Privacy Policy

Grover ("we," "us," or "our") is operated by Matthew Gibson, a sole proprietor carrying on business in Calgary, Alberta, providing a platform for exploring Canadian building permit data. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in accordance with Alberta's Personal Information Protection Act (PIPA) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

By using Grover, you agree to the collection and use of information as described in this policy.

1. What we collect

We collect only what we need to operate the service:

• Business email address — collected when you sign in or request access. Used for authentication (magic-link login) and transactional service communications.
• Name and company — optional, and only if you choose to provide them in your account profile.
• Billing information, if you subscribe — handled by our payment processor, Stripe. We never receive or store your card number, expiry date, or security code. Those details are entered directly on Stripe's payment pages. What we store is an identifier issued by Stripe that links your Grover account to your Stripe customer record, together with your subscription status, plan, renewal date, and any discount applied.
• Usage records — counts of your activity within the service, such as how many CSV exports or contractor lookups you have made in a month. These are used to apply plan limits and to support your account.
• Aggregated, anonymized usage data — collected via Vercel Analytics. This is non-personal: no cookies are set, no individual users are tracked, and no personal identifiers are stored. We receive only aggregate metrics such as page views and referral sources.

We do not collect phone numbers, government identifiers, or any sensitive categories of personal information. Stripe may collect a billing address as part of processing a payment, and holds it on its own records; we do not store it and do not use it for any purpose.

2. How we use it

We use your email address to:

• Authenticate you and deliver magic-link sign-in emails
• Send transactional service notices — account changes, billing notices, and notices we are required to give you under our Terms of Service
• Send email alerts and digests that you have configured yourself, which you can turn off at any time
• Respond to support or account requests you initiate

If you subscribe, we use your billing information to take payment, apply the correct plan limits to your account, show you your own billing status, and keep the financial records we are required by law to keep.

We will not send marketing or promotional emails without your explicit opt-in, in compliance with Canada's Anti-Spam Legislation (CASL).

Aggregated usage data is used solely to understand how the product is used and to improve it. It cannot be linked back to any individual.

3. Who we share it with

We do not sell, rent, or trade your personal information. We share it only with the following service providers who help us operate the platform:

• Stripe — our payment processor. If you subscribe, your email address and any name you have provided are passed to Stripe so that it can create your billing record, take payment, and send you receipts. You provide your card details directly to Stripe, not to us. Stripe acts as an independent controller of the payment data it collects and handles it under its own privacy policy. Stripe operates infrastructure in the United States and other countries.
• Resend — our transactional email provider. Your email address is passed to Resend solely to deliver sign-in links and service notices. Resend operates infrastructure in the United States.
• Vercel — our hosting and analytics provider. Vercel Analytics is privacy-first: it collects no personal data and sets no cookies. Vercel infrastructure is located in the United States.
• Railway — our database hosting provider. Your email address and account records are stored in a PostgreSQL database hosted on Railway infrastructure located in the United States.
• Sentry — our error monitoring provider. When the service encounters an error, diagnostic information is sent to Sentry, which may include your account identifier. Sentry operates infrastructure in the United States.

All providers are bound by data processing agreements and confidentiality obligations. We may also disclose personal information where required to do so by law, or to establish, exercise, or defend a legal claim. No other third parties receive your personal information.

4. Cross-border data transfers

As noted above, Stripe, Resend, Vercel, Railway, and Sentry process data on infrastructure located in the United States. When your personal information is transferred outside Canada, it may be subject to the laws of that jurisdiction, including lawful access by US government authorities. We have taken steps to ensure appropriate contractual safeguards are in place with each provider.

5. Public data

The building permit data displayed on Grover comes from the City of Calgary Open Data portal and is licensed under the Open Government Licence – City of Calgary. This is publicly available information. We do not collect it from users, and it contains project and contractor information from public municipal records.

Some municipal permit records name individuals — for example, a homeowner acting as their own applicant. We publish these records only as they appear in the municipality's own public release. If you believe a record published through Grover contains personal information about you that should not be shown, contact us at support@groverdata.ca and we will review it.

6. Data retention

We retain your account information for as long as your account is active. Cancelling a paid subscription does not delete your account — it returns to the free plan, and your saved searches and preferences remain available to you.

If you request account deletion, we will remove your personal information within 30 days, with one exception: records of payments and invoices must be retained for tax purposes. Canadian tax law generally requires business records supporting a transaction to be kept for six years from the end of the relevant tax year. We retain the minimum necessary for that purpose — transaction records and the amounts involved — and we do not use them for anything else. Stripe retains its own payment records under its own retention policy.

Vercel Analytics data is aggregated and non-personal; it is retained per Vercel's standard retention policy.

7. Security

We implement industry-standard safeguards including encryption in transit (TLS), encrypted database storage, and strict access controls. Only authorized personnel can access personal information, and only to the extent required for their role.

Because card details are entered directly on Stripe's systems and never reach ours, your card number is not stored in, and cannot be exposed by, Grover's database.

No system is completely secure. While we take reasonable precautions, we cannot guarantee the absolute security of your information.

8. Your rights

Under Alberta PIPA and, where it applies, PIPEDA, you have the right to:

• Know what personal information we hold about you and how it has been used and disclosed
• Request a correction if it is inaccurate or incomplete
• Request deletion of your personal information, subject to the retention exception in section 6
• Withdraw consent to collection or use, subject to legal or contractual restrictions — note that withdrawing consent to hold your email address means we can no longer provide the service, as sign-in depends on it

To exercise any of these rights, email us at support@groverdata.ca with "Privacy Request" in the subject line. We will respond within 30 days.

9. Data breach notification

If a breach of personal information occurs that poses a real risk of significant harm, we will notify affected individuals and the Office of the Information and Privacy Commissioner of Alberta as required by PIPA — and, where PIPEDA applies, the Office of the Privacy Commissioner of Canada — without unreasonable delay.

10. Changes to this policy

We may update this Privacy Policy as the product evolves. Material changes will be communicated by email to registered users before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

Questions, concerns, or requests regarding this policy should be directed to:

If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta, or the Office of the Privacy Commissioner of Canada.