Canada Privacy Addendum

Application of Canadian Privacy Law

If you are a resident of Canada (excluding Quebec), your personal information is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. This addendum explains how we comply with Canadian privacy requirements and describes your rights under Canadian law.

Note: Enginr is not currently available in Quebec. Quebec has distinct privacy requirements under the Act respecting the protection of personal information in the private sector (Quebec Privacy Act) and Law 25. We plan to expand to Quebec in a future update with appropriate French language support.

How We Comply with PIPEDA

PIPEDA is based on 10 fair information principles. Here is how Enginr addresses each principle:

1. Accountability

Enginr is responsible for personal information under our control. Our team is accountable for compliance with PIPEDA. For privacy inquiries, contact us at support@enginr.dev.

2. Identifying Purposes

We identify the purposes for collecting personal information at or before the time of collection. Our purposes are described in detail in our main Privacy Policy under "How We Use Your Information."

3. Consent

We obtain your consent for the collection, use, and disclosure of personal information, except where permitted or required by law. By creating an account and using Enginr, you consent to our privacy practices as described in our Privacy Policy. For marketing communications, we obtain express consent as required by Canada's Anti-Spam Legislation (CASL).

4. Limiting Collection

We limit the collection of personal information to what is necessary for the purposes we have identified. We do not collect more information than needed to provide our services.

5. Limiting Use, Disclosure, and Retention

Personal information is used only for the purposes for which it was collected, unless you consent to other uses or as permitted by law. We retain personal information only as long as necessary to fulfill those purposes. See our data retention practices in the main Privacy Policy.

6. Accuracy

We keep personal information as accurate, complete, and up-to-date as necessary for its purposes. You can update your profile information at any time through your account settings.

7. Safeguards

We protect personal information with security safeguards appropriate to the sensitivity of the information. This includes encryption in transit and at rest, access controls, and regular security assessments. See "Data Security" in our main Privacy Policy.

8. Openness

We make our privacy policies and practices readily available. Our Privacy Policy and this Canada Addendum are accessible at any time on our website.

9. Individual Access

Upon request, we will inform you of the existence, use, and disclosure of your personal information and give you access to that information. You can also challenge the accuracy and completeness of your information and have it amended as appropriate. See "Your Rights Under PIPEDA" below.

10. Challenging Compliance

You may challenge our compliance with these principles by contacting us. We will investigate all complaints and take appropriate measures to address legitimate concerns.

Cross-Border Data Transfers

Enginr is based in the United States, and your personal information is stored and processed on servers located in the United States. This means your personal information will be transferred outside of Canada.

Under PIPEDA, we remain accountable for your personal information even when it is processed by third parties outside of Canada. We ensure that our service providers (including our infrastructure provider, Google Firebase) maintain appropriate security measures and handle your information in accordance with our instructions and applicable privacy laws.

By using Enginr, you acknowledge and consent to the transfer of your personal information to the United States for processing and storage. Your information may be subject to U.S. laws, including the possibility of disclosure to U.S. government authorities under certain circumstances.

Your Rights Under PIPEDA

As a Canadian resident, you have the following rights regarding your personal information:

• Right to Access: Request information about what personal data we hold about you and how it is used.
• Right to Correction: Request correction of inaccurate or incomplete personal information.
• Right to Withdraw Consent: Withdraw your consent to our collection, use, or disclosure of your personal information, subject to legal or contractual restrictions.
• Right to Data Export: Request a copy of your personal data in a portable format. You can export your data directly from Settings > Account > Data & Privacy.
• Right to Deletion: Request deletion of your account and personal information. You can initiate this from Settings > Privacy & Safety.

Response Time

We will respond to access requests within 30 days of receiving a complete request, as required by PIPEDA. In limited circumstances where we need additional time (for example, due to the complexity of the request), we will notify you and provide an estimated completion date.

How to Exercise Your Rights

You can exercise most of these rights directly through your account settings. For formal requests or if you need assistance, please submit a request through our Privacy Request Form or contact us at support@enginr.dev.

CASL Compliance (Anti-Spam)

Enginr complies with Canada's Anti-Spam Legislation (CASL) for commercial electronic messages sent to Canadian users:

• Express Consent: We obtain your express consent before sending marketing or promotional emails.
• Identification: All commercial messages clearly identify Enginr as the sender and include our contact information.
• Unsubscribe: Every commercial message includes a working unsubscribe mechanism that remains valid for at least 60 days.
• Prompt Action: We process unsubscribe requests promptly (typically within minutes, well ahead of the 10-business-day CASL requirement).

Transactional messages (such as password resets, security alerts, and account notifications) are not subject to CASL consent requirements and will continue to be sent as necessary to maintain your account.

Breach Notification

In the event of a privacy breach that creates a real risk of significant harm to you, we will:

• Notify you as soon as feasible about the breach and the steps we are taking
• Report the breach to the Office of the Privacy Commissioner of Canada (OPC)
• Notify any other organizations or government institutions that may be able to reduce the risk of harm
• Keep records of all breaches for at least 24 months, as required by PIPEDA regulations

Filing a Complaint

If you have concerns about how we handle your personal information, please contact us first at support@enginr.dev. We take all privacy concerns seriously and will work to resolve them.

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC):

• Website: www.priv.gc.ca
• Toll-free: 1-800-282-1376
• Address: 30 Victoria Street, Gatineau, Quebec K1A 1H3

Residents of Alberta, British Columbia, or Quebec may also contact their provincial privacy commissioner.

Contact Us

For questions about this Canada Privacy Addendum or our privacy practices, please contact us:

• Email: support@enginr.dev
• Privacy Requests: Privacy Request Form