Privacy Policy
Integra is an operator-side facilities-operations platform. When a facilities-management operator uses Integra to coordinate work for their clients and contractors, the operator is the data controller and Integra acts as a data processor on their behalf. This policy explains how personal information is handled in the platform, consistent with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
The Integra platform is provided and hosted by Stackloom Corp., a federally incorporated Canadian corporation (corporation no. 1830604-4) based in London, Ontario, which processes personal information in the platform only on the operator's instructions.
1. Information we process
| Category | Examples |
|---|---|
| Account | Name, email address, phone number, role, organization |
| Operational | Work orders, service requests, sites and addresses, assets, quotes, invoices, activity logs |
| Technical | Session cookie (httpOnly, essential), server logs |
2. Why we process it
- To provide the service: coordinating, dispatching, quoting, completing and billing facilities work.
- To notify parties of relevant status changes by email/SMS (transactional messages).
- To secure the service and maintain an audit trail of actions.
3. Service providers & cross-border transfers
We use a limited set of sub-processors. The current list is published at /subprocessors. Some are located in the United States or elsewhere outside Canada, meaning your information may be processed outside Canada and subject to foreign law.
| Sub-processor | Purpose | Location |
|---|---|---|
| SendGrid (Twilio) | Transactional email | United States |
| Twilio | Transactional SMS | United States |
| Application hosting (OVH) | Servers & database | Canada |
| Microsoft OneDrive | Off-site storage of encrypted backup copies | May be outside Canada |
| Google Fonts | Web fonts loaded by your browser (receives your IP address and browser details only) | United States |
4. Consent
We rely on your consent to collect, use and disclose personal information for the purposes described above; by using the Service you consent to that processing. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting the operator, though withdrawing may limit or end the Service.
Electronic messages (CASL). Operational notifications are transactional messages tied to work you are a party to. Every message identifies the sender and provides a way to manage or stop notifications; SMS recipients can reply STOP to opt out. Marketing messages, if any, are sent only with the consent CASL requires, and consent records are kept.
5. Retention
Personal information is retained only as long as necessary to provide the Service and to meet the operator's legal, tax and record-keeping obligations, then deleted or de-identified. The outbox of sent notifications is purged on a configurable schedule; the operator maintains a written retention schedule per record type.
Server logs (IP address, time, page requested and browser type) are deleted automatically after about 14 days. Each night an encrypted backup of the database is made; it is kept on the server for 7 days, and 30 nightly copies are kept off-site, on Stackloom's own computer in Ontario and in Microsoft OneDrive. Information deleted from the platform can remain in a backup until that copy ages out.
6. Your rights
Subject to law, you may request access to, or correction of, your personal information, and you may request deletion of your account. Signed-in users can export their data and delete their account from within the app, or contact the operator/administrator. Requests about operator-controlled business records are directed to that operator as the controller.
7. Complaints
If you have a privacy concern, contact the operator's privacy officer first. If it is unresolved, you may complain to the Office of the Privacy Commissioner of Canada, or to the applicable provincial regulator, for example the Commission d'accès à l'information (Quebec) or the Information and Privacy Commissioner of British Columbia or Alberta.
8. Which privacy law applies
Depending on where an organization and its people are located, the Service may be subject to Canada's federal PIPEDA, a substantially-similar provincial law (British Columbia or Alberta PIPA), or Quebec's Law 25, which imposes additional requirements. The operator confirms which law(s) govern each deployment. (To be confirmed with counsel.)
9. Children
The Service is intended for business use by adults and is not directed to children. We do not knowingly collect personal information from anyone under the age of majority.
10. Safeguards
We protect information with encryption in transit (HTTPS/TLS), optional field-level encryption of sensitive data at rest, authenticated database access, role-based access controls, tenant isolation, hashed passwords, a tamper-evident audit log and optional multi-factor authentication. No method of transmission or storage is perfectly secure.
11. Cookies & session
Integra does not use advertising or tracking cookies. It sets a single essential, httpOnly session cookie to keep you signed in; this cookie is not readable by page scripts and is not used for tracking.
12. Contact & privacy officer
Questions or requests: privacy@integra.stackloom.dev. Operators must designate a named privacy officer and insert their contact details here.
13. Changes
We may update this policy; material changes will be reflected by the “last updated” date above.