Note for Users: This Privacy Policy describes how FeasibL (published by Dark Horse Matrix Inc.) collects, uses, and protects your information. By using our platform, you agree to the data practices described in this policy.

1. Information We Collect

We collect the following categories of information to operate and improve the Service:

Account Information: When you sign up, we collect your name, email address, company name, and role. Email verification is required before you can buy a project.
Project Data: Information you enter into or upload to the Service, including land addresses, project names, zoning inputs, massing configurations, drawings you import (such as DXF floor plans), financial assumptions, proforma data, and the renderings you generate.
Workspace Data: If you create or join an organization workspace, its name, its members and their roles, and the invitations sent. Members of a workspace can see the projects that belong to it.
Access Tokens: If you create a personal access token or connect an AI application, we store a one-way hash of the token (never the token itself), its label, and when it was created and last used.
Usage Data: We automatically collect data on how you interact with the Service, including pages visited, features used, session duration, and browser/device metadata.
Authentication & Audit Events: We maintain audit logs of sign-ins, password changes, data exports, account deletions, and billing events for security and compliance purposes.
Payment Information: Billing details are collected and processed directly by Stripe. We store only the Stripe customer and checkout identifiers and a record of what you bought — we do not store card numbers on our servers, and no card is kept on file for future charges.

2. How We Use Your Information

Provide, maintain, and improve the Service, including generating massing visualizations, financial projections, and zoning summaries.
Process payments, calculate applicable sales tax from your billing address, and keep track of the projects and credits your account holds.
Send transactional emails (welcome, email verification, receipts, security alerts, expiry reminders, and purchase confirmations).
Detect, prevent, and respond to fraud, abuse, and security incidents.
Comply with legal obligations and enforce our Terms of Service.

3. Third-Party Service Providers

We use the following third-party processors to operate the Service. Each receives only the data necessary for its function and is bound by its terms of service and data-processing commitments to protect your information. We do not sell your personal data, and we do not share it with advertising networks.

Firebase & Google Cloud (US): Authentication, database (Firestore), file storage, and hosting.
Stripe (US): Payment processing and sales-tax calculation. Your billing address is provided to Stripe so it can determine the correct GST/HST and provincial tax. Card details are collected and stored by Stripe; we do not receive or store card data.
PostHog (US): Product analytics. When you are signed in, PostHog receives your user ID and email to attribute usage events to your account.
Sentry (US): Error and performance monitoring. Error reports may include your user ID, email, and technical details of failures for debugging.
Resend (US): Transactional email delivery for welcome, verification, billing, and support messages.
Google Gemini (Google AI, US): Used for render generation in the Rendering Studio, AI edits to map imagery, and reading a plain-language program description into a set of uses. Images of your massing or site, the prompt or description you write, and the uses your zoning district permits may be sent to Google's Gemini API for processing. The zoning analysis, massing and financial model do not use AI and are not sent to it. We do not use your data to train AI models.
Google Maps Platform (US): Address search, geocoding, and map imagery. The addresses you search for and the map areas you view are sent to Google.
Cloudflare (US): Network security, bot protection, and aggregate traffic measurement for our website. Cloudflare processes your IP address and request metadata.

Public Data Sources: To build a site's context, we query public open-data services with the site's location — the City of Winnipeg Open Data portal (parcels, zoning, streets), OpenStreetMap servers (surrounding buildings and roads), and Natural Resources Canada (terrain). These queries carry map coordinates only, never your name, email, or financial assumptions. These are public services rather than our processors, and some OpenStreetMap servers are located in Europe.

User-Directed Sharing: If you choose to share a scenario's binder via a link ("Share Token"), the information in that binder — including its financials and renderings — will be accessible to anyone who possesses the link, without signing in, until the link expires 15 days after it is created. You are responsible for managing the distribution of these links.

Connected AI Applications: If you connect an AI application (for example through an access token or a connector), that application can read your projects on your behalf, read-only and limited to what your account can see. What it reads is then handled by that application's provider under its own privacy policy. You can revoke access at any time in Settings → Agent access.

4. Data Location & Cross-Border Transfers

Your personal data is processed and stored primarily on servers located in the United States via Firebase and Google Cloud. The other third-party processors listed in Section 3 also operate from the United States. If you are located in Canada, the European Union, or elsewhere, you acknowledge and consent that your personal information may be transferred to, stored in, and processed in the United States or other countries where these providers operate. We rely on appropriate safeguards, including contractual commitments from our processors, to protect data in transit and at rest.

5. Data Retention

We retain your personal data only for as long as necessary to provide the Service and comply with our legal obligations:

Active accounts: Retained for the duration of your account.
Unused projects: A project you have bought but not yet started expires one year after purchase. Projects you have started are kept for the life of your account.
Account deletion: Upon deletion of your account, your personal data and project data are removed from our production systems. Residual copies may persist in backup systems for up to 90 days before being purged. A purchased project is tied to the project record and the owning account; deleting your account removes it.
Audit logs: Security and billing audit logs are retained for up to 12 months for fraud prevention and compliance purposes.
Legal obligations: We may retain certain records for longer periods where required by law (e.g., tax or accounting records).

6. Your Rights

Depending on your jurisdiction — including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the European Union's General Data Protection Regulation (GDPR) — you may have the following rights regarding your personal information:

Access & Portability: Request a copy of your personal data in a machine-readable format.
Correction: Request correction of inaccurate or incomplete data.
Deletion: Request deletion of your personal data (the "Right to be Forgotten").
Objection & Restriction: Object to or restrict certain processing activities.
Withdrawal of Consent: Withdraw previously given consent for optional processing.

How to Exercise Your Rights: You can export a full copy of your account data and delete your account directly from Settings → Profile within the application. For other requests — including access, correction, or questions about your rights — contact us at the email address in Section 11. We will respond within the timeframes required by applicable law.

7. Cookies and Tracking

We use cookies and similar technologies in two categories:

Essential Cookies: Required for the Service to function, including authentication (__session) and user preferences. These cannot be disabled if you use the Service.
Analytics Cookies: Optional. Used by PostHog to gather usage data that helps us improve the Service.

You can manage your cookie preferences at any time using the Cookie Settings link in the footer of any page. Rejecting analytics cookies will not affect your ability to use the Service.

8. Security & Breach Notification

We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS), encrypted data storage, authenticated API access, and restricted administrative access. While no system is completely secure, we continually review and improve our practices.

In the event of a personal data breach that is reasonably likely to create a risk of significant harm, we will notify affected users and the relevant regulatory authorities — including the Office of the Privacy Commissioner of Canada where required by PIPEDA — without undue delay.

9. Children's Privacy

The Service is not intended for users under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by email at least 30 days before the changes take effect. Continued use of the Service after the effective date constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

Email: [email protected]
Website: darkhorsematrix.com
Entity: Dark Horse Matrix Inc., Winnipeg, Manitoba, Canada