Permacore Privacy Policy
Effective date: October 14, 2026
Last updated: October 14, 2026
1. Who we are and what this policy covers
This Privacy Policy explains how STRUVARO INC. ("Struvaro", "we", "us"), the company that operates Permacore, collects, uses, discloses and protects personal information when you use the Permacore permit tracker, our website at https://struvaro.com, any test or preview link, and the emails we send (together, the "Service"). It should be read with our Terms and Conditions.
Permacore is an independent tool. It is not affiliated with the City of Toronto or any other permit authority, and we do not share your information with any authority unless you ask us to or the law requires it.
We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair information principles.
Our two roles. For information about you as an account holder and visitor (such as your name, email and sign-in activity), we decide how it is used and are responsible for it. For personal information that you or your organization put into a workspace (such as names and emails of permit owners, watchers and distribution lists, or details in uploaded documents), we process it on behalf of the account holder or organization that controls the workspace. If you are one of those people and have a question, contact that organization first; we will help them respond.
2. Accountability
We have named a Privacy Officer who is responsible for our compliance with this policy and with privacy law:
Privacy Officer, STRUVARO INC.
Email: info@struvaro.com
Location: Toronto, Ontario, Canada
3. Information we collect
We collect only what we need to run the Service. We do not use advertising trackers, third-party analytics, or social media pixels, and we do not sell personal information.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account information | Your name, email address, password (stored only as a salted scrypt hash, never in readable form), mobile phone number (once text-message sign-in is switched on), whether your email address and mobile number are verified, role (administrator or user), account status, date created and date of last sign-in | You, or an administrator who adds you |
| Workspace content | Projects (name, code, applicant, municipality, sites and locations, description), permits and their authority, department, type, location, dates, submissions, review cycles, decisions, reasons for delay, mitigation notes, owners, watchers, checklists and plans | You and other users of your workspace, including by Excel import or backup restore |
| Contact details of other people | Names and email addresses of permit owners, watchers, project distribution lists and alert recipients | You or other users of your workspace |
| Uploaded documents | Files you attach to permits (for example drawings, reports, letters and forms), their names, sizes and document types. These files may contain personal information, such as names, signatures and addresses | You and other users of your workspace |
| Alert and email records | Your alert settings (send time, recipients, digest day), and a log of the latest 200 alert runs showing which addresses were emailed and any delivery errors | Created by the Service |
| Email-sending credentials | If an administrator connects an email account so the Service can send alerts: the address, server and app password for that account | The administrator |
| Technical and security information | IP address (used to limit repeated sign-in and sign-up attempts), browser request details, and sign-in cookies | Your device and browser, automatically |
| Security log | A record of sign-ins, failed sign-ins, sign-in codes sent, and changes to accounts made by you or an administrator, each with the time, email address, IP address, a description of the browser and system used, and a short note of what happened | Created by the Service |
| Remembered devices | For each device you sign in from (up to 10 per account): a description of the browser and system, when it was first and last seen, and, if you chose "Remember this device", when that ends | Created by the Service |
| Free-trial fingerprints | A one-way, keyed fingerprint of your email address and of your verified mobile number. A fingerprint cannot be turned back into the email address or number | Created by the Service |
| Support and communications | What you send us when you email us, report a problem or give feedback | You |
| Website waitlist sign-ups | Your email address, the plan and billing choice you picked, which form you used, campaign labels in the link you followed (such as utm_source), the time you joined, and your consent to early-access and launch emails | You, on struvaro.com |
| Billing information | If you buy a paid plan: billing name, company, address, tax details and payment status. Card details are collected and stored by Stripe, our payment processor, not by us. | You and Stripe |
Your mobile number. Once text-message sign-in is switched on, a mobile phone number is required to sign in, so that we can send you a one-time sign-in code by text message or voice call. Until then, sign-in codes are sent by email and we do not ask for a mobile number. We use it only for sign-in codes and security alerts, never for marketing, and each number can be used for only one account. When you add a number, our provider checks whether it is a mobile, internet (VoIP) or landline number.
