Privacy Policy

1. Information we handle

• Account information: name, email, password hash, workspace memberships, roles, invitation and verification status, and account activity. We store password hashes rather than readable passwords.
• Workspace information: projects, drawings, specifications, quotations, takeoffs, files and filenames, contact and recipient details, tasks, deadlines, notes, and sharing instructions. These may contain personal information supplied by your organization.
• Technical and security information: session identifiers, IP addresses and browser information for some security events, access and error logs, upload metadata, and email delivery or failure information. Some abuse-prevention records use hashed network identifiers.
• Billing information: Stripe customer and subscription identifiers, purchased user/storage allowances, billing status and relevant billing-event identifiers. Payment card details are entered in Stripe’s hosted Checkout and are not stored by Estentra.
• Agreement records: your user and workspace identifiers, acceptance timestamp, terms and privacy versions, and document hashes. Acceptance does not add an IP address or browser fingerprint to that record.
• Support information: correspondence and information you choose to provide when requesting help or service access.

We receive information from you, workspace administrators and colleagues, and providers handling delivery or security. Upload only information you have authority to provide. Avoid unrelated sensitive information such as health records, government identification or payment card details.

2. Why we use it

We use information to manage accounts and workspaces; organize projects and documents; carry out RFQ and sharing instructions; send invitations, verification, password recovery and other necessary service messages; prevent abuse and investigate security incidents; answer support requests; maintain and troubleshoot the service; record agreement acceptance; and meet legal obligations.

We do not sell or rent personal information, use it for behavioural advertising, or use customer project content to train AI models. Optional marketing is separate from necessary service messages and agreement acceptance. We will obtain any required permission before optional marketing and provide a way to unsubscribe.

3. Workspace access and sharing

Your organization's administrators control invitations, roles and workspace access. Authorized colleagues can see information available to their role. RFQ recipients or anyone who obtains an active supplier share link may access authorized files. Links may be forwarded and downloaded copies cannot be recalled by expiring or revoking a link.

Your organization is responsible for the purposes and permissions for personal information it puts into tender records. We process those records to provide the service. Ask your administrator about their handling practices; you can also contact us about information we hold.

4. Providers and processing outside Canada

• DigitalOcean: application hosting, managed PostgreSQL and Spaces storage. Our current deployment uses its Toronto region; this is not a guarantee that every support, operational or backup process stays in Canada.
• Postmark: transactional email delivery. It receives addresses, message content and delivery information, including one-time account links in messages. Postmark processes and stores email data in the United States.
• Stripe: hosted payment collection and subscription management. Stripe receives payment and billing details you provide, subscription selections and an Estentra workspace identifier. Stripe may process information outside Canada and handles payment information under its own privacy policy. Estentra receives billing status and identifiers; it does not receive your full payment card number or security code.
• Fastmail: support correspondence, including your email address, message and attachments. Its email infrastructure includes processing outside Canada, including the United States.

Providers may use subcontractors. Information processed outside Canada may be accessible to courts, law enforcement or other authorities under local law. We remain responsible for appropriate contractual and other safeguards for information processed on our behalf.

We may disclose information where required or permitted by law, to address a security incident or legal claim, or for a business transfer subject to appropriate confidentiality safeguards and applicable notice requirements. We do not grant providers a right to use project content for their advertising.

5. Cookies and email tracking

Estentra uses an essential session cookie for sign-in and request protection. Interface preferences may be stored in your browser. Blocking essential cookies can prevent sign-in. The current app does not use advertising trackers or third-party analytics scripts. Our Postmark integration disables email-open tracking and tracked-link rewriting; delivery and failure information may still be recorded.

6. Security and risks

Safeguards include authentication, password hashing, access roles, workspace isolation, expiring account and sharing links, protected sessions and request tokens, and encrypted connections for hosted access. Support access is limited to service needs. No service, email or shared link is completely secure. Use a unique password and review recipients and documents before sharing.

Unauthorized access may expose confidential project documents, contacts or account information. We will assess suspected breaches and notify affected people and regulators when required by applicable law.

7. Retention, closure and deletion

We retain active account and workspace records while needed to provide the service. Archiving a project, disabling a member or revoking a share link does not erase stored records or downloaded copies. Account closure and deletion requests are handled through support.

Contact [email protected] for closure, deletion, correction or retrieval assistance. We verify your identity and authority, distinguish your account from organization records, and explain information that must be retained for legal obligations, security, disputes or another legitimate purpose, and why. Information no longer required will be deleted or de-identified. Agreement records may be retained to demonstrate acceptance and resolve disputes.

Deletion from active systems may not immediately remove backups or provider copies. Restricted backups remain subject to their retention and replacement cycles and are not used for ordinary access. Postmark retains content and metadata under its configured settings; its published default is 45 days, with longer-lived suppression information for delivery management. We explain provider and backup constraints when handling requests rather than promise immediate deletion everywhere.

Backup recovery and signup verification

We keep private daily recovery copies of the database and uploaded files in DigitalOcean Spaces in Toronto, with a rolling 30-day recovery window. Access is limited to authorized backup administration. Recovery copies are used to restore service after data loss; deleted records can remain in those copies until the recovery window expires. After a restore, we reapply completed deletion requests before returning restored personal information to active use.

Self-service signup collects your name, organization and email to send a verification link. Links expire after 24 hours; only their hashes are stored. Your workspace and free trial are created after you verify your email, choose a password and accept the policies. Expired signup verification records are removed after 30 days; recovery copies can remain for the backup window.

8. Access, correction, withdrawal and complaints

Request access to your personal information, corrections, details of our practices, or withdrawal of consent through our Privacy Officer at [email protected]. We may request information reasonably needed to verify identity and respond within applicable legal time limits. Access may be limited where law permits, such as to protect another person's information; we explain restrictions where permitted.

You may decline the terms, stop using the service, or ask about closure and withdrawal. Withdrawing permission essential to operating an account may mean we cannot continue providing it. Optional uses can be declined separately. Acknowledging this policy does not waive privacy rights or authorize unspecified new purposes.

If we cannot resolve a complaint, you may contact the Office of the Privacy Commissioner of Canada or another applicable authority.

Product suggestions and service improvement

Settings includes an optional suggestion form. If you submit it, Estentra's authorized platform owner can read your suggestion, display name, organization name and submission date to evaluate improvements and communicate review status. Other members cannot see your submission through the suggestion form. Do not include passwords, client information or confidential project details. We retain suggestions while needed for product review and follow-up; you may request deletion through support.

We maintain first-party daily totals of authenticated application requests by broad feature area, server-error counts, processing time and slow-request counts to identify reliability and performance problems. These aggregates do not contain user or organization identifiers, IP addresses, full URLs, search terms, filenames, document contents or browser fingerprints and expire after 90 days. We also summarize existing account sign-in records and workspace counts for service administration. Only the authorized platform owner can view this console. Switching the console to user view does not grant access to other customer workspaces.

Advanced reporting and cost history process the records your workspace supplies. Owner-authorized API integrations receive only the data permitted by the token's scopes and plan. We store API token hashes rather than readable tokens and retain API request history for 30 days. Your organization controls which integrations it authorizes; external integration providers have their own privacy practices.

9. Changes and scope

This policy covers Estentra's website, tender management service and support communications. The service is intended for adult business users. External websites and recipients have their own practices. We identify material changes and seek renewed consent where required before new uses. Previous published versions remain available, and account users will be asked to acknowledge an updated version.