Draft — pending lawyer review
# Privacy Policy — Redline Research **Draft for review by a lawyer before publishing.** **Controller / organization:** 13758958 Canada Inc. d.b.a. Redline Research (“Redline Research”, “we”, “us”, or “our”), British Columbia, Canada. **Effective date:** [PLACEHOLDER: effective date] **Privacy contact / privacy officer:** [PLACEHOLDER: privacy officer name or role] · [PLACEHOLDER: privacy email] **Mailing address:** [PLACEHOLDER: mailing address] This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use the Redline Research website and service (the “Service”). We aim to comply with Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and British Columbia’s Personal Information Protection Act (“PIPA”), and to provide reasonable transparency for users in the United States (including California Consumer Privacy Act / “CCPA”-style rights where they apply). This policy is not legal advice. ## 1. What we collect Depending on how you use the Service, we may collect: - **Account data:** name, email address, authentication identifiers from our sign-in provider (Clerk), plan tier, usage/quota counts, preferences - **Billing data:** billing name, email, billing country and province/state (and other address fields Stripe collects), subscription status, invoices, and limited payment metadata. **Full payment card numbers are processed by Stripe; we do not store full card numbers** - **Service data:** tickers and filing pairs you compare, job status, exports you request, share-link identifiers you create, support messages you send us - **Technical data:** IP address, device/browser type, approximate location derived from IP, logs, cookies or similar technologies, and product-analytics events (for example via PostHog or a similar provider). We instruct analytics not to send filing body text or email addresses in event properties where practicable - **Communications:** transactional emails (sign-up, “we’ll email you when ready,” receipts) via an email provider (for example Resend or equivalent) Content of SEC EDGAR filings we process is public regulatory information, not personal information about you, except insofar as it appears in your account history as activity you requested. ## 2. How we use personal information We use personal information to: - Provide, secure, and improve the Service (authentication, quotas, redlines, exports, share links) - Process payments and subscriptions; apply or record applicable Canadian and U.S. sales taxes using billing location; maintain accounting records - Send transactional messages; respond to support and Team sales inquiries - Detect abuse (bots, quota evasion, scraping) and enforce our Terms of Service - Analyze product usage in aggregate or pseudonymous form - Comply with law and protect our rights We do not sell personal information for money. We do not use your data to provide investment advice. ## 3. Sharing and processors We share personal information with service providers who process it on our instructions, including: - **Clerk** — authentication - **Stripe** — payments and billing - **Hosting / database / storage / workers** — application infrastructure [PLACEHOLDER: name production host when chosen] - **Transactional email provider** — account and job emails - **Product analytics** — PostHog or similar - **Professional advisers** (lawyer, accountant) when needed - Authorities when required by law Some providers process data in the **United States** or other countries. Cross-border transfers are a normal part of using these vendors. We take contractual and practical steps appropriate to the risk; absolute risk elimination is not possible on the public internet. We may disclose information in connection with a merger, financing, or sale of assets, subject to appropriate protections. ## 4. Share links If you create a share link, anyone with the link may view the shared redline or section **without signing in**. Do not put secrets in share URLs. We store enough data to serve and revoke those links. ## 5. Retention We retain account and billing records for as long as your account is active and afterward as needed for legal, tax, and dispute purposes. Logs and analytics are retained for shorter operational periods. You may request deletion as described below; some records must be kept by law. ## 6. Security We use reasonable technical and organizational measures (access controls, TLS in transit where configured, secrets management). No method of transmission or storage is completely secure. ## 7. Your rights (Canada) Subject to PIPEDA/PIPA exceptions, you may request access to, or correction of, your personal information, and withdraw consent where applicable (which may limit Service features). Contact [PLACEHOLDER: privacy email]. We will respond within the timeframes those laws require where they apply. ## 8. Your rights (United States / California-style) If you are a resident of a U.S. state with consumer privacy laws (for example California), you may have rights to know/access, delete, correct, and opt out of “sale” or “sharing” of personal information as those terms are defined in those laws. We do not sell personal information for money. To exercise rights, email [PLACEHOLDER: privacy email]. We will not discriminate against you for exercising rights. We may need to verify your request. Authorized agents may submit requests where the law allows, with proof of authority. ## 9. Children The Service is not directed to children under 16 (or the higher age required in your jurisdiction). We do not knowingly collect personal information from children. ## 10. Cookies and similar technologies We and our providers use cookies or local storage for sign-in sessions, security, preferences, and analytics. You can control cookies through your browser; blocking some cookies may break sign-in or parts of the Service. ## 11. Changes We may update this Policy by posting a new Effective date. Material changes will be highlighted when practicable. Continued use after the Effective date means you acknowledge the updated Policy. ## 12. Contact Privacy questions or requests: [PLACEHOLDER: privacy email] Privacy officer: [PLACEHOLDER: privacy officer name or role] Mail: [PLACEHOLDER: mailing address] --- *End of Privacy Policy draft. Not legal advice. Have counsel review before publishing. Align Home FAQ privacy answers with this document before launch.*