Privacy Policy

Pistis Contracting Inc., a corporation incorporated under the laws of Ontario, Canada, operating under the trade name Safer Inventory (“we,” “our,” or “us”), is committed to protecting the personal information of our users and customers in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5) and Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23).

If you are a resident of Quebec, additional requirements under Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25, as amended and fully in force since September 2024) apply to your personal information. See Section 11 for Quebec-specific rights.

1. Who We Are

Pistis Contracting Inc. (operating as Safer Inventory) is the data controller for personal information collected through saferinventory.com and the Safer Inventory platform. Our Privacy Officer can be reached at:

Privacy Officer
Pistis Contracting Inc. (operating as Safer Inventory)
18 Strathearn Ave Unit 6B, Brampton, ON L6T 4X7, Canada
privacy@saferinventory.com

2. What Personal Information We Collect

2a. Information you provide

• Account registration: name, business name, job title, email address, phone number, billing address
• Payment: billing details processed directly by Stripe Inc.; we do not store raw card numbers
• Platform use: inventory records, product data, supplier and customer contacts you upload to the Service
• Support communications: messages, attachments, and account details shared with our support team
• Marketing preferences: email address and consent records

2b. Information collected automatically

When you use the Service, we collect:

• Log data: IP address, browser type, device type, pages visited, session duration, referring URL
• Usage data: feature interactions, clicks, search queries within the platform, error reports
• Authentication events: login times and session tokens, managed by Clerk Inc.

2c. Cookies and tracking technologies

• Essential cookies: authentication sessions, CSRF protection, user preferences. Cannot be disabled without breaking the Service.
• Analytics cookies: PostHog Inc. is used to understand aggregate usage patterns and improve the platform. These are loaded only after you have given consent where required.

No advertising or third-party retargeting cookies are used on saferinventory.com.

Quebec residents: Under Law 25, we obtain your consent before activating non-essential cookies. A consent banner is displayed on your first visit. You may withdraw consent at any time using the Cookie Preferences link in the site footer.

3. Why We Collect and Use Personal Information

We collect and use personal information only for purposes a reasonable person would consider appropriate in the circumstances (PIPEDA Principle 4.3):

• Providing and operating the Service: account management, authentication, inventory and order processing features
• Billing and payment processing: invoicing, subscription management, payment fraud prevention (processed by Stripe)
• Customer support: responding to tickets, troubleshooting, and account recovery
• Service improvement: aggregate usage analytics to develop new features and improve performance
• Security: detecting and preventing fraud, unauthorized access, and abuse of the platform
• Legal and tax compliance: retaining records for the period required under the Income Tax Act (Canada) and Ontario Taxation Act
• Marketing communications: sending product updates and promotional content where we have obtained CASL-compliant consent (see Section 7)

We do not sell your personal information to third parties. We do not use your inventory or order data to train machine learning models.

4. Sub-Processors and Third-Party Services

We share your personal information only with the service providers necessary to operate the platform (“Sub-processors”). The complete Sub-processor list is also maintained in our Data Processing Agreement. Current Sub-processors:

We will provide at least 30 days' written notice before adding a new Sub-processor that processes your personal information. Our Data Processing Agreement describes the objection process.

5. Cross-Border Transfers

Your personal information may be stored and processed in Canada and in other countries, including the United States and the United Kingdom, by the Sub-processors listed in Section 4. We do not represent that Customer Data is stored exclusively in Canada.

These transfers are conducted in compliance with PIPEDA Schedule 1 Principle 4.1.3 (Accountability for Onward Transfers). We require all Sub-processors to maintain contractual data protection obligations no less protective than those in our Data Processing Agreement.

Quebec residents: Cross-border transfers from Quebec are subject to a Privacy Impact Assessment (PIA) where required under Law 25. See Section 11.

6. Customer Data vs. Account Data

The Safer Inventory platform is a tool that business customers use to manage their own inventory, supplier, and customer data (“Customer Data”). We act as a data processor for Customer Data on behalf of the business customer (who is the data controller). Our processing of Customer Data is governed by the Data Processing Agreement.

Personal information about the individuals who register for and administer a Safer Inventory account (names, email addresses, billing details) is processed by us as a data controller under this Privacy Policy.

7. Marketing Communications and CASL Compliance

We send commercial electronic messages (newsletters, product updates, feature announcements, promotional content) only where we have obtained consent as required under Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23):

• Express consent: You checked a clearly labelled marketing opt-in checkbox at sign-up or in your account settings. Express consent has no expiry.
• Implied consent (existing business relationship): We may send commercial electronic messages to current subscribers for up to two years from your last purchase or transaction, or until you unsubscribe, under CASL s. 10(9)(a). After two years without a new transaction, we will request renewed consent before sending further marketing.

Every marketing email we send includes:

• Clear identification of Pistis Contracting Inc. (operating as Safer Inventory)
• Our mailing address
• A one-click unsubscribe link

Unsubscribe requests are honored within 10 business days as required by CASL s. 11(3). You may also unsubscribe at any time by emailing privacy@saferinventory.com.

8. Data Security

We implement the following security measures to protect personal information:

• Encryption at rest: AES-256 for all stored data
• Encryption in transit: TLS 1.2 or higher for all data transmission
• Access controls: role-based access control (RBAC) limiting staff access to personal information on a need-to-know basis
• Authentication: multi-factor authentication available and encouraged for all accounts
• Breach response: a documented incident response plan for detecting, containing, and reporting data breaches

No security measure is 100% effective. In the event of a data breach involving real risk of significant harm to individuals, we will:

• Notify the Office of the Privacy Commissioner of Canada (OPC) as soon as feasible after determining the breach has occurred, in accordance with PIPEDA s. 10.1 and the Breach of Security Safeguards Regulations (SOR/2018-64)
• Notify affected individuals as soon as feasible
• If you are a business customer with a Data Processing Agreement, notify you within 72 hours of becoming aware of a breach involving your Customer Data, as described in the DPA
• Maintain records of all breaches for a minimum of 24 months as required by PIPEDA regulations

If you believe your account has been compromised, contact us immediately at security@saferinventory.com.

9. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy:

After the applicable retention period, personal information is securely deleted or anonymized.

10. Your Rights Under PIPEDA

Under PIPEDA, you have the right to:

• Access: Request a copy of the personal information we hold about you (PIPEDA Schedule 1, Principle 9)
• Correction: Request correction of inaccurate or incomplete information
• Withdraw consent: Withdraw consent for non-essential uses (e.g., marketing) at any time, subject to legal obligations
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca if you believe we have not complied with PIPEDA

Submit access or correction requests to privacy@saferinventory.com. We will respond within 30 days as required by PIPEDA.

11. Quebec Residents — Law 25 Rights

If you are a resident of Quebec, the Act Respecting the Protection of Personal Information in the Private Sector (Law 25, fully in force since September 2024) grants you additional rights:

• Consent: We obtain your explicit, informed consent before collecting personal information for purposes beyond those necessary to provide the Service. Consent for each distinct purpose is obtained separately and is not bundled into these Terms.
• Cookie consent: Non-essential cookies are activated only after you have consented via the cookie banner displayed on your first visit. You may withdraw cookie consent at any time using the Cookie Preferences link in the site footer.
• Right to data portability: You may request your personal information in a structured, commonly used technological format. Submit portability requests to privacy@saferinventory.com; we will fulfill requests within 30 days.
• Right to de-indexation: You may request that we cease disseminating personal information about you where doing so causes harm and the harm outweighs the public interest in continued dissemination.
• Privacy Impact Assessments: Where we transfer your personal information outside Quebec to Sub-processors in other provinces or countries, we conduct a Privacy Impact Assessment (PIA) to ensure adequate protection.
• Privacy Officer: Our designated Privacy Officer for Law 25 purposes is The Privacy Team, reachable at privacy@saferinventory.com.
• Complaints:You may file a complaint with the Commission d'accès à l'information (CAI) at cai.gouv.qc.ca.

12. Changes to This Privacy Policy

We will provide at least 30 days' written notice before making material changes to this Policy (e.g., adding a new category of Sub-processor, new cross-border transfer destination, or new use of personal information). Non-material updates (clarifications, formatting) may be made without notice, with the “Last Updated” date revised accordingly.

13. Contact Us

Questions about this policy or your personal information should be directed to:

Pistis Contracting Inc. (operating as Safer Inventory)
Privacy Officer
18 Strathearn Ave Unit 6B, Brampton, ON L6T 4X7, Canada
privacy@saferinventory.com

For data processing inquiries related to Customer Data processed on behalf of your business, refer to our Data Processing Agreement or email legal@saferinventory.com.