Privacy policy

Introduction

CivilProposal is operated by Lifesaver Technology Services Inc. ("we," "our," or "us"), a British Columbia, Canada corporation. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use CivilProposal (sourced civil site scoping intelligence and proposal drafts for Canadian civil engineering firms). Some infrastructure providers we use may process or store data outside Canada. See the Data Storage Location and International Data Transfers sections below.

We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia's Personal Information Protection Act (PIPA) and, for people in Quebec, the Act respecting the protection of personal information in the private sector (as amended by Law 25), as applicable. Lifesaver Technology Services Inc. is accountable for personal information under its control. The person in charge of protecting personal information is our Privacy Officer, who you can reach at [email protected]. Our company-wide privacy practices are described in the Lifesaver Privacy Policy; this page describes CivilProposal-specific collection and subprocessors.

Marketing communications (CASL)

We may send transactional emails about your account, security, billing, and service operation without additional consent. Promotional or marketing emails about CivilProposal or other Lifesaver products are sent only with consent where required under Canada's Anti-Spam Legislation (CASL). You may unsubscribe from marketing messages using the link in those emails or by contacting [email protected].

Information we collect

How we use your information

• To provide, maintain, and improve our services
• To process your requests and transactions
• To communicate with you about your account and service updates
• To ensure security and prevent fraud
• To comply with legal obligations

Data storage and security

Your data is stored on secure servers using industry-standard encryption. We implement technical and organizational measures designed to protect your information from unauthorized access, loss, or alteration. However, no method of transmission over the internet or electronic storage is completely secure.

Data sharing and disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• With service providers who assist in operating our platform, subject to confidentiality agreements and data protection requirements:
  • Fly.io (Canada): application hosting and runtime infrastructure
  • Supabase (Canada): database storage and authentication. Supabase receives account and application data needed to operate the service.
  • OpenAI (US): generates proposal text under their API terms. Before transmission, identifying details are replaced with placeholder tokens on our servers, and real values are restored only in the final document on our own infrastructure. The following firm, client, team, and credential fields are ALWAYS tokenized before any OpenAI request: client and firm names; firm and signatory addresses, email addresses, phone numbers, and websites; signatory names and titles; the firm's PE license number and insurance certificate note; every team member's name, title, PE license, biography, and past-project descriptions; and subcontractor company names. Reference proposals uploaded before that feature was retired remain stored on our infrastructure and are NEVER sent to any AI provider. Non-identifying project context (project type, city/province, scope items, facility size, and dataset-derived site intelligence such as zoning and floodplain status) is sent so the model can produce substantive content. The automated redaction is best-effort and may not catch every identifying detail that a user places inside a free-text field. Under OpenAI's API data-usage policy, data submitted through the API is not used to train their models and is retained only transiently (up to 30 days) for abuse and misuse monitoring before deletion, unless a zero-retention arrangement applies.
  • Stripe (US): payment processing for subscriptions. Stripe collects and processes your payment information (credit card, billing address) directly. We do not store your full payment card details.
  • PostHog (US): product analytics (feature usage, funnels), only after you accept analytics cookies. Session recording is off, and email addresses and phone numbers are stripped from event data before it is sent.
  • Google Analytics (US): website traffic analytics, only after you accept analytics cookies. Advertising features and ad personalization are off.
  • Cloudflare (global edge): DNS, CDN, and DDoS protection in front of the application. All traffic passes through Cloudflare, which sees your IP address and request details to deliver and protect the site. If Cloudflare Web Analytics is enabled, it counts page views without cookies.
  • Sentry (US): error monitoring. When an error occurs, a technical report (error message, stack trace, page or API path, browser type and your internal user ID) is sent so we can fix it. Sign-in tokens, cookies, authorization headers and share-link tokens are removed before sending, and session replay is not used.
  • Resend (US): delivers our emails (sign-in links, invites, shared links, notifications and reminders). Resend receives the recipient address and the message content.
• When required by law or to respond to legal process
• To protect our rights, property, or safety, or that of our users
• With your explicit consent

Some service providers (including OpenAI, Stripe, Resend, Sentry, PostHog, and Google Analytics) may process your information in data centers located in the United States. These providers are contractually required to protect your information in accordance with applicable privacy laws.

