Privacy Policy

We collect personal information in the following categories:

• Identity data — full name, username, profile photo
• Contact data — email address, phone number
• Professional data — job title, role, organization name
• Usage data — login timestamps, feature usage, IP address, device type
• Operational data — work order notes, asset descriptions, location data, vendor contact information
• Communication data — messages submitted through the platform, support ticket content
• Website form data — details you enter in our demo-request, newsletter and contractor forms (such as email, company and number of sites), the page you submitted from, and your marketing-email preference
• Website usage data — page views and performance measurements on this website, and, only if you accept analytics, the browsing and interaction data described in Section 9

We collect only the information necessary to provide the Concoct platform and related services. We do not sell personal information to third parties.

We use personal information to:

• Provide and operate the Concoct platform and managed services
• Authenticate users and manage account access
• Support maintenance management workflows on your behalf
• Respond to support requests and provide customer service
• Send transactional communications (work order notifications, reports, billing)
• Send marketing communications where you have given express consent (unsubscribe anytime)
• Protect our services from abuse, for example by rate-limiting requests and blocking bots
• Comply with legal and regulatory obligations
• Improve and develop our platform and services

Your data is processed and stored mainly in the United States and Canada through the service providers listed in Section 4. A few of those providers also process limited information, such as your IP address when a page or image loads, in other countries; Section 4 lists where each one operates. Where personal information is processed outside your province or outside Canada, Concoct puts contractual and other safeguards in place as required by applicable law. Information stored or processed in another country is subject to that country's laws and may be accessible to its courts and authorities.

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Your organization's data is isolated from other tenants at the database level using row-level security — no other customer can access your data.

We engage the following service providers to deliver the Concoct platform and this website. Each is bound by data protection obligations consistent with this policy:

We will provide 30 days advance notice of any material changes to our sub-processor list.

We keep personal information only as long as we need it for the purposes described in this policy, then delete or anonymize it.

Customer accounts. We retain account data for as long as your account is active or as needed to provide services. Upon cancellation or termination of your subscription:

• Your data is retained for 90 days to allow you to export it
• All personal information is deleted within 30 days after the 90-day retention period
• We will provide written confirmation of deletion upon request
• Certain data may be retained longer where required by law

Website leads. Details from our demo-request, newsletter and contractor-application forms are stored in HubSpot. We keep them while we have an active business relationship with you and delete them within 24 months of our last interaction with you, or sooner if you ask us to.

Website analytics. These tools only run if you accept analytics, and keep data under their own retention settings. Microsoft Clarity keeps session recordings for 30 days; after that it keeps a small sample of recordings, any recordings we specifically save, and aggregated heatmaps for up to 13 months. Google Analytics keeps user-level and event-level data for the retention period set in our Google Analytics account, which is no longer than 14 months; aggregated reports are not tied to you.

We implement the following technical and organizational measures to protect your information:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security enforcing tenant isolation at the database level
• Role-based access controls and multi-factor authentication capability
• Audit logging of sensitive operations
• Regular security assessments
• Background checks on employees with access to production data

In the event of a personal information breach affecting your data, we will notify you without undue delay and within 72 hours where feasible.

Wherever you are in Canada, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request correction of inaccurate or incomplete information
• Erasure — request deletion of your personal information
• Withdraw consent — where processing is based on consent, withdraw it at any time
• Complain — file a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, contact us at privacy@concoct.ca. We will respond within 30 days.

If you are in Quebec, you also have these rights under the Act respecting the protection of personal information in the private sector:

• Access — to be told what personal information we hold about you and to receive a copy
• Rectification — to have inaccurate, incomplete or equivocal information corrected
• De-indexation and cessation of dissemination — to ask us to stop disseminating your personal information, or to de-index any hyperlink attached to your name, where the law allows
• Portability — to receive personal information you provided to us in a structured, commonly used technological format, or to have it sent to a person or organization you choose
• Withdrawal of consent — to withdraw your consent to any use or communication of your personal information at any time
• Complaint — to file a complaint with the Commission d'accès à l'information du Québec

Information communicated outside Quebec. Your personal information is communicated outside Quebec, to the service providers listed in Section 4 in the United States, Canada and elsewhere. Before communicating personal information outside Quebec, we conduct a privacy impact assessment and make sure the information will receive adequate protection, including through written agreements with those providers.

Tracking and profiling. Analytics and session-recording tools on this website that can identify, locate or profile you are switched off by default and only run if you choose "Accept" in the cookie banner. You can switch them off again at any time with the cookie preferences control in the website footer.

Person in charge of the protection of personal information. Our Privacy Officer, reachable at privacy@concoct.ca, is responsible for protecting personal information at Concoct and handles access, rectification and other requests. We respond to written requests within 30 days.

The Concoct platform uses cookies and similar technologies for authentication, session management, and analytics. We use Google Analytics to understand platform usage in aggregate. You may disable cookies in your browser settings, but some features of the platform may not function correctly without them.

On this marketing website, analytics and marketing tools load only after you choose "Accept" in the cookie banner. They are Google Analytics (usage statistics), Microsoft Clarity (which records how visitors interact with pages, such as clicks and scrolling; text you type into our forms is masked from these recordings), and HubSpot (which associates your visit with any form you submit). You can change your choice at any time using the cookie preferences control in the footer.

If your browser sends a Global Privacy Control signal, we treat it as "Decline" and these tools stay off unless you opt in yourself. We ask for your choice again after 12 months, or sooner if we change which tools the cookie banner covers.

To withdraw consent, open Cookie preferences in the footer and choose "Decline". Tracking stops and the analytics cookies set by Google Analytics, Microsoft Clarity and HubSpot are deleted immediately. You can also delete cookies at any time in your browser settings.

These analytics and marketing tools never run on our signup, account onboarding or content management pages, whatever you chose in the cookie banner.

The following run on every visit because the website needs them or they do not identify you:

• Cookie preference — your banner choice, stored in your browser's local storage
• Sign-in cookie — set only if you sign up, to keep you signed in (Supabase)
• Vercel Analytics and Speed Insights — cookie-free page-view and performance measurement
• Cloudflare Turnstile — bot protection on our forms, which processes your IP address and browser signals
• Blog images — loaded from Sanity's image network (cdn.sanity.io), which receives your IP address and browser information

Submitting a form sends what you entered to HubSpot so we can respond, whether or not you accepted analytics. Requesting a demo or applying as a contractor does not sign you up for marketing email: we use those details only to respond to you. We send marketing email only to people who give express consent, by subscribing to our newsletter or ticking an unticked marketing-email checkbox on a form. Marketing-email checkboxes are never pre-ticked, and when you tick one we record your consent together with the exact wording you were shown. Every marketing email identifies Concoct and includes an unsubscribe link, and we act on unsubscribe requests within 10 business days.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice at least 30 days before the changes take effect. If a change requires your consent, for example a new purpose for your personal information, we will ask for it rather than treat continued use as agreement.

Questions, access requests, or complaints about this policy should be directed to our Privacy Officer: