Privacy policy

STRACTA is an online service that construction companies use to plan daily dispatch, report field work and track quantities. This policy explains what personal information STRACTA handles, why, where it is stored, how long it is kept and whom to contact.

Who is responsible

• Operator: [to be added before launch] runs STRACTA at https://demo.stracta.ca.
• Person in charge of personal information: [to be added before launch], [to be added before launch]. This person is responsible for protecting personal information under Québec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
• Your company: STRACTA is invite only. Each customer company decides what goes into its own workspace and who gets an account. STRACTA processes that information to provide the service to the company. [counsel]

What STRACTA collects

• Account data: name, work email address and role, and a phone number and profile photo if they are added.
• Work records: daily dispatch, projects and their contacts, field reports, quantities, tasks, team chat, and the photos and PDF files people add.
• Audit records: who did what and when, including every action taken during a "STRACTA support" session.
• Security data: sign-in sessions, and sign-in attempt counters that are kept under hashed values, not readable addresses.
• Email delivery records: which invitations, password reset links and notifications were emailed, and whether they were delivered.

Why STRACTA uses it

STRACTA uses this information only to provide the service: to sign people in, show each person their work, send invitations, reset links and notifications, keep the service secure and give support. STRACTA does not sell personal information and does not use it for advertising. [confirm]

Where it is stored

• Database, files and sign-in data: in Canada, with Supabase in the ca-central-1 region (Montréal).
• Application servers: in Montréal, with Vercel in the yul1 region.
• Network and request logs: Vercel's network is global, so a request can pass through, and be logged at, Vercel locations outside Canada.
• Email: emails pass through Resend in the United States.
• Error reports: only if Sentry is used. They carry no personal information by design: no names, email addresses, messages or page content.
• Outside Québec: before personal information is sent outside Québec (for example email through Resend in the United States), the operator assesses the transfer as Québec law requires. [counsel]

Service providers

• Supabase: database, file storage and sign-in.
• Vercel: hosting.
• Resend: email.
• Sentry: error alerts, if used.

Each provider works under its data processing agreement. The uptime monitor only reads a public health address and receives no personal information.

Cookies and storage on your device

STRACTA uses essential cookies only, so it shows no consent banner.

• Company sign-in cookie: powa_session, named __Host-powa_session on the production domain. It keeps you signed in for up to 7 days, and for at most 60 minutes during a support session.
• Platform staff cookie: stracta_platform, named __Host-stracta_platform on the production domain. It keeps STRACTA staff signed in to the platform portal for up to 8 hours.
• No tracking: no analytics, advertising or third-party cookies.
• Offline use: unsaved field drafts and the app's own files stay on your device so STRACTA keeps working without a signal. Drafts are cleared when you sign out.

Support access

To give support, the platform owner can act as a person in a company for at most 60 minutes at a time. Every action is recorded, and the company's audit log shows it as "STRACTA support".

How long it is kept

• Accounts, work records and audit records: for the life of the company account.
• Sign-in sessions: a company sign-in lasts up to 7 days, a support session at most 60 minutes and a platform staff sign-in 8 hours. The daily cleanup deletes expired platform staff sign-ins and ends expired support sessions (the audit record stays). The record of an expired company sign-in (a hashed token, the person and its end time) stays until that person's sign-ins are ended, for example by a password change. [confirm]
• Sign-in attempt counters: each counter covers 15 minutes. A counter (a hashed value and a number) is reused, not deleted. [confirm]
• Daily email counters: they count one day at a time and hold no personal information.
• Unfinished uploads: removed by the daily cleanup once their upload links have expired, within about a day and a half. [confirm]
• Files no record uses any more: removed by the daily cleanup once they are more than 24 hours old, usually within 2 days, and within 17 days for a company with more than 2,000 files. [confirm]
• Backups: 7 days.
• Hosting logs, email logs and error reports: as set by each provider's plan. [confirm]

Export and deletion

A company owner can ask for a copy of the company's data, or for its deletion. These requests are handled by a manual procedure, and every step is recorded. When the service ends, the company is suspended first. After deletion, backups age out within 7 days.

Security

• Data is encrypted in transit (TLS) and at rest by the providers.
• Database roles have only the access they need.
• Each company's data is kept separate from every other company's.
• Platform staff sign in with two-factor authentication.

Your rights, incidents and complaints

• Access and correction: you can ask to see the personal information STRACTA holds about you, or to correct it, by writing to the person in charge of personal information.
• A copy you can reuse: you can ask for the personal information you gave, in a structured, commonly used format. [counsel]
• Incidents: if a breach of security creates a risk of serious harm, the people affected are notified, and so are the authorities the law names.
• Complaints: you can complain to the Commission d'accès à l'information du Québec or to the Office of the Privacy Commissioner of Canada.

Changes to this policy

When this policy changes, the date below changes with it, and important changes are announced in STRACTA before they take effect. [counsel]

This policy is available in French and in English, as Québec's Charter of the French language requires. [counsel]

Last updated: 7 October 2026.