Privacy Policy

Grover ("we," "us," or "our") is a Calgary, Alberta–based business that provides a platform for exploring Canadian building permit data. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in accordance with Alberta's Personal Information Protection Act (PIPA) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

By using Grover, you agree to the collection and use of information as described in this policy.

1. What we collect

We collect only what we need to operate the service:

• Business email address — collected when you sign in or request access. Used for authentication (magic-link login) and transactional service communications.
• Aggregated, anonymized usage data — collected via Vercel Analytics. This is non-personal: no cookies are set, no individual users are tracked, and no personal identifiers are stored. We receive only aggregate metrics such as page views and referral sources.

We do not collect payment information, personal addresses, phone numbers, or any other sensitive personal data during the current beta period.

2. How we use it

We use your email address to:

• Authenticate you and deliver magic-link sign-in emails
• Send transactional service notices (e.g., account changes, data updates)
• Respond to support or account requests you initiate

We will not send marketing or promotional emails without your explicit opt-in, in compliance with Canada's Anti-Spam Legislation (CASL).

Aggregated usage data is used solely to understand how the product is used and to improve it. It cannot be linked back to any individual.

3. Who we share it with

We do not sell, rent, or trade your personal information. We share it only with the following service providers who help us operate the platform:

• Resend — our transactional email provider. Your email address is passed to Resend solely to deliver sign-in links and service notices. Resend operates infrastructure in the United States.
• Vercel — our hosting and analytics provider. Vercel Analytics is privacy-first: it collects no personal data and sets no cookies. Vercel infrastructure is located in the United States.
• Railway — our database hosting provider. Your email address is stored in a PostgreSQL database hosted on Railway infrastructure located in the United States.

All providers are bound by data processing agreements and confidentiality obligations. No other third parties receive your personal information.

4. Cross-border data transfers

As noted above, Resend, Vercel, and Railway process data on infrastructure located in the United States. When your personal information is transferred outside Canada, it may be subject to the laws of that jurisdiction, including lawful access by US government authorities. We have taken steps to ensure appropriate contractual safeguards are in place with all three providers.

5. Public data

The building permit data displayed on Grover comes from the City of Calgary Open Data portal and is licensed under the Open Government Licence – City of Calgary. This is publicly available information. We do not collect it from users, and it contains only project and contractor information from public municipal records — not personal information about private individuals.

6. Data retention

We retain your email address for as long as your account is active. If you request account deletion, we will remove your personal information within 30 days, except where retention is required by law.

Vercel Analytics data is aggregated and non-personal; it is retained per Vercel's standard retention policy.

7. Security

We implement industry-standard safeguards including encryption in transit (TLS), encrypted database storage, and strict access controls. Only authorized personnel can access personal information, and only to the extent required for their role.

No system is completely secure. While we take reasonable precautions, we cannot guarantee the absolute security of your information.

8. Your rights

Under Alberta PIPA, you have the right to:

• Know what personal information we hold about you
• Request a correction if it is inaccurate or incomplete
• Request deletion of your personal information
• Withdraw consent to collection or use, subject to legal or contractual restrictions

To exercise any of these rights, email us at support@groverdata.ca with "Privacy Request" in the subject line. We will respond within 30 days.

9. Data breach notification

If a breach of personal information occurs that poses a real risk of significant harm, we will notify affected individuals and the Office of the Information and Privacy Commissioner of Alberta as required by PIPA, without unreasonable delay.

10. Changes to this policy

This product is currently in beta. We may update this Privacy Policy as the product evolves. Material changes will be communicated via email to registered users before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

Questions, concerns, or requests regarding this policy should be directed to:

If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta.