Privacy Policy

1. Introduction

Glass Wave Consulting Inc. (“we,” “us,” or “our”), provider of PineReport, is committed to protecting the privacy and security of personal information entrusted to us. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit pinereport.ca or use our incident reporting and compliance software (the “Services”).

Our privacy practices are designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), and Nova Scotia's Personal Information International Disclosure Protection Act (PIIDPA) where applicable.

PineReport does not sell, rent, or trade personal information to any third party for marketing or commercial purposes. Your data is used solely to deliver and improve our Services. We also do not use personal information to train artificial intelligence or machine learning models without explicit consent.

By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Services.

2. Who This Policy Applies To

PineReport is sold to summer camps and similar organizations (“Camps”), not to individuals or families. In privacy law terms:

• Camps are data controllers. They decide what information to collect about their staff and campers, and they are responsible for complying with privacy law in their jurisdiction.
• PineReport is a data processor. We process personal information on behalf of Camps, under their instruction, as described in our Data Processing Agreement (available on request).

This Privacy Policy also covers the limited personal information we collect directly from Camp Administrators (the people who sign up for and manage a PineReport account on behalf of their Camp).

3. Information We Collect

3.1 Information Submitted by Camps

Camps submit information about their staff and campers when using PineReport. This may include:

• Camper records: name, date of birth, cabin or group assignment, and guardian contact details.
• Staff records: name, email address, role, and on-call contact details.
• Incident Reports: written descriptions of incidents, dates, locations, staff involved, and any health or medical notes relevant to an incident.
• Media: photos and audio recordings attached to Incident Reports to document circumstances.

Incident Reports may contain health information about campers or staff. PineReport treats this as sensitive personal information and applies heightened protections, as described in Section 5.

3.2 Account and Billing Information

When a Camp Administrator registers for PineReport, we collect:

• name and email address (used for login and service communications);
• billing contact name and address; and
• payment method details (processed by Stripe — we do not store raw card numbers).

3.3 Technical Information

When you use the Services, we may automatically collect limited technical information, including:

• IP address and browser type (used for security monitoring and rate limiting);
• session data (managed via Clerk authentication cookies); and
• error and diagnostic information (collected by Sentry for application monitoring — see Section 6).

We do not use analytics cookies or third-party tracking. See our Cookie Policy for details.

4. How We Use Personal Information

4.1 Providing the Services

• storing and displaying Incident Reports and compliance records for authorized camp staff;
• managing Camp Administrator accounts and access controls;
• sending transactional emails (account invitations, password resets, incident notifications) on behalf of Camps;
• processing subscription payments; and
• providing customer support.

4.2 Security and Operations

• detecting and preventing unauthorized access, fraud, and abuse;
• monitoring application errors and performance; and
• maintaining audit logs for security and breach investigation.

4.3 Legal Compliance

• complying with applicable law, including court orders and regulatory requirements; and
• enforcing our Terms of Service and other policies.

4.4 Service Improvement

We may analyze aggregated, de-identified usage patterns to improve the Services. This analysis does not involve individual personal information and cannot be used to identify any person.

We do not use personal information for automated decision-making that produces legal or similarly significant effects on individuals.

5. Data Storage and Security

5.1 Storage Location

PineReport stores all primary application data — camper records, staff records, Incident Reports, and media — on OVH servers located in Canada (Beauharnois, QC and Toronto, ON). Transactional email is delivered via Amazon Web Services SES in the ca-central-1 (Canada) region.

Some sub-processors (Clerk for authentication, Stripe for billing, Sentry for error monitoring, and Upstash for rate limiting) operate in the United States and process only the limited data necessary for their specific function. The full list is on our security page.

5.2 Security Measures

• AES-256 encryption of all data at rest;
• TLS 1.2/1.3 encryption of all data in transit;
• role-based access controls limiting data to authorized personnel;
• mandatory multi-factor authentication (MFA) for all user accounts, enforced at sign-up and sign-in, plus MFA for administrative and infrastructure access;
• automated daily database backups;
• application error monitoring and alerting; and
• documented incident response procedures.

