We collect personal information in the following categories:

• Identity data — full name, username, profile photo
• Contact data — email address, phone number
• Professional data — job title, role, organization name
• Usage data — login timestamps, feature usage, IP address, device type
• Operational data — work order notes, asset descriptions, location data, vendor contact information
• Communication data — messages submitted through the platform, support ticket content

We collect only the information necessary to provide the Concoct platform and related services. We do not sell personal information to third parties.

We use personal information to:

• Provide and operate the Concoct platform and managed services
• Authenticate users and manage account access
• Support maintenance management workflows on your behalf
• Respond to support requests and provide customer service
• Send transactional communications (work order notifications, reports, billing)
• Send marketing communications where you have provided consent (unsubscribe anytime)
• Comply with legal and regulatory obligations
• Improve and develop our platform and services

Your data is processed and stored in Canada and the United States via our infrastructure sub-processors. Where data is stored in the US, Concoct ensures appropriate safeguards are in place as required by PIPEDA and applicable law.

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Your organization's data is isolated from other tenants at the database level using row-level security — no other customer can access your data.

We engage the following sub-processors to deliver the Concoct platform. Each is bound by data protection obligations consistent with this policy:

We will provide 30 days advance notice of any material changes to our sub-processor list.

We retain personal information for as long as your account is active or as needed to provide services. Upon cancellation or termination of your subscription:

• Your data is retained for 90 days to allow you to export it
• All personal information is deleted within 30 days after the 90-day retention period
• We will provide written confirmation of deletion upon request
• Certain data may be retained longer where required by law

We implement the following technical and organizational measures to protect your information:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security enforcing tenant isolation at the database level
• Role-based access controls and multi-factor authentication capability
• Audit logging of sensitive operations
• Regular security assessments
• Background checks on employees with access to production data

In the event of a personal information breach affecting your data, we will notify you without undue delay and within 72 hours where feasible.

As a Canadian resident, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request correction of inaccurate or incomplete information
• Erasure — request deletion of your personal information
• Withdraw consent — where processing is based on consent, withdraw it at any time
• Complain — file a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, contact us at privacy@concoct.ca. We will respond within 30 days.

The Concoct platform uses cookies and similar technologies for authentication, session management, and analytics. We use Google Analytics to understand platform usage in aggregate. You may disable cookies in your browser settings, but some features of the platform may not function correctly without them.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice at least 30 days before the changes take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

Questions, access requests, or complaints about this policy should be directed to our Privacy Officer: