Privacy Notice

Septic Safety Ltd. operates the Septic Safety Registry. For the personal data described here, Septic Safety Ltd. is the data controller — we decide what data is collected and why, and we are responsible for protecting it.

1. Personal data we collect

• Service company account data — name, email address, phone number, login credentials, role, and company membership. Accounts exist only for registered septic service companies and their staff.
• Company data — business name, address, and contact details for registered service companies, plus billing details held by our payment provider.
• Property data — property or site name, address, septic system specifications, site contact name and email, access instructions, and internal notes recorded by the service company.
• Service records — visit dates, service type, technician name, checklist results, issues and resolutions, amendments, notes, and photographs submitted by service companies.
• Support messages — the content of requests you send us.
• Technical data — IP address, device and browser identifiers, and usage and error telemetry.

2. Why we use it, and our legal basis

• Creating service-company accounts, verifying provider eligibility, and operating the registry — performance of a contract.
• Maintaining permanent property records and public Registry pages — performance of a contract and legitimate interests in a reliable public record.
• Security, abuse prevention, and fraud detection — legitimate interests.
• Customer support and service communications — performance of a contract.
• Product improvement and aggregate analytics — legitimate interests.
• Marketing emails, where sent — consent, withdrawable at any time.
• Meeting legal, tax, and record-keeping obligations — legal obligation.

3. What is public and what is not

A property’s Registry page is public and needs no account to view. Property owners and members of the public — inspectors, insurers, buyers, parents — can open it directly.

A public Registry page may show:

• the property or site name, property type, and Record ID;
• the property address;
• the current septic service company;
• service and inspection dates and service types;
• inspection checklist results;
• issues found and how they were resolved;
• amendments filed against earlier records;
• photographs the service company has explicitly published;
• maintenance and inspection due dates.

The following are never shown on a public Registry page:

• site contact name;
• site contact email or phone number;
• access instructions, gate or lock codes, and access-point details;
• internal property notes;
• photographs that have not been published;
• unsubmitted draft records;
• billing and payment information.

4. Who we share data with

• Service providers and subprocessors — cloud hosting, database and storage, email delivery, error monitoring, and analytics tooling.
• Merchant of Record — Paddle, for service-company record fees, payments, tax compliance, and invoicing. Property owners are billed directly by their septic service company, not by us.
• Registered service companies — the company that services a property, and companies that serviced it previously, can access that property’s service history.
• Professional advisers — legal, accounting, and insurance advisers where needed.
• Authorities — where required by law or valid legal process.

We do not sell personal data.

5. International transfers

Our providers may process data outside your country, including in the United States and the European Union. Where data leaves Canada, the UK, or the EEA, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.

6. Retention

Property safety records are retained for the life of the registry entry, because their value is a permanent maintenance history. Account and company data is retained while the account is active and for up to 7 years afterwards for tax and legal purposes. Support messages and technical logs are retained for up to 24 months. When data is no longer needed, it is deleted or anonymised.

7. Your rights

Subject to applicable law, you may request access to your personal data, correction of inaccurate data, deletion, restriction of or objection to processing, and portability, and you may withdraw consent where we rely on it. If you are in the UK or EEA you may also complain to your supervisory authority. We respond within one month. Note that a submitted service record is corrected by amendment rather than by editing history.

8. Security

We apply appropriate technical and organisational measures, including encryption in transit and at rest, row-level access controls scoped to your account and role, signed short-lived URLs for photographs, and least-privilege access for our staff.

9. Cookies

We use essential cookies and local storage to keep you signed in and to keep the app functioning. Where we use analytics cookies, they are optional and you can manage them through your browser settings or any cookie banner presented to you. We do not use advertising cookies.

10. Contact

Septic Safety Ltd. — privacy@septicsafety.ca