Privacy Policy

1. Introduction

This Privacy Policy explains how personal data is collected, used, stored, transferred internationally, and protected when you use our AI-assisted software designed for architecture firms. It applies to all website, application and system users and customers who interact with our services. The policy is governed by Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) and United States state privacy laws.

2. Scope and Application

This Privacy Policy applies to personal data we process about: (a) users of our AI-assisted software for architecture firms, including our customers' authorised users; (b) visitors to our website, myarchfp.com; (c) people who contact us or request a demo; (d) prospective customers whose business contact information we collect from public sources and business-contact databases; and (e) individuals whose personal data our customers upload to the platform, such as employees and subconsultants named in CVs and project records. It covers the collection, use, storage, international transfer, and protection of personal data in accordance with Canadian PIPEDA and United States state privacy laws.

3. Definitions

In this Privacy Policy: "personal data" means information about an identifiable individual; "processing" means any operation performed on personal data, such as collection, use, storage, disclosure, or deletion; a "data controller" decides why and how personal data is processed, and a "data processor" processes personal data on a controller's behalf; "we", "us", and "our" mean Project Rayder Inc.; the "services" or "platform" means ArchFP, our AI-assisted software for architecture firms, including our website and application; a "customer" is a firm or individual that subscribes to the services, and a "user" is anyone who uses them, including a customer's authorised users; "customer content" means the documents, proposals, answers, project records, CVs, and other material that customers and users upload to or generate in the platform; "service providers" means the third parties listed in section 13 that process personal data on our behalf; an "international transfer" is a transfer of personal data to a country other than the one in which it was collected; and "applicable laws" means the privacy and data protection laws that apply to our processing, including PIPEDA and United States state privacy laws.

4. Data Controller and Contact Details

The data controller for personal data processed under this Privacy Policy is Project Rayder Inc., located at 1366, Creekside Dr., Oakville, ON, L6H 4Z3, Canada. Our Privacy Officer is accountable for our compliance with this Privacy Policy. For privacy-related queries, requests, or concerns, please contact our Privacy Officer at [email protected] or +1 (647) 676-7886.

5. Personal Data We Collect

6. Sources of Personal Data

We collect personal data from multiple sources, including directly from users when they register, interact with our software, or communicate with us; from customers who provide information about their authorised users or project teams, including in the CVs and project records they upload; from Google, if you choose to sign up or sign in with your Google account; from staff members; and from third party sources such as service providers, business partners, or publicly available sources, where permitted by applicable law. Publicly available sources include professional registers, such as the Ontario Association of Architects' public register, and firms' own websites, from which we collect business contact information about prospective customers. We also obtain business contact information about prospective customers, such as email addresses, job titles, and company size, from the business-contact database Apollo.

7. Purposes of Processing

We process personal data for the following purposes: to deliver and operate our AI-assisted software for architecture firms; to improve and develop our services and user experience; to comply with applicable laws and regulatory requirements; to manage customer accounts and relationships; to respond to support requests and communications; to analyse usage and performance; to ensure data security and integrity; to facilitate international transfers and lawful disclosures; and to contact prospective customers about our services, as described in section 19. Additional purposes may include research, product enhancement, and fraud prevention, as permitted by law.

8. Legal Bases for Processing

We process personal data on the following legal bases, as required by applicable laws in each jurisdiction: (a) with the consent of the data subject; (b) for the performance of a contract with the user or customer; (c) to comply with legal obligations under Canadian PIPEDA and United States state privacy laws; (d) for our legitimate business interests, including improving and securing our AI-assisted software for architecture firms, provided such interests are not overridden by the rights and freedoms of data subjects; and (e) where necessary to protect vital interests or for the establishment, exercise, or defence of legal claims. Where consent is required, users and customers may withdraw consent at any time by contacting us at [email protected].

9. Use of AI and Automated Decision Making

10. Cookies and Similar Technologies

11. Retention of Personal Data

We retain personal data for as long as your account is active and as needed to provide our services, and afterwards for as long as necessary to comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. You may ask us to delete your account and personal data at any time by emailing [email protected], and we will delete it within thirty (30) days of your request, except where we are required by law to keep certain information, such as billing and tax records. Copies held in backups are removed as those backups expire. Criteria for determining retention periods include the nature of the data, applicable legal requirements, and business needs.

12. International Data Transfers

Personal data may be transferred to and processed in jurisdictions outside your country of residence, including Canada, the United States and other locations where our service providers, infrastructure, or business partners operate. Such transfers are conducted in compliance with applicable laws and subject to appropriate safeguards, including contractual clauses, data protection agreements, and technical measures designed to ensure the security and lawfulness of processing. Where required, you may request a copy of the relevant safeguards by contacting us at [email protected].

13. Disclosure of Personal Data to Third Parties

14. Data Security Measures

15. Your Rights Under Canadian Privacy Law

Individuals have the right under Canadian privacy law, including PIPEDA, to access their personal data, request corrections, and withdraw consent for processing where applicable. You may also request information about how your data is used, challenge the accuracy of your data, and file complaints with the Office of the Privacy Commissioner of Canada. To exercise these rights, please contact us at [email protected] or follow the procedures outlined in this Privacy Policy. We will respond to requests within thirty (30) days or sooner, as required by law. If you are dissatisfied with our response, you may escalate your concern to the relevant privacy authority.