Non-identifying project information is transmitted to OpenAI to generate your proposal; every identifying firm, client, signatory, team and credential field is either replaced with a placeholder or withheld entirely before transmission. Because the automated redaction operates on structured fields, it may not catch identifying details a user places inside free-text notes. Professional Engineers should assess their professional confidentiality obligations under their provincial PE code of ethics before transmitting client or RFP data.

Your rights

Under PIPEDA, BC PIPA and Quebec's private-sector privacy law (as applicable), you have the right to:

• Access your personal information
• Request correction of inaccurate information
• Request deletion of your personal information
• Receive a copy of the information you gave us in a structured, commonly used format
• Withdraw consent for data processing where applicable, including analytics cookies and marketing email
• File a complaint with the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, or the Commission d'accès à l'information du Québec

You can delete your account yourself in Settings, under Account. Deleting your account cancels any subscription, deletes your profile and the pursuits, reports and drafts you own, and deletes your sign-in record. You can export any pursuit's report or proposal draft from the app at any time. For a full copy of your information, or any other request, contact [email protected]. We will respond to access and correction requests within 30 days where required by law. You may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or the Office of the Information and Privacy Commissioner for BC at www.oipc.bc.ca.

Data breach notification

In the event of a data breach that poses a real risk of significant harm, we will notify affected individuals and regulators as required by PIPEDA and PIPA, including the Office of the Privacy Commissioner of Canada and, where applicable, the Office of the Information and Privacy Commissioner for British Columbia. Notification will include the nature of the breach, the information involved, steps we have taken to mitigate the breach, and steps affected individuals can take to protect themselves. We maintain records of all breaches for a minimum of 24 months as required by law.

To report a suspected security vulnerability or incident involving the Service, contact [email protected].

Data retention

We keep your account information and the work you create for as long as your account is active. Some records are deleted automatically on a schedule:

• Product usage events: 90 days
• Read in-app notifications: 30 days; all in-app notifications: 180 days
• AI usage records (used for plan limits and billing): 365 days
• Billing webhook payloads from Stripe: reduced to a minimal record after 365 days
• Security audit events (for example, role changes and deletions): 2 years
• Saved versions of a proposal draft: the most recent 50 per draft

When you delete your account, we delete your personal information from our database, except where we must keep it for legal reasons. Stripe keeps payment and invoice records under its own legal obligations, and we keep financial records for 7 years (CRA requirements). Database backups roll over and are not edited, so deleted data can remain in a backup until that backup expires. Records needed for a legal dispute or required by court order are kept for as long as required.

Cookies and tracking

We use browser storage to keep you signed in and remember your preferences. Analytics (PostHog and Google Analytics) are off until you choose "Accept all" in the cookie banner: before that, and if you choose "Essential only", no PostHog or Google script is loaded and nothing is sent to them. We ask again after 12 months. You can change your choice at any time:

You can also control cookies through your browser settings, though blocking essential storage will sign you out.

Authentication uses Supabase Auth session storage in the browser (typically local storage) rather than classic session cookies alone. Declining analytics cookies does not affect core application functionality.

International data transfers

Your core application data and authentication records are stored in Canada. Other service providers may process limited data in the United States as described above. By using our Service, you consent to that cross-border processing where required to operate the service.

We ensure appropriate safeguards are in place to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Contractual protections with service providers requiring data protection standards
• Access controls and security measures to prevent unauthorized access
• Compliance with applicable privacy laws to the extent possible

Please note that information stored in the United States may be subject to access by U.S. authorities under applicable laws. If you have concerns about data storage outside of Canada, please contact us before using the Service.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the service after such changes constitutes acceptance of the updated policy.

Contact us

If you have questions about this Privacy Policy or wish to exercise your rights, contact our privacy team: