Cet avis n'est offert qu'en anglais pour le moment.
[brackets] are completed by the authority having jurisdiction (AHJ) before publication. It is provided for review, not as a final published policy. It is drafted to align with PIPEDA and Yukon's ATIPP Act (public-body personal information); the AHJ should confirm the correct legal basis for its jurisdiction.Dernière vérification par rapport à la plateforme : 2026-08-19.
[Authority having jurisdiction] uses CACCP, a building-permit code-compliance platform, to review permit applications. This notice explains what personal information we collect when you use it, why, who can see it, and the choices and rights you have.
In short: We collect your account details, your project's address, and the drawings you upload, so a human reviewer can check your application against the building code and record a decision. Your data is stored in Canada. We do not sell your data or use it for advertising. Approval is always made by a person, never automatically.
| Information | Examples | Why we need it |
|---|---|---|
| Account details | Name, email, password | Create your account and sign you in securely |
| Project details | Property address, municipality, permit type | Identify the property and application under review |
| Uploaded drawings | The files you submit | They are the subject of the code review; may contain your name/address or a designer's stamp |
| Building facts | Dimensions, areas you enter or confirm | The inputs the code rules are checked against |
| Technical/security | Your IP address (security log) | Protect the service against abuse; audit trail |
We do not collect your Social Insurance Number, government ID numbers, payment-card numbers, date of birth, or any health or biometric information.
Findings are produced by a deterministic rules engine, but every approval, refusal, or override is made and recorded by a human reviewer — no decision about your application is made automatically.
Your data is stored in Canada [region: Quebec]. Traffic is encrypted in transit (HTTPS/TLS), and passwords are stored only as secure one-way hashes — never in plain text.
One exception, while you type an address: the address-suggestion service we currently use is an open-data service hosted outside Canada, so the address text you type in that one field is sent abroad to fetch suggestions (see section 5). Everything else — your account and your application, and your drawings unless you use AI extraction (section 5) — stays in Canada. You can skip this by typing the address manually without using a suggestion.
| Service | What it receives | Status |
|---|---|---|
| Bot protection (Cloudflare Turnstile) | Would send your IP address and a challenge token, to confirm you're not an automated bot | Not in use — we send nothing to Cloudflare for bot protection. If we ever turn it on, we will update this notice. |
| Automated drawing reading (AI extraction) | The PDF drawings in the submission | In use — only when you press "Extract facts from drawings" on a project. The PDF drawings in that submission are then sent to Anthropic's AI service to read building facts from them, and may be processed outside Canada, including in the United States. Nothing is sent unless you press that button, and you can type the facts yourself instead. The facts it suggests are never saved until you review and save them. |
| Address lookup (OpenStreetMap / Nominatim — open data) | The partial address or postal code you type in the address field | In use — used only to suggest civic addresses as you type. This is a free, public open-data service hosted outside Canada, so the address text you type (and your request's IP) leaves the country. It receives *only* what you type in that field — never your drawings, account details, or application content. Nothing is sent until you type at least 3 characters, and the address field can be filled in manually instead. |
| Address lookup (Canada Post AddressComplete) | The partial address or postal code you type in the address field | Planned replacement — a licensed, Canadian-hosted address service. Once configured it supersedes the open-data service above and keeps address lookups in Canada; we will update this notice when that happens. |
| Email notifications | Your email and name (in notification emails) | [In use / Not in use — currently in-app only] |
We keep your application information for [retention period — per the AHJ's records-retention schedule]. Because permit records are a legal record, some information may be retained after your application is complete. Security-log and audit entries are kept for [audit retention period].
The platform uses a single essential session cookie to keep you signed in securely (it is HTTP-only and cannot be read by scripts). We do not use advertising or cross-site tracking cookies.
We protect your information with encryption in transit (TLS), hashed passwords, role-based access control, session controls that can revoke access immediately, and an append-only audit log. If a breach affecting your information occurs, we will respond and notify you as required by law.
Privacy Officer, [Authority having jurisdiction]
[email] · [phone] · [mailing address]
Version [1.0] · En vigueur le [date] · Retour à l'inscription