16. Your Rights Under United States Privacy Laws

Individuals have rights under United States privacy laws, including the right to access personal data, request correction or deletion, and opt out of certain data processing activities. State-specific laws, such as the California Consumer Privacy Act (CCPA), may provide additional rights, including the right to know what personal data is collected, the right to request deletion, and the right to opt out of the sale or sharing of personal data. To exercise these rights, please contact us at [email protected]. We will respond to requests within forty-five (45) days or sooner, as required by law. If you are dissatisfied with our response, you may contact the relevant state privacy authority.

17. Exercising Your Privacy Rights

Individuals may exercise their privacy rights by submitting a written request to our Privacy Officer at [email protected]. Upon receipt, we will verify your identity by matching account details and/or requesting supporting documentation. We aim to respond to all requests within thirty (30) days or sooner, subject to applicable law. If additional information is required to process your request, we will notify you promptly. Requests may be denied where permitted by law, including where compliance would compromise the rights of others or conflict with legal obligations.

18. Children's Privacy

Our AI-assisted software and related services are not directed to children under the age of thirteen (13) and we do not knowingly collect personal data from children. If we become aware that personal data from a child has been collected without appropriate parental consent, we will take steps to delete such information promptly. Parents or guardians who believe their child has provided personal data may contact us at [email protected] to request removal. Where applicable, we comply with relevant laws regarding children's privacy, including the Children's Online Privacy Protection Act (COPPA) in the United States and similar requirements in other jurisdictions.

19. Direct Marketing and Communications

20. Enterprise Customers and Authorised Users

Enterprise customers are responsible for ensuring that authorised users comply with this Privacy Policy and applicable data protection laws. Authorised users may include employees, contractors, or other individuals designated by the enterprise customer to access and use our AI-assisted software for architecture firms. Enterprise customers must provide accurate information about authorised users, obtain any necessary consents, and communicate relevant privacy notices. We process personal data of authorised users on behalf of enterprise customers, who act as data controllers for such data. The same applies to personal data contained in customer content, such as employees' or subconsultants' CVs: the customer is responsible for having the right to upload it, and we process it on the customer's behalf. Our obligations as a data processor are governed by applicable agreements and laws. Enterprise customers must promptly notify us of any changes to authorised user status or data subject requests relating to personal data processed through our services.

21. Data Storage Location and Infrastructure Providers

Our application servers and file storage are hosted by Amazon Web Services in the United States (Ohio region), our database is hosted by MongoDB Atlas in the United States, and our product analytics data is stored by PostHog in the United States. Many of the other service providers listed in section 13 also process personal data in the United States. Personal data stored or processed outside Canada is subject to the laws of the country where it is held and may be accessible to courts, law enforcement, and national security authorities there. Data may also be processed or backed up in additional jurisdictions as required for redundancy and business continuity. For more information about where personal data is stored, please contact us at [email protected].

22. Data Protection by Design and Default

We design ArchFP to collect only the personal data it needs, and access to it is limited to the people who operate the service. Passwords are stored as one-way hashes, bid portal login details are encrypted, connections to the platform are encrypted, and the platform uses rate limiting and standard web-security protections. Session recordings mask all on-screen text. You can unsubscribe from marketing emails using the link in any of them, remove your content and portal login details from the platform at any time, and ask us to access, correct, or delete your personal data by emailing [email protected].

23. Data Breach Response

We maintain internal procedures to promptly identify, contain, and assess any suspected or confirmed data breach involving personal data. Upon detection, our incident response team investigates the breach, mitigates risks, and documents findings. Where required by Canadian PIPEDA or United States state privacy laws, we will notify affected individuals and relevant authorities without undue delay, providing details of the breach, potential impacts, and remedial actions. Notifications will be made in accordance with applicable legal timeframes and may include guidance for individuals to protect themselves. For further information about our breach response process, or to report a suspected breach, please contact our Privacy Officer at [email protected].

24. Links to Third Party Sites and Services

Our AI-assisted software for architecture firms may contain links to third party websites, platforms, or services. Such third party sites and services operate independently and are subject to their own privacy policies and practices, which are not controlled, endorsed, or governed by us. We are not responsible for the privacy, security, or content of any third party sites or services. Users and customers are encouraged to review the privacy policies of any third party sites or services before providing personal data or engaging with them. Accessing third party links is at your own risk.

25. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the features of our AI-assisted software for architecture firms. Any material changes will be communicated by posting the revised Privacy Policy on our website and, where required by law, by providing direct notice to users and customers via email or other appropriate means. The effective date of the updated Privacy Policy will be indicated at the top of the document. Continued use of our services after the effective date of any changes constitutes acceptance of the revised Privacy Policy. We encourage you to review this Privacy Policy periodically to stay informed about how your personal data is handled.

26. Governing Law and Complaints

This Privacy Policy is governed by the laws of Canada (PIPEDA) and applicable United States state privacy laws. Individuals may lodge complaints regarding personal data handling by contacting our Privacy Officer at [email protected], or by submitting a complaint to the relevant privacy authority in their jurisdiction, such as the Office of the Privacy Commissioner of Canada or the appropriate US state privacy regulator. We encourage individuals to contact us directly with any concerns before escalating to a regulatory authority. Complaints will be investigated promptly and addressed in accordance with applicable legal requirements.

27. Contact Information

For privacy queries, rights requests, and complaints, please email [email protected], or write to Project Rayder Inc. at 1366, Creekside Dr., Oakville, ON, L6H 4Z3, Canada.