Privacy Policy

1. Introduction

GrainTrackr (“we”, “us”, or “our”) operates this Service. This Privacy Policy explains how we collect, use, disclose, and protect personal information in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

2. Information We Collect

We collect the following categories of information:

• Account information: name, email address, and password (stored as a one-way hash)
• Facility information: business name, address, phone number, and logo
• Operational data: customer records, sales orders, scale tickets, invoices, and employee information you enter into the Service
• Billing information: subscription status and payment method details (payment data is handled by Stripe and not stored on our servers)
• Usage data: log data, IP addresses, browser type, and pages visited
• Enquiry information: if you ask for a demo, the name, facility name, phone number and email address you give us. We keep this to arrange the demo and to follow up about the Service, even if you never open an account. Ask us and we will delete it.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Process payments and manage your subscription
• Send transactional emails (invoices, password resets, billing notices)
• Respond to support requests and feedback
• Comply with legal obligations

We do not sell your personal information to third parties. We do not use your operational data for advertising purposes.

4. Data Sharing and Disclosure

We may share your information with:

• Stripe: for payment processing. Stripe's privacy policy governs their handling of your payment data.
• SendGrid: for transactional email delivery.
• Neon / PostgreSQL hosting provider: your data is stored on encrypted servers.
• Sentry: for error monitoring and diagnostics. When the Service encounters an error, technical details about that error are sent to Sentry so we can diagnose it. See section 8 for what this includes.
• Legal authorities: when required by law or to protect our legal rights.

5. Data Retention

We retain your account and operational data for as long as your account is open.

If you cancel your subscription, your account is closed to new activity but your records are kept for 90 days. This is so you can resubscribe without losing anything, or export your data if you are leaving. After 90 days we delete the facility and everything in it.

If you trialled the Service and never subscribed, your data is not deleted on a schedule. We keep it so you can pick up where you left off, and we review dormant trial accounts periodically and delete those no longer needed. You can ask us to delete a trial account at any time and we will.

If you asked us for a demo and never opened an account, we keep the details you gave us so we can follow up about the Service. We do not delete those on a schedule, and we delete them whenever you ask.

If you ask us to delete your data sooner, at any time and whether or not you have cancelled, we will do it within 30 days of your request. Deletion removes your facility records, customers, tickets, invoices and staff information from the Service and cannot be undone. We keep only what we are required to retain by law. Contact us at spencer@graintrackr.com.

One safeguard you should know about. Before we delete a facility we take a copy of its records, so that deleting the wrong thing is recoverable rather than final. That copy is held securely by us, is never used for anything else, and is destroyed within 12 months. If you would rather it were destroyed sooner, ask us and we will.

6. Security

We implement industry-standard security measures including encrypted data transmission (TLS), bcrypt password hashing, and access controls. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

7. Your Rights (PIPEDA)

Under PIPEDA, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Withdraw consent to the collection or use of your personal information (subject to legal and contractual restrictions)
• Request deletion of your account and associated data

To exercise these rights, contact us at spencer@graintrackr.com. We will respond within 30 days.

8. Cookies, Tracking, and Error Diagnostics

GrainTrackr uses session cookies strictly necessary for authentication. We do not use third-party tracking cookies or advertising cookies, and we do not run analytics or advertising scripts on the Service.

We use Sentry to tell us when the Service breaks. If your browser encounters an error, Sentry records a diagnostic replay of that session so we can see what went wrong. These replays are captured only when an error occurs - we do not record ordinary sessions.

Replays are masked before they leave your browser: all on-screen text, all form input, and all images are blocked out. We see the shape of the page, which elements were clicked, the addresses of pages visited, and your IP address. We do not see your growers, your tonnages, your rates, or anything else you typed.

9. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or by posting a notice in the application. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact

For privacy-related inquiries or to exercise your rights, contact our Privacy Officer at: spencer@graintrackr.com