FireTAG Connect — Privacy Policy
1. Introduction
FireTag Technologies Ltd. ("FireTAG", "we", "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use FireTAG Connect (the "Service") at connect.firetag.ca.
We are located in Port Moody, British Columbia, Canada. We handle personal information in accordance with British Columbia's Personal Information Protection Act (BC PIPA) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Other provincial laws — Alberta's PIPA and Quebec's Law 25 — may also apply if we serve customers in those provinces.
2. Information we collect
a. Account information you provide: first and last name, email address, password (stored hashed, never in plain text), and the equipment serial number used to verify your ownership.
b. Customer and equipment records: information associated with your Customer account, such as equipment, locations, inspections, service orders, and service history. Some of this originates from your fire-safety Service Provider.
c. Payment information: you may pay by card or by bank transfer, cash, or cheque. Card payments are processed by Stripe, Inc. — we do not collect or store full payment card numbers on our servers; Stripe processes and stores that information under its own privacy policy. We may retain limited billing metadata (e.g., plan, amounts, invoice identifiers, card last-4 as provided by Stripe, and — for non-card payments — a bank transfer reference number you provide).
d. Usage and technical data: log data, device/browser information, IP address, and analytics events. The Service uses Google Analytics (property ID G-XWDZDRNBFC) and may use cookies or similar technologies.
3. How we use information
We use personal information to: (a) create and secure your account and verify equipment ownership; (b) provide, maintain, and improve the Service; (c) process subscriptions and payments (via Stripe); (d) send transactional communications (e.g., account activation, billing, service notices); (e) provide support; (f) comply with legal obligations; and (g) analyze usage to improve the product.
4. Legal basis and consent
We collect and use personal information with your consent (which you provide by registering and accepting the Terms) and as otherwise permitted or required by applicable law. Consent may be express or implied depending on the sensitivity of the information and the circumstances.
You may withdraw consent subject to legal or contractual restrictions, as described in Section 9.
5. Marketing communications (CASL)
We send transactional messages needed to operate the Service (e.g., activation, billing, service notices). Where we send commercial electronic messages (marketing/promotional), we do so in accordance with Canada's Anti-Spam Legislation (CASL) — that is, with the required consent, clear sender identification, and a working unsubscribe mechanism in every message.
6. How we share information
We do not sell personal information. We may share it with:
- Your Service Provider — the fire-safety company currently associated with your FireTAG customer account (identified by your unique FireTAG customer number) has access to your Content, including your equipment records and full service history, to deliver services to you. If you change your Service Provider, access is reassigned to your new Service Provider as described in our Terms of Service, and your prior Service Provider's access is revoked.
- Service providers / processors — e.g., Stripe (payments), Microsoft Azure (hosting), our web hosting provider (transactional email, sent via SMTP), Google (analytics), acting on our behalf under appropriate safeguards.
- Legal and safety — when required by law, regulation, legal process, or to protect rights, safety, and security.
- Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.
7. International storage and transfer
Our production infrastructure is hosted on Microsoft Azure in the United States (West US 2 region), and our payment processor Stripe also processes data in the United States.
This means personal information about our Canadian customers is stored and processed outside Canada, in the United States, where it is subject to U.S. law, including potential lawful access by U.S. authorities.
8. Data retention
Retention periods depend on the type of information:
Active equipment records — retained for as long as the equipment remains in service, regardless of whether your Account is active, cancelled, or reassigned to a new Service Provider.
Condemned or disposed equipment records — retained for one (1) year from the date the equipment is condemned, disposed of, or removed from service, after which they are securely deleted or anonymized.
Account and login information — if your Account is inactive for two (2) years, we may deactivate your login credentials; this does not affect retention of active equipment records as described above.
In all cases, information is retained longer where required to meet legal, accounting, or reporting obligations.
9. Your rights
Subject to applicable law, you may: (a) access the personal information we hold about you; (b) request correction of inaccurate information; (c) withdraw consent or request deletion, subject to legal/contractual limits; and, where provincial law provides them (e.g., Quebec Law 25), (d) request data portability and de-indexing. You may make a complaint to us or to the applicable regulator — the Office of the Privacy Commissioner of Canada, or the provincial authority (e.g., the OIPC in BC/Alberta, or the Commission d'accès à l'information in Quebec). To exercise these rights, contact us using Section 13.
10. Security
We use reasonable administrative, technical, and physical safeguards (e.g., hashed passwords, HTTPS/TLS, access controls) to protect personal information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
11. Security breach notification
If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as soon as feasible, notify other organizations where that may reduce the risk of harm, and maintain records of breaches — as required by PIPEDA and any applicable provincial law (including Quebec Law 25).
12. Cookies and analytics
The Service uses cookies and similar technologies for authentication, session management, and analytics (including Google Analytics).
13. Contact us / Privacy Officer
We have designated a Privacy Officer responsible for our compliance with privacy law (a requirement under Quebec Law 25 and good practice under PIPEDA). For privacy questions or to exercise your rights, contact: David Wadge, Privacy Officer, contact@firetag.ca, FireTag Technologies Ltd., #530 – 130 Brew Street, Port Moody, British Columbia V3H 0E5, Canada.
14. Children's privacy
The Service is not directed to children under 13, and we do not knowingly collect their personal information. If we learn that we have collected personal information from a child under 13 without appropriate parental or guardian consent, we will take reasonable steps to delete that information.
15. Changes to this Policy
We may update this Policy. We will post the updated version and revise the "Last updated" date, and provide additional notice for material changes as required by law.