Last updated: July 2026 · DRAFT — pending review by legal counsel prior to commercial launch.
This policy explains how Canadian Board of Certified Energy Practitioners, operating RFPace (rfpace.com), collects, uses, and protects personal information, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.
Account information: name, business email, password (stored as a salted hash — we never see your password).
Organization content you choose to provide: company profiles, personnel information (such as resumes and certifications your organization uploads), project references, procurement documents, and proposal drafts.
Usage and technical data: log data, actions taken in the platform (for the audit trail your organization sees), and cookies strictly necessary for signing you in. We do not run advertising trackers.
Payment data: processed by Stripe, our payment provider. We never store card numbers.
To provide the Service: analyzing your procurement documents, generating drafts, sending alerts you configure, and operating your organization's account. To secure and improve the Service. To communicate with you about your account. We do not sell personal information, and we do not use one customer's content to serve another customer or to train shared AI models.
Content you submit for analysis is processed by our infrastructure and AI providers solely to fulfil your request: Vercel (hosting), Turso (database), Anthropic (AI processing), Stripe (payments), and email delivery providers for notifications you enable. These providers may process data outside Canada (including the United States). By using the Service you consent to this cross-border processing; we select providers with strong contractual and security commitments.
When your organization uploads information about its employees (resumes, certifications), your organization is responsible for having the authority or consent to do so. We process it only to provide the Service to your organization.
We retain your data while your account is active. You may delete individual documents and records at any time in the platform. On account termination, you may request export of your data; we delete Customer Content within a reasonable period thereafter, except where retention is required by law.
Data is encrypted in transit (HTTPS) and at rest, isolated per organization, and access-controlled by role. No system is perfectly secure; we will notify affected users of any breach creating a real risk of significant harm, as required by PIPEDA.
You may request access to, correction of, or deletion of your personal information, and withdraw consent (which may limit Service functionality), by contacting info@rfpace.com. You may also complain to the Office of the Privacy Commissioner of Canada.
We will post updates here and flag material changes in the Service. Privacy questions and requests: info@rfpace.com.