Privacy Policy

1. Overview

IncentivIQ ("we", "our", "us") is a Canadian government incentive eligibility platform operated at claimpilot-ca.polsia.app. We help Canadian businesses identify and understand federal and provincial incentive programs they may qualify for.

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform. By using IncentivIQ, you consent to the practices described in this policy.

2. What We Collect

Information You Provide Directly

• Business information: Company name, industry (NAICS category), province of operation, years in business, number of employees
• Financial information: Annual revenue range, approximate R&D expenditure ranges, export revenue estimates, hiring/training costs
• Contact information: Email address (when you create an account or request a report)
• Account credentials: Email and password for registered accounts

Information Collected Automatically

• Usage data: Pages visited, features used, time spent on the platform
• Technical data: IP address, browser type, device type, operating system
• Cookies: Session cookies and preference cookies (see Section 9)

Information From Third Parties

• Payment information: Processed by Stripe. We do not store full credit card numbers. We receive transaction confirmation and subscription status from Stripe.

3. How We Use Your Information

We use your information to:

• Run the eligibility assessment and match your business to applicable government incentive programs
• Calculate directional estimates of potential claim values
• Generate and deliver your assessment report (PDF and on-screen)
• Create and maintain your account (if registered)
• Process subscription payments via Stripe
• Send transactional emails (account confirmations, receipt notifications)
• Improve the accuracy of our program matching logic
• Detect and prevent fraud or misuse of the platform
• Comply with applicable legal obligations

We do not use your information for:

• Selling or renting your data to third parties
• Sharing data with the Canada Revenue Agency, ISED, or any government body
• Behavioural advertising or ad targeting
• Automated decision-making that has legal or similarly significant effects on you

4. Business Financial Data

IncentivIQ collects approximate financial ranges (not exact figures) to perform eligibility assessments. Specifically:

• Revenue ranges (e.g., "$500K–$1M") to determine program thresholds
• R&D expenditure estimates to assess SR&ED eligibility
• Hiring and training cost ranges to identify wage subsidy eligibility
• Export revenue estimates to assess CanExport and trade programs

How we use it: Financial data is used solely to run the program-matching algorithm and generate your eligibility report. It is not used for credit scoring, underwriting, or any financial assessment beyond program eligibility.

How we protect it: All data is transmitted over HTTPS. Our database is hosted on Neon (a SOC 2 certified PostgreSQL provider). Access is restricted to authorized IncentivIQ personnel only.

Retention: Financial data from unregistered assessments is retained for 90 days, then purged. Registered account data is retained while your account is active and for 12 months following deletion. See Section 6 for full retention details.

5. Who We Share It With

We share your information only with trusted service providers necessary to operate the platform:

• Stripe — Payment processing. Stripe's privacy policy is available at stripe.com/privacy. We share only what Stripe requires to process transactions.
• Neon — Managed PostgreSQL database hosting (SOC 2 Type II certified).
• Render — Application hosting and deployment infrastructure.
• Google Fonts — Typography delivery (no personal data shared; font requests are IP-only).

We do not share your data with:

• Government agencies (CRA, ISED, provincial ministries) without your explicit consent
• Tax advisors, accountants, or law firms without your explicit consent
• Data brokers or analytics resellers
• Other IncentivIQ users

We may disclose your information if required by law (e.g., a valid court order), but will notify you to the extent permitted by law before doing so.

6. Data Retention

• Anonymous assessments (no account): Submission data retained for 90 days, then automatically deleted.
• Free accounts: Retained while the account is active. Deleted within 30 days of account deletion request.
• Paid accounts: Retained while the subscription is active and for 12 months following cancellation (for billing dispute purposes). Deleted within 30 days thereafter.
• Payment records: Transaction records retained for 7 years as required by Canadian tax law.
• Cookies and analytics logs: Anonymized after 90 days.

7. Security

We implement reasonable technical and organizational safeguards to protect your information:

• All data transmitted over HTTPS/TLS encryption
• Database credentials and secrets stored in environment variables, never in source code
• Database hosted on SOC 2 certified infrastructure (Neon)
• Access to production data limited to authorized personnel
• Regular dependency updates and vulnerability scanning

No system is 100% secure. If you believe your account has been compromised, contact us immediately at privacy@incentiviq.com.

In the event of a data breach that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required under PIPEDA.

8. Your Rights

Under PIPEDA and applicable provincial privacy laws, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that inaccurate information be corrected
• Deletion: Request that we delete your personal information (subject to legal retention requirements)
• Withdrawal of consent: Withdraw consent for non-essential data processing at any time
• Portability: Request your data in a structured, machine-readable format
• Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

To exercise any of these rights, email privacy@incentiviq.com with subject line "Privacy Request". We will respond within 30 days.

9. Cookies & Tracking

We use the following types of cookies:

• Strictly Necessary: Session cookies required for the platform to function (authentication, form state). Cannot be disabled.
• Preference cookies: Remember your display preferences and consent choices. Can be disabled.
• Analytics cookies: Anonymous usage tracking to improve the platform. Can be disabled.

We do not use advertising, tracking, or third-party behavioural cookies.

You can manage cookie preferences via the consent banner shown on your first visit, or by clearing cookies in your browser settings. Note that disabling necessary cookies will affect platform functionality.

10. PIPEDA & Provincial Privacy Laws

IncentivIQ operates in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private-sector privacy law.

We also respect applicable provincial legislation, including:

• Quebec: Loi 25 (Act respecting the protection of personal information in the private sector). Quebec residents have additional rights including the right to data portability and the right to be forgotten.
• Alberta: Personal Information Protection Act (PIPA)
• British Columbia: Personal Information Protection Act (PIPA BC)

Our Privacy Officer can be reached at privacy@incentiviq.com. We will respond to all privacy requests within 30 days as required by PIPEDA.

Our servers and data are located in Canada and/or the United States. If your data is processed in the United States, it may be subject to that country's laws.

11. Contact Us

If you are not satisfied with our response to a privacy request, you have the right to complain to the Office of the Privacy Commissioner of Canada:

• Website: www.priv.gc.ca
• Toll-free: 1-800-282-1376

We may update this Privacy Policy from time to time. Material changes will be communicated by email (for registered users) or by a prominent notice on the platform. The "last updated" date at the top of this page reflects the most recent revision.