Privacy Policy

We act in two roles:

• Controller of customer-account data — information about the people who create and administer accounts.
• Processor of member data — information a customer organization collects about its own members. For that data the organization is the controller and its own privacy policy governs; we process it only on the organization’s instructions under our Data Processing Agreement.

Privacy contact: privacy@networkbase.ca · Mailing address: 422 Richards St #170, Vancouver, BC V6B 2Z4. Québec Law 25 person in charge of the protection of personal information: our Privacy Officer, reachable at the address above.

This policy covers Networkbase’s own websites and the platform. If an organization added you as a member, that organization’s privacy policy governs its use of your data; contact them for requests about member data we hold on their behalf (we will route or assist — see §10).

We do not request government IDs, precise geolocation, or special-category data (health, race, etc.) by default.

• Provide and operate the service — contract.
• Security, fraud prevention, service improvement, analytics — legitimate interests.
• Marketing email and non-essential cookies — consent (withdraw anytime).
• Tax, accounting, lawful requests — legal obligation.

For member data, the legal basis is the customer organization’s responsibility as controller.

We use strictly-necessary technologies to run the service and may use functional/analytics technologies. Non-essential cookies require your consent where required (EU/Québec). See our Cookie Policy.

We share personal information with the sub-processors below, the customer organization, professional advisors, authorities under lawful process, and parties to a corporate transaction. We do not sell personal information and do not “share” it for cross-context behavioral advertising.

Current sub-processors: Resend (email), Stripe (payments), Amazon Web Services (storage/CDN), Sentry (error monitoring), and our managed database host. See the full list at Sub-processors.

Some sub-processors are outside Canada and the EEA. We rely on Standard Contractual Clauses or an equivalent safeguard (such as the EU–US Data Privacy Framework where a recipient is certified), and for transfers outside Québec we conduct a transfer assessment. We will provide details of the safeguard on request.

We retain personal information only as long as needed for the purposes above or as required by law. Append-only consent records and audit logs are retained as legal evidence beyond account life; backups expire on a rolling cycle.

bcrypt password hashing; authenticated access with strict per-organization isolation and role-based access; TLS in transit; encryption at rest on the managed database; audit logging of access to personal data; rate limiting and input validation. No method is 100% secure.

Depending on your location you may have rights to access, correct, delete, port, restrict, object, and opt out. To exercise them:

• Self-service: Profile → Privacy & your data → Download my data / Delete my account.
• Or email privacy@networkbase.ca. We verify your identity, allow authorized agents (California), and respond within roughly 30 days (45 days for California, extendable). We will not discriminate or retaliate for exercising rights.

For member data held on behalf of an organization, we route your request to that organization (the controller) and assist.

We do not sell or share personal information, and we do not use sensitive personal information for purposes that would require a “Limit the Use of My Sensitive Personal Information” link. California residents retain the rights to know, delete, and correct (see §10).

We do not offer financial incentives or price/service differences in exchange for personal information.

We do not make decisions producing legal or similarly significant effects based solely on automated processing.

Where we rely on consent (marketing email, non-essential cookies), you may withdraw it at any time — via account settings, the one-click unsubscribe in our emails, or by contacting us. Our commercial emails include our physical mailing address (CASL/CAN-SPAM).

The service is not directed to children and we do not knowingly collect their data.

Contact us first at privacy@networkbase.ca. You may also complain to your regulator: the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the California Privacy Protection Agency / Attorney General, or your EU data protection authority.

If a security incident affecting your personal information meets the applicable risk threshold, we will notify regulators and affected individuals as required by law.

We may update this policy; we will post the new version and date, and for material changes provide notice and, where required, seek renewed consent.

RapidIteration, 422 Richards St #170, Vancouver, BC V6B 2Z4 · privacy@networkbase.ca.