Privacy Policy

1. Information We Collect

We collect the following categories of information to operate and improve the Service:

• Account Information: When you sign up, we collect your name, email address, company name, and role. Email verification is required to access certain features, including free trials and paid subscriptions.
• Project Data: Information you enter into the Service, including land addresses, project names, zoning inputs, massing configurations, financial assumptions, and proforma data.
• Usage Data: We automatically collect data on how you interact with the Service, including pages visited, features used, session duration, and browser/device metadata.
• Authentication & Audit Events: We maintain audit logs of sign-ins, password changes, data exports, account deletions, and billing events for security and compliance purposes.
• Payment Information: Billing details are collected and processed directly by Stripe. We store only the Stripe customer and subscription identifiers — we do not store card numbers on our servers.

2. How We Use Your Information

• Provide, maintain, and improve the Service, including generating massing visualizations, financial projections, and zoning summaries.
• Process payments, manage subscriptions, and handle free trials.
• Send transactional emails (welcome, email verification, billing, security alerts, trial reminders, and unlock confirmations).
• Detect, prevent, and respond to fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms of Service.

3. Third-Party Service Providers

We use the following third-party processors to operate the Service. Each receives only the data necessary for its function and is contractually bound to protect your information. We do not sell your personal data, and we do not share it with advertising networks.

• Firebase & Google Cloud (US): Authentication, database (Firestore), file storage, and hosting.
• Stripe (US): Payment processing and subscription management. Card details are collected and stored by Stripe; we do not receive or store card data.
• PostHog (US): Product analytics. When you are signed in, PostHog receives your user ID, email, and plan type to attribute usage events to your account.
• Sentry (US): Error and performance monitoring. Error reports may include your user ID, email, and technical details of failures for debugging.
• Resend (US): Transactional email delivery for welcome, verification, billing, and support messages.
• Google Gemini (Google AI, US): AI features include massing optimization, zoning summary narration, render generation in the Rendering Studio, and proforma assistance. Site polygons, zoning inputs, and project metadata may be sent to Google's Gemini API for processing. We do not use your data to train AI models.

User-Directed Sharing:If you choose to share a project via a public link ("Share Token"), any information contained within that project will be accessible to anyone who possesses the link. You are responsible for managing the distribution of these links.

4. Data Location & Cross-Border Transfers

Your personal data is processed and stored primarily on servers located in the United States via Firebase and Google Cloud. The other third-party processors listed in Section 3 also operate from the United States. If you are located in Canada, the European