions.

Send written access or correction requests, privacy questions or complaints to support@actutrack.com. “Privacy Request” in the subject line helps routing but is not required to exercise a legal right. We verify identity and authority proportionately and explain applicable refusals and complaint options.

Where Alberta PIPA applies, access requests generally require a response within 45 calendar days; where PIPEDA applies, the general period is 30 calendar days, subject to lawful extensions and exceptions. The applicable deadline concerns a substantive response, not merely an acknowledgement. Requests about customer-controlled workspace records may be coordinated with the relevant organization without avoiding any obligation ActuTrack independently owes.

The intended public contact is Privacy Officer, ActuTrack LTD, through support@actutrack.com. Appointment of an accountable individual and the internal request/incident handling records remain operational checks before this draft is adopted; a contact title alone does not establish those procedures.

The service is intended for business use and is not directed at children. Optional promotional electronic messages require the applicable consent or other valid basis, sender identification, current mailing address and unsubscribe arrangements. Invitation-only or complimentary access is not a blanket exemption from anti-spam law. A requested service response or other exempt message must be assessed according to its content and circumstances.

ActuTrack has not established in this draft that all future promotional invitations meet those requirements. Such messages must not be sent until the relevant requirements or a valid exemption are documented. Ordinary necessary account and support communications are assessed separately and must not be mixed with unnecessary promotion.

We will communicate material updates where required and show the effective date of the published Policy.

Privacy Officer, ActuTrack LTD Alberta, Canada Email: support@actutrack.com Website: https://actutrack.com