Email addresses. We do not accept disposable or temporary email addresses when you create an account yourself.
4. How we use your information
We use personal information to:
- Provide the Service: create and secure your account, sign you in, keep your workspace private to you and the people you share it with, and store your records and files.
- Calculate and send alerts: work out deadlines and send the daily alerts, instant notices and weekly digests that you or your administrator set up, to the recipients you chose.
- Support you: answer questions, fix problems and restore data when you ask.
- Protect the Service: prevent fraud and abuse, verify your email address and mobile number, send sign-in codes, tell you about sign-ins from a new device, limit repeated sign-in attempts, keep a security log, make sure each person gets only one free trial, investigate security incidents and keep backups.
- Improve the Service: understand which features need work, using information you send us and aggregate information that does not identify you.
- Run the waitlist: if you join the waitlist on struvaro.com, send you early-access invitations and launch updates, and understand which plans people are interested in.
- Communicate with you: send service messages such as account, security, billing and policy-change notices. We will send marketing emails only with your consent, as required by Canada's Anti-Spam Legislation (CASL), and every marketing email will have an unsubscribe link.
- Meet legal obligations: keep records the law requires and respond to lawful requests.
We do not use your workspace content or documents to train artificial intelligence models, and we do not look at your workspace content except when needed to support you at your request, to keep the Service secure, or to comply with law.
5. Consent
We rely on your consent, given when you create an account, join the waitlist on our website or use the Service, for the purposes in this policy. Where information is more sensitive, we will ask for express consent. You can withdraw consent at any time, subject to legal or contractual limits, by contacting our Privacy Officer. If you withdraw consent to information we need to run the Service (such as your email address), we may not be able to keep providing it.
When you add other people. If you enter someone else's name or email address (for example as a permit owner, watcher or alert recipient), you confirm that you have their consent or another lawful basis, and that you have told them they will receive permit alerts from the Service. Anyone who no longer wants these alerts can ask the workspace owner to remove them, or contact us.
6. Cookies and similar technologies
We use the minimum needed for the Service to work:
| Name | Type | Purpose | How long |
|---|---|---|---|
plaa_session |
Essential cookie (HttpOnly, SameSite=Lax, Secure over HTTPS) | Keeps you signed in. It holds a signed reference to your account, not your password | Ends after 60 minutes without activity, after 12 hours at most, or when you sign out |
plaa_pending |
Essential cookie (HttpOnly, SameSite=Lax, Secure over HTTPS) | Holds a sign-in that is in progress while you enter your sign-in code | 15 minutes |
plaa_device |
Essential cookie (HttpOnly, SameSite=Lax, Secure over HTTPS) | A random identifier for your browser. It lets us notice sign-ins from a new device and, if you choose "Remember this device", skip the sign-in code on that device for 30 days | 1 year |
| Browser local storage | Essential preference storage on your device | Remembers screen preferences, such as the view or filters you last used. It stays on your device and is not sent to us | Until you clear your browser data |
We do not use advertising or third-party analytics cookies. Because these items are needed for the Service to work, the Service will not function properly if you block them.
7. Who we share information with
We share personal information only as described here. We require every service provider to protect it, to use it only to provide services to us, and to follow terms at least as protective as this policy.