5.3 Breach Notification

In the event of a privacy breach that creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and, where applicable, the Commission d'accès à l'information du Québec, and will notify affected individuals as required by PIPEDA Section 10.1, Law 25, and applicable provincial legislation. We maintain a register of all breaches as required by law.

We will notify affected Camps without undue delay and in any event no later than 72 hours after becoming aware of a breach.

6. Data Retention

Category	Retention period
Camper and staff records, Incident Reports, media	Duration of Camp's subscription; after termination, retained until deletion is requested and then permanently deleted
Camp Administrator account and billing information	Duration of subscription plus a reasonable period (typically 2 years) for legal and audit purposes
Audit logs	At least 7 years to support breach investigation and regulatory inquiry

Personal information is permanently and securely deleted on request following termination, or once it is no longer required for the purposes described above. You may request deletion at any time by contacting our Privacy Officer at privacy@pinereport.ca, subject to legal retention requirements.

7. Data Sharing and Disclosure

7.1 No Selling of Personal Data

PineReport does not and will not sell, rent, trade, or otherwise transfer personal information to third parties for monetary or other consideration.

7.2 Sub-processors

We share personal information with the sub-processors listed on our security page, solely as necessary for them to provide their specific service. All sub-processors are contractually bound to protect personal information in accordance with applicable privacy law. We will give Camps at least 30 days' notice before adding or replacing a sub-processor.

7.3 Legal Requirements

We may disclose personal information if required by law, court order, or valid government authority. If we receive a foreign demand for disclosure of personal information held on behalf of a Canadian public body customer, we will notify the affected customer in accordance with PIIDPA before disclosing, unless prohibited by law.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, personal information may be transferred as part of that transaction. We will notify affected Camps and individuals via email and a notice on our website before any change in how their information is used.

8. Your Rights

8.1 Access and Control

Under PIPEDA, Law 25, and applicable provincial privacy legislation, you have the right to:

• access the personal information we hold about you;
• correct inaccurate or incomplete information;
• request deletion of your information (subject to legal retention obligations);
• withdraw consent for specific uses;
• request portability of your information in a structured, commonly used format (Law 25, s. 28.1);
• request de-indexation in certain circumstances (Law 25, s. 28.1); and
• object to or restrict certain processing activities.

To exercise these rights, contact our Privacy Officer at privacy@pinereport.ca. We will respond within 30 days as required by PIPEDA, or sooner where required by other applicable legislation.

If your request relates to information submitted by a Camp (for example, your child's incident records), please contact the Camp directly first, as they control those records. See our For Parents page for more detail.

8.2 Communication Preferences

You may opt out of non-essential communications by using the unsubscribe link in any email or by contacting privacy@pinereport.ca. Note that certain communications (such as breach notifications and security alerts) are required and cannot be opted out of while your account is active.

8.3 Filing a Privacy Complaint

If you are not satisfied with how we have handled a privacy concern, you may file a complaint with:

• Office of the Privacy Commissioner of Canada — priv.gc.ca — for matters governed by PIPEDA
• Commission d'accès à l'information du Québec — cai.gouv.qc.ca — for Quebec residents
• Your applicable provincial privacy commissioner.

9. Children and Minors

PineReport is designed for use by summer camps, which routinely submit records about minor campers. We recognize this carries heightened obligations.

Under Quebec Law 25, individuals under 14 years of age require parental or guardian consent for the collection and use of their personal information. We apply a similar approach in all other Canadian provinces, consistent with applicable law.

Camps are responsible for obtaining all required consents from campers and their guardians before submitting information to the Services. If you believe we hold information about a minor without proper consent, contact us immediately at privacy@pinereport.ca.

See our For Parents page for a plain-language explanation of camper data and parental rights.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify affected Camps and individuals of material changes by posting the updated policy here and updating the “Last updated” date, and by email where appropriate. You are encouraged to review this policy periodically.

11. Privacy Officer and Contact

PineReport's designated Privacy Officer is:

Jane Matthews
Glass Wave Consulting Inc.
privacy@pinereport.ca

The Privacy Officer is responsible for PineReport's compliance with applicable privacy legislation and is the primary contact for all privacy inquiries, access requests, and complaints.

For general inquiries unrelated to privacy, contact info@pinereport.ca.