Privacy Policy
1. Who This Policy Covers
NorthCan Safety (“NorthCan”, “we”, “us”) provides NorthCan Safety Hub, also called NorthCan 360°. This policy describes how we handle personal information in Hub accounts, company workspaces, support and billing.
NorthCan manages information needed to operate accounts and provide the service. Your employer or company controls the workplace records it places in its workspace, including why they are collected, who should have access and applicable retention requirements. Contact your company about its employment practices. We assist with requests relating to the information we process for it.
2. Information We Handle
- Account and profile: name, email, role, company, site assignments, profile photo, contact information and emergency contacts that you or an authorized manager provide.
- Workplace records: forms, inspections, hazards, incidents, corrective actions, training and certifications, attachments, messages, signatures, timestamps and audit history.
- Billing and support: company and billing contact details, plan, transaction and invoice references, subscription status, requests and correspondence. Stripe collects payment credentials through its hosted checkout and portal. The Hub does not store full card numbers or security codes.
- Technical information: authentication events, service requests and errors, device/browser information, push subscription identifiers, and operational logs collected by our infrastructure providers.
Provide only information necessary for the task. Avoid unnecessary medical details, government identifiers and other sensitive material. If you enter someone else’s information, including an emergency contact, you must have an appropriate basis and provide any required notice.
3. Purposes And Permissions
We use information to authenticate users, provide company access, store and share records with authorized people, support signatures and follow-up work, deliver requested notifications, administer subscriptions, answer enquiries, prevent misuse and meet applicable legal requirements.
We rely on consent where required, your company’s authorized instructions for workplace processing, and other grounds permitted by applicable law. Optional device notifications can be disabled in the Hub or your browser. Withdrawal of information needed to operate an account may prevent us from continuing that service. We do not use Hub records for advertising or sell personal information.
4. Who Can Receive Information
Records are available to authorized company users according to role, permissions and site access. Managers may access worker profiles and company records, including records created by workers. Exported or downloaded copies leave the Hub’s access controls; your company is responsible for how it handles them.
Service providers process information needed to deliver the Hub: Supabase for authentication, Sites/Cloudflare infrastructure for hosting, database and file storage, Resend for transactional email, Stripe for payments, OpenAI for optional AI replies, and browser or device push services for opted-in alerts. These providers may process operational information under their own service and privacy terms. NorthCan support may access information necessary to investigate a request, maintain the service or protect accounts.
We may disclose information when legally required, to address fraud or security incidents, or to protect lawful rights. If the service is transferred to another operator, any transfer of personal information must remain subject to appropriate safeguards and applicable notice requirements.
Optional AI Assistance
When you choose to use the Virtual Safety Officer and agree to AI processing, your message and the earlier messages in that conversation are sent to OpenAI to generate a response. Avoid personal, medical, confidential or identifying details unless your company authorizes their use. You can use the other Hub workflows without sending messages to the AI assistant.
Conversations are saved in your company account for you to reopen. The assistant does not automatically read your company records. We request that the AI response is not stored as a retrievable response by the provider; this does not mean that no provider security or operational retention applies. Contact NorthCan for questions about AI data handling. AI drafts require competent review before workplace use.
5. Storage, Transfers And Safeguards
Information may be processed in Canada and other countries where providers operate. It may be subject to lawful access in those countries. We do not promise that all Hub data remains in Canada.
The Hub uses authenticated sessions, company and role access checks, protected service connections and server-side controls for sensitive actions. No internet service can guarantee absolute security. Protect your password, use your own account, sign out on shared devices and tell us promptly about suspected unauthorized access. We assess security incidents and provide notices required by applicable law.
6. Retention And Account Closure
Retention depends on the record’s purpose, company instructions, applicable workplace and tax requirements, dispute needs and legal holds. There is no single retention period for every safety record, and the Hub does not currently apply automatic expiry to all workplace records.
| Information | What Happens On Account Closure |
|---|---|
| Login, private drafts, profile photo and push subscriptions | Removed through the closure process. If a cleanup step fails, access remains blocked and you can retry the remaining step. |
| Personal contact and emergency details | Cleared from your Hub worker profile; its status becomes inactive. Copies previously entered into company records are handled as those records. |
| Workplace records and identifiers | Company forms, signatures, audit history, messages, employment identifiers and training evidence remain separately retained. Your name and email may remain where needed to identify who performed or signed work. |
| Billing, security and closure records | Necessary transaction, consent, security and closure records may remain to meet legitimate operational and legal needs. Provider backups and logs follow the provider’s applicable retention arrangements. |
Owners must transfer the workspace to an eligible manager or close it. Closing a workspace ends team access and cancels its subscription immediately; it does not automatically purge company records. Request a retention review when records are no longer needed. We assess whether deletion, de-identification or continued retention is appropriate and explain any lawful restriction. Deletion cannot recall exports held by your company or other recipients.
7. Your Choices And Requests
You can update available personal fields, manage notifications, export records within your permissions and close your account at Account closure. Contact NorthCan for access to your personal information, correction, withdrawal of consent, a deletion or retention review, or a privacy complaint. We may verify identity and coordinate with the company responsible for workplace records.
Where PIPEDA applies, we respond to an access request within 30 days, subject to permitted extensions and exceptions. If an extension, fee or refusal is permitted and necessary, we explain it and available recourse. We do not promise to erase information we must lawfully retain. You may also contact the Office of the Privacy Commissioner of Canada or the applicable provincial regulator.
8. Browser Storage And Changes
The Hub stores authentication tokens in persistent storage on this device so you can remain signed in across navigation and app restarts. Tokens are refreshed while your session remains valid and removed by sign-out. Use a personal device with a screen lock and sign out when you finish on a shared device. Private drafts, unsent messages and pending attachments may also be stored on this device, separately scoped to your account and company. Device drafts are not a backup of submitted company records; clearing app or browser data can remove them. Limited local settings support company setup and app installation. The installed app may cache application assets; push access is optional. The Hub application does not include advertising trackers.
We update this policy when our practices change and identify the effective version. Material changes will be brought to users’ attention in the Hub; additional consent will be requested where required. A new use of information will not rely solely on silently changing this page.
Contact NorthCan
Privacy, billing and service enquiries: Chris@NorthCanSafety.com
519-994-2082 · Ontario, Canada
Include your account email and company so we can route your request. Do not send passwords, card details or unnecessary sensitive information.