| Service provider | What they do for us | Where data is processed |
|---|---|---|
| Fly.io, Inc. | Hosts the application, database file, uploaded documents and daily backups | Canada (Toronto) for the application and its data; Fly.io's automatic backup copies (kept up to 5 days) may be stored outside Canada, including the United States |
| The email provider used to send alerts: the account an administrator connects (such as Google Gmail or Microsoft Outlook), or our own Titan Mail account | Delivers alert, digest and account emails | United States and other countries where the provider operates |
| Hostinger | Hosts our website at struvaro.com and stores its waitlist sign-ups | Outside Canada, in the data centre region of our hosting plan |
| Titan Mail, provided through Hostinger | Runs our business email at info@struvaro.com, which receives waitlist sign-ups and the emails you send us | United States and other countries where the provider operates |
| Twilio Inc. | Sends sign-in codes by text message or voice call, and checks whether a phone number is a mobile, internet (VoIP) or landline number | United States |
| Cloudflare, Inc. | Carries traffic for temporary test and preview links | United States and Cloudflare's global network |
| Stripe (Stripe Payments Canada, Ltd. and its affiliates) | Processes card payments and subscriptions for paid plans, stores card details, and collects the billing details needed to charge tax | United States and other countries where Stripe operates |
We may also disclose personal information:
- within your workspace: to the administrator and other users your workspace is shared with, and to the recipients you choose for alerts. Alert emails can include project names, permit numbers, permit types, locations and dates;
- at your direction: for example when you export to Excel, download a backup or ask us to send something to someone;
- for legal reasons: when required by law, a court order, subpoena or other lawful request, or to protect the rights, safety or property of Struvaro, our users or others, as PIPEDA permits;
- in a business transaction: to a party involved in a proposed or actual sale, merger, financing or reorganization of our business, under a confidentiality agreement and only as PIPEDA permits; and
- in aggregate or de-identified form that cannot reasonably identify you.
We do not sell, rent or trade personal information, and we do not share it for cross-context behavioural advertising.
8. Storage outside Canada
The application, its database, uploaded documents and the app's own daily backups are hosted in Canada (Toronto). Our hosting provider also keeps short-term backup copies of that data, which may be stored outside Canada, including in the United States. Some of our providers process information outside Canada: the email provider that sends alerts and receives your emails (our Titan Mail account, provided through Hostinger, or the Gmail or Outlook account an administrator connects) may process it in the United States and other countries, as may Hostinger for our website and its waitlist, and Cloudflare for temporary test and preview links. Twilio, which sends sign-in codes, processes your mobile number and those codes in the United States, and Stripe processes billing and card details for paid plans in the United States and other countries. While information is outside Canada, it is subject to the laws of that country, and courts, law enforcement and national security authorities there may be able to access it. We use contracts and safeguards to protect it, but we cannot prevent lawful access under foreign law. By using the Service you understand that some of your information, such as alert emails, their recipients, your mobile number and messages you send us, will be processed outside Canada. Contact our Privacy Officer if you have questions about our providers and where they process data.
9. How long we keep information
We keep personal information only as long as needed for the purposes in this policy, then delete it or make it anonymous.
| Information | How long we keep it |
|---|---|
| Account and workspace content | While your account is active. When an account is deleted, its account record and workspace are removed from the live database right away |
| Uploaded documents | Until you or an administrator delete them, or the account is deleted |
| Daily backups of the database | Up to 30 days, then overwritten automatically |
| Alert log | The latest 200 alert runs per workspace; older entries are removed automatically |
| IP addresses used for rate limiting | Held in memory for up to 24 hours and not written to the database (IP addresses in the security log are kept as described for that log) |
| Sign-in cookie | Ends after 60 minutes without activity, after 12 hours at most, or when you sign out |
| Email verification codes | Expire after 10 minutes, and are stored only as one-way hashes |
| Password-reset links | Expire after 30 minutes |
| Unfinished sign-ups | Deleted after 7 days if the email address is never confirmed |
| Security log | 1 year, then deleted automatically. Entries are kept for that year even after an account is deleted, to prevent fraud and investigate security incidents |
| Remembered devices | Until you forget them or the account is deleted. "Remember this device" lasts 30 days |
| Free-trial fingerprints | Kept after the account is deleted, so that each person gets only one free trial |
| Support emails | 24 months after the issue is closed |
| Website waitlist sign-ups | Until you ask us to remove you, and no longer than 24 months after you join |
| Billing and tax records | As long as tax law requires (generally 6 years in Canada) |
| Test and preview data | It may be deleted at any time and is not guaranteed to be kept or moved to the full Service |
Where we use personal information to make a decision that affects you, we keep it long enough for you to ask about it.
