This Privacy Policy explains how StormQuote Pro (“we,” “us,” “our”) collects, uses, shares, and protects your personal information when you use the StormQuote Pro mobile application (Android, distributed through Google Play) and the StormQuote Pro web application at stormquote.ca/app (together, the “App” or “Service”).
StormQuote Pro is a concrete estimating tool for contractors and do-it-yourself users in Canada. It is operated by Steven Litwin, operating as Buffalo Beaver Storm Concrete (BBSC), a sole proprietor based in Vegreville, Alberta, Canada.
This policy applies to all users of the App. By creating an account or using the Service, you agree to the collection and use of information as described here. This policy is written to comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Alberta law, and to meet the privacy-disclosure requirements of the Google Play Developer Program and the Intuit / QuickBooks Online Developer Platform.
We collect only the information needed to run the Service. The categories are:
When you enter your customers’ personal information (such as a customer’s name and address) into a quote, you are responsible for having the right to provide that information. In that situation you are the party accountable to your own customers for their information; we process it only to provide the App to you.
We use your information to:
We do not use your data for advertising, and we do not sell your personal information to anyone.
Under PIPEDA, we collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate, and only with your knowledge and consent. We identify our purposes for collection at or before the time we collect your information, consistent with PIPEDA’s Identifying Purposes and Consent principles. By creating an account and using the App, you consent to the collection and use of your information for the purposes described in this policy. Where we rely on service providers (Section 5), we do so to deliver the Service you requested.
You may withdraw your consent at any time by closing your account (see Section 9), subject to legal and contractual limits. Withdrawing consent may mean we can no longer provide the Service. PIPEDA does not require a specific “legal basis” the way the EU GDPR does; our lawful purpose is to provide and operate the Service you signed up for.
We do not sell your data. We share it only with the service providers needed to operate the Service. Each provider receives only the information needed for its specific function and is required to protect it. Our sub-processors are:
Stripe collects and processes your payment-card details and billing information directly to handle subscription payments and free trials. We never receive or store your full card number — we store only a Stripe customer ID and your plan/trial status. Stripe acts as our data processor for payments and processes data in the United States. Stripe is certified annually by an independent PCI Qualified Security Assessor as a PCI Service Provider Level 1 — the most stringent level of certification available in the payments industry. You can review Stripe’s privacy policy at stripe.com/privacy.
If you choose to connect QuickBooks, we use Intuit’s OAuth 2.0 authorization flow. With your authorization, the App pushes estimate data into your own QuickBooks Online company file. The data sent to Intuit for this purpose includes: customer name, customer phone, customer email, job-site address / memo, line items, amounts, and tax information. The App only creates and queries the customers, items, and estimates needed for this feature; it does not access any other QuickBooks data. We store the OAuth access and refresh tokens (tied to a device ID) needed to maintain the connection, and we protect them with the safeguards in Section 8. You can disconnect QuickBooks at any time (see Section 9); disconnecting revokes the App’s access tokens and stops further data exchange with Intuit. Your use of QuickBooks is also governed by Intuit’s own privacy statement.
We use PostHog to track the usage events listed in Section 2(e) so we can understand and improve the App. PostHog may process this data on US-based cloud servers (us.i.posthog.com; PostHog Cloud US is hosted on AWS in Virginia). You can opt out of analytics (see Section 9).
We use Brevo (an SMTP email service) to send transactional emails such as password-reset codes. We share your email address and the content of the transactional message. We do not currently send marketing emails. Brevo is operated by Sendinblue SAS, a French Simplified Joint Stock Company at 17 rue de Salneuve, 75017 Paris, France, with operations in the EU and the US.
Our backend (Node.js / Express server and SQLite database) runs on a Hostinger VPS. Hostinger provides the server infrastructure where your account and quote data are stored. The server is located in the United States.
We may also disclose information if required by law, to comply with valid legal process, or to protect our rights, our users, or the public — consistent with PIPEDA’s exceptions to consent.
Our business is based in Alberta, Canada, but some service providers store or process data outside Canada: Stripe processes payment data in the United States; PostHog may process analytics data in the United States; Brevo operates in the EU and US; and your account and quote data reside on a Hostinger VPS in the United States.
Under PIPEDA, transferring personal information to a service provider in another country is permitted, but we remain accountable for protecting your information and we use contractual and other means to require a comparable level of protection. While your information is in another country, it may be accessible to that country’s courts, law enforcement, and government authorities under that country’s laws. We disclose these transfers here in line with the Office of the Privacy Commissioner of Canada’s transparency guidance.
We keep your account information and saved quotes for as long as your account is active. We keep QuickBooks OAuth tokens only while your QuickBooks connection is active; when you disconnect, we revoke and delete those tokens. We retain certain billing and transaction records as needed to meet tax, accounting, and legal obligations even after account closure.
When you request deletion of your account (see Section 9), we delete your personal information from our active systems, except for information we are legally required to retain or that we need for legitimate purposes such as fraud prevention or dispute resolution.
We use reasonable technical and organizational safeguards appropriate to the sensitivity of the information, including:
No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. If we experience a breach of security safeguards that creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required by PIPEDA, and we will keep records of breaches as PIPEDA requires.
Under PIPEDA you have the right to ask what personal information we hold about you, how it is used, and to whom it has been disclosed, and to request corrections. Email us (Section 13). We will respond within 30 calendar days, as required by PIPEDA; in limited circumstances PIPEDA permits a single extension of up to 30 additional days, and we will tell you in writing within the first 30 days if an extension is needed. Access is provided free of charge.
You can request deletion of your account and associated data at any time by emailing privacy@stormquote.ca or by visiting stormquote.ca/delete-account. We will delete your personal data except where we must retain it for legal reasons (see Section 7).
You can disconnect your QuickBooks Online connection at any time using the disconnect option in the App, which revokes the App’s access tokens and stops any further data exchange with Intuit.
You can opt out of PostHog analytics tracking by contacting us at privacy@stormquote.ca.
You may withdraw consent to our collection and use of your information by closing your account, subject to legal and contractual limits.
If you have a privacy concern, contact us first (Section 13). If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) and, where applicable, the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).
StormQuote Pro is a professional construction and estimating tool. It is not directed at children and is not intended for anyone under 18. We do not knowingly collect personal information from minors. If we learn we have collected information from someone under 18, we will delete it.
The web app uses cookies and similar storage that are necessary for login sessions (JWT authentication) and core functionality. We use PostHog analytics, which may set a cookie or use similar storage to measure product usage and record the events listed in Section 2(e). We do not use third-party advertising cookies and we do not sell data to advertisers. You can control cookies through your browser settings, and you can opt out of analytics as described in Section 9.
We may update this policy from time to time. When we make material changes we will update the “Last Updated” date and, where appropriate, notify you in the App or by email. Your continued use of the Service after a change means you accept the updated policy.
If you have questions, requests, or complaints about this policy or your personal information, contact the person accountable for privacy at:
Privacy Officer: Steven Litwin
Operating as: Buffalo Beaver Storm Concrete (BBSC)
Email: privacy@stormquote.ca
Mailing Address: 5605 52 Street, Vegreville, Alberta, Canada T9C 1K1