1. Who is responsible: Turja Deb Mitun is the Privacy Officer for WhatsMyEmissions, in Montreal, Quebec. Write to support@whatsmyemissions.com about anything in this policy. We handle personal information under Quebec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's PIPEDA. Most people use this site without an account and without giving us anything — section 2 covers that, and sections 3 onward apply only if you create one.
2. Using the tools without an account: activity data, invoice text and figures entered into the calculator or the smart import are processed locally by the page in front of you. We do not store, retain or transmit them, and closing the tab discards them.
3. The one exception — reporting an unrecognised line: if a line cannot be matched to an activity, you may choose to send it to us so the factor library can be extended. This never happens automatically, and it is limited to what you see in the preview before you press send: the single source line, any description you add, any factor and source you supply, and an email address if you choose to give one. The rest of your inventory is never attached. The “which tool should come next” form on the home page sends what you type and, if you give it, your email address. Both forms are sent to our own server on Cloudflare and delivered to us as email by Resend; no other company sees them. If you give an address and we reply, that reply is delivered the same way. There is no analytics or tracking of any kind on this site.
4. What we hold if you create an account: your email address and, if you give one, your name. Your password is handled entirely by Auth0 (an Okta company) — we never receive, see or store it. We hold the inventories saved against your account, and standard access logs (IP address, browser type, timestamps) kept by our host, Cloudflare, for security and denial-of-service mitigation. The email we send you — confirming your address, resetting your password, or replying to you — is delivered by Resend, which handles your address and the content of that message in order to deliver it, and keeps a short delivery log. Resend is not sent your inventories.
5. Saving happens automatically while you are signed in: the inventory you are working on — including the raw activity data you pasted in, which may contain supplier and individual names — is saved to your account a few seconds after you stop typing, with no Save button to press. You can see, download and delete everything held against your account at any time on your account page. Signed out, nothing is saved anywhere.
6. Personal information about other people in what you save: invoices and travel records name individuals — “Flight, J. Tremblay, Montreal–Toronto, 14 March” is an ordinary expense line. The import reads lines like that, and the line is stored as written, because keeping the source line beside each figure is what makes the number auditable. Names are never read, analysed or disclosed. Remove them before saving where you can; the inventory is editable. If you save personal information about employees or anyone else, you remain responsible for having a basis to do so under the privacy law that applies to you. Ask us and we will delete any such line, or a whole inventory.
7. Why we hold it: only to sign you in, to store and show you your own inventories, and to keep the platform secure. We do not sell, rent, trade, monetise or profile your personal information or your company's activity data, and we do not use it to train anything.
8. Where it is held: Auth0 handles sign-up, sign-in and sessions; Cloudflare provides hosting, TLS, the database holding saved inventories and the server that receives the two forms in section 3; Resend delivers the email we send you. Information is encrypted in transit and at rest. Our Auth0 tenant is in Auth0's Canadian region (CA-1). Saved inventories sit with Cloudflare in eastern North America, which may be Canada or the United States — Cloudflare offers no Canada-only location. Resend sends from the United States; it offers no Canadian region either. All three providers are outside Quebec for the purposes of the Act, including the Canadian one; each was assessed for equivalent protection before use, and those assessments are available from the Privacy Officer.
9. Cookies: Auth0 sets strictly necessary cookies to keep you signed in, and clearing them signs you out. There are no analytics cookies, no advertising cookies, no cross-site tracking and no profiling.
10. How long: an open account, for as long as it stays open. A closed account, permanently deleted within 30 days of your request. An account not signed in to for 24 months: we write to it, and delete it if there is no answer within 30 days. An unrecognised-line report and any email address with it: until the question is resolved, and no longer than 24 months. The delivery log for an email we send you: kept by Resend for a short period so a failed delivery can be traced, and used for nothing else.
11. Your rights under Law 25: you may have a copy of what we hold in a machine-readable format, have inaccurate information corrected, withdraw consent and have your account and its contents erased, and be told if a confidentiality incident affects you. Download everything and delete everything are buttons on your account page and work immediately; deleting your data there does not remove your sign-in record at Auth0, which we delete on request. Formal requests to support@whatsmyemissions.com are answered within 30 days.
12. Confidentiality incidents: if we have reason to believe an incident involving personal information has occurred, we take measures to reduce the risk of harm. Where it presents a risk of serious injury, we notify the Commission d'accès à l'information du Québec and the people affected promptly, as the Act requires, and we keep a register of incidents for five years.
13. Changes: the revision date is at the top of this notice. If anything material changes we will say so on the site and write to account holders before it takes effect. Questions: support@whatsmyemissions.com.