10. How we protect information
We use administrative, technical and physical safeguards suited to the sensitivity of the information, including:
- passwords stored only as salted scrypt hashes;
- signed, HttpOnly session cookies that end after 60 minutes without activity, with all sessions ended when you change your password;
- two-step sign-in with a one-time code sent to your mobile phone (or by email until text messages are switched on);
- a 15-minute pause, and an email to you, after 10 wrong passwords;
- email alerts when your account is signed in from a new device;
- verified email addresses, with disposable email addresses blocked;
- encrypted connections (HTTPS) on our hosted Service, with HTTP Strict Transport Security;
- limits on repeated sign-in and sign-up attempts;
- separate, private workspaces for each account;
- security headers that block framing and content-type sniffing; and
- daily backups and access to production systems limited to authorized personnel.
No system is perfectly secure. You help protect your account by using a strong, unique password and signing out on shared devices. Temporary preview links are less protected than the hosted Service, so do not upload sensitive information to them.
Breaches. If a breach of security safeguards involving personal information under our control creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as soon as feasible, and keep a record of the breach, as PIPEDA requires.
11. Your choices and rights
You have the right to:
- access the personal information we hold about you and learn how it has been used and to whom it has been disclosed;
- correct information that is inaccurate or incomplete;
- withdraw consent, as described in section 5;
- ask us to delete your account and personal information, subject to what we must keep by law; and
- complain to us and to a privacy regulator.
Doing it yourself. You can see and change your name, email address, mobile number and password in your account settings, see how many devices are remembered and forget them, sign out of all devices, change who receives your alerts, delete projects, permits and files, and download a backup or Excel export of your workspace at any time.
Deleting your account. An administrator can delete a user's account. When an account is deleted, its account record, workspace and uploaded files are removed from the live system, and remaining copies in backups are overwritten within 30 days. Security log entries and free-trial fingerprints are kept after deletion, as described in section 9. If you cannot delete your account yourself, email our Privacy Officer.
Making a request. Email info@struvaro.com from the address on your account. We may need to verify your identity. We will respond within 30 days, as PIPEDA requires, or tell you if we need more time and why. Access requests are free in most cases. If we cannot fulfil a request (for example, because the information belongs to someone else's workspace or the law prevents it), we will explain why.
If your information is in someone else's workspace. If an organization entered your name or email into its workspace, please contact that organization first. We will help them respond, and you can also contact us directly.
Complaints. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada at 1-800-282-1376.
12. Users outside Ontario
Quebec. If you are in Quebec, you also have rights under Quebec's Act respecting the protection of personal information in the private sector, including the right to data portability and to be informed of the use of technology that profiles you. We do not use automated decision-making or profiling. You may contact our Privacy Officer, who is also our person in charge of the protection of personal information, or the Commission d'accès à l'information du Québec.
Alberta and British Columbia. If you are in Alberta or British Columbia, your provincial private-sector privacy law may also apply, and you may contact the provincial privacy commissioner.
United States. The Service is designed for construction and infrastructure projects in Ontario. We do not sell or share personal information for cross-context behavioural advertising, and we have no actual knowledge of selling or sharing information of anyone under 16. If you are a California resident, you have the right to know what personal information we collect, use and disclose (described in sections 3, 4 and 7), to request access, correction and deletion, and not to be discriminated against for exercising these rights. You may make a request, or have an authorized agent make one, by emailing info@struvaro.com. We will verify your identity before responding.
Europe and the United Kingdom. The Service is not directed to people in the European Union or the United Kingdom.
13. Children
The Service is a professional tool for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.
14. Changes to this policy
We may update this policy when the Service, our providers or the law changes. We will post the new version with a new "Last updated" date. If a change is material, for example a new purpose or a new kind of service provider, we will notify you by email or in the Service before it takes effect and, where required, ask for your consent again.
15. Contact us
Questions, requests or complaints about this policy or your personal information:
Privacy Officer, STRUVARO INC.
Toronto, Ontario, Canada
Email: info@struvaro.com