Privacy Policy

1.1 Account Information:

• Email address (required for account creation)
• Full name and company name (optional)
• Industry type and company size (optional)
• Password (encrypted and never stored in plain text)

1.2 Payment Information:

• Payment processing handled by Stripe (PCI-DSS compliant)
• We do NOT store credit card numbers, CVV, or full payment details
• We store transaction IDs and payment status only

1.3 Blockchain Information:

• Wallet addresses (public blockchain addresses you connect)
• Smart contract addresses and transaction hashes
• Note: Blockchain data is public and immutable by nature

1.4 Usage Information:

• IP address and browser type
• Pages visited and features used
• Device information (type, OS, screen resolution)
• Timestamps of actions

1.5 Safety Analysis Data (AI Features):

• Images uploaded for safety analysis
• AI-generated hazard assessments and recommendations
• Note: We do NOT permanently store uploaded images unless you explicitly save them

We use collected information for:

• Service Delivery: Providing smart contract deployment and AI safety analysis
• Account Management: Authentication, password resets, account settings
• Payment Processing: Charging platform fees and processing transactions
• Product Improvement: Analyzing usage patterns to improve features
• Security: Detecting fraud, preventing abuse, protecting against attacks
• Communications: Service updates, security alerts, important notifications (you can opt out of marketing)
• Legal Compliance: Meeting regulatory requirements, responding to legal requests

We do NOT:

• Sell your personal information to third parties
• Use your data for advertising purposes
• Share your workplace safety images with anyone
• Train AI models on your proprietary data without consent

3.1 Security Measures:

• TLS/SSL encryption for all data in transit
• AES-256 encryption for data at rest
• Secure authentication via Supabase (industry-standard auth provider)
• Regular security audits and vulnerability scans
• Access controls and role-based permissions
• Automated backup and disaster recovery

3.2 Data Retention:

• Account data: Retained until account deletion
• Transaction records: 7 years (legal/tax requirements)
• Temporary image uploads: Deleted within 24 hours unless saved
• Audit logs: 90 days

Important: While we implement industry-standard security measures, no system is 100% secure. You are responsible for maintaining the security of your account credentials and wallet private keys.

We use the following third-party services:

5.1 Rights Under PIPEDA (Canada):

• Right to Access: Request a copy of your personal information held by PictoSafe
• Right to Correction: Request correction of inaccurate personal information
• Right to Withdraw Consent: Withdraw consent for collection, use, or disclosure of your information (subject to legal obligations)
• Right to Challenge Compliance: File a complaint with the Office of the Privacy Commissioner of Canada
• Right to Know: Understand why your information is collected, how it is used, and to whom it is disclosed

5.2 CASL Compliance (Canada's Anti-Spam Legislation):

• We only send commercial electronic messages (CEMs) with express or implied consent
• All marketing emails include an unsubscribe mechanism
• Unsubscribe requests are processed within 10 business days
• Transactional and service-related messages are exempt but clearly identified

5.3 Rights Under GDPR (EU Users):

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Portability: Receive your data in machine-readable format
• Right to Object: Object to certain data processing
• Right to Restrict Processing: Limit how we use your data

5.4 Rights Under CCPA (California Users):

• Know what personal information is collected
• Know if personal information is sold or disclosed (we don't sell data)
• Opt-out of sale of personal information (not applicable - we don't sell)
• Request deletion of personal information
• Non-discrimination for exercising privacy rights

5.5 How to Exercise Rights:

Email us at: privacy@pictosafe.com

We will respond within 30 days for PIPEDA and GDPR requests, and 45 days for CCPA requests.

We use minimal cookies and tracking:

For privacy-related questions or to exercise your rights:

Response time: Within 48 hours for urgent security matters, 5-7 business days for general inquiries

We may update this Privacy Policy periodically. Material changes will be communicated via:

• Email notification to registered users
• Prominent notice on the platform
• Updated "Last Modified" date at the top of this page

Continued use after changes constitutes acceptance of the updated policy.