Privacy Policy

Effective Date: September 29, 2026 Version: 2.0.1

1. Introduction

This Privacy Policy describes how Septenar Inc. ("Septenar", "we", "us", or "our") collects, uses, and protects personal information through the Septenar platform ("Service").

We are committed to protecting your privacy in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act respecting the protection of personal information in the private sector (Law 25).

2. Information We Collect

2.1 Account Information (Builders)

When you create an account, we collect:

  • Email address
  • Organization name
  • Timezone preference
  • Language preference
  • WebAuthn credential data (public keys only — biometric data never leaves your device)

2.2 Usage Information

We automatically collect:

  • Service usage metrics (forms created, submissions received)
  • IP addresses (for security and audit purposes)
  • Browser user agent strings
  • Timestamps of actions

2.3 Participant Data

Participant data (survey responses, poll votes) is collected on behalf of Account Owners and processed according to our Data Processing Agreement. Septenar acts as a service provider for this data.

3. How We Use Information

We use collected information to:

  • Provide and maintain the Service
  • Authenticate users and secure accounts
  • Process billing and usage tracking
  • Send service-related notifications
  • Comply with legal obligations
  • Improve the Service

4. Data Storage and Security

  • Account metadata is stored in PostgreSQL and submission data in DynamoDB, both in AWS ca-central-1 (Montreal) with encryption at rest
  • All data in transit is encrypted using TLS 1.2+
  • Access controls follow the principle of least privilege; row-level security separates accounts in PostgreSQL, and every DynamoDB partition is keyed by App
  • The production fleet is monitored by CloudWatch alarms; personal information is redacted from application logs
  • Container images are scanned for known vulnerabilities on every push; Septenar does not yet run application-level vulnerability scanning or third-party penetration testing

5. Data Sharing

We do not sell personal information. We may share information with:

  • Service providers: Infrastructure and operational partners, subject to DPAs
  • Legal requirements: When required by law, court order, or government request
  • Business transfers: In connection with a merger, acquisition, or sale of assets

6. Data Retention

  • Active account data: retained while the account is active
  • Legal acceptance records: retained indefinitely
  • Audit logs: one year for LAW_25 Apps, six years for HIPAA Apps; PIPEDA_BASELINE Apps write none
  • Submission data: retained until the Account Owner archives the form, a participant exercises erasure, or the account is cancelled; not deleted on a schedule
  • Cancelled account data: deleted 30 days after cancellation. For an account that hosted a HIPAA App, the account record, its Apps and the audit trail are kept for six years while all submission data is deleted

7. Your Rights

Under PIPEDA and Law 25, you have the right to:

  • Access your personal information
  • Correct inaccurate information
  • Withdraw consent (subject to contractual obligations)
  • Request deletion of your data
  • Receive your data in a portable format (within 30 days, per Law 25)
  • File a complaint with the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec

8. Privacy Officer

Our Privacy Officer can be contacted at:

9. Cookies and Tracking

We use essential cookies for authentication and session management. We do not use third-party advertising trackers. Analytics cookies, if used, are first-party only.

10. Children's Privacy

The Service is not directed to individuals under 18. Account Owners who collect data from minors through forms are responsible for compliance with applicable laws regarding minors' data.

11. International Transfers

All data is stored and processed in AWS ca-central-1 (Montreal). The only sub-processor holding personal information outside Canada is Stripe, which receives billing contact details and payment methods, never participant data. The current list of sub-processors is at septenar.ca/legal/subprocessors.

12. Changes to This Policy

We will notify you of material changes via email and in-platform notification. Continued use after notification constitutes acceptance of the updated policy.

13. Contact

For privacy inquiries, contact privacy@septenar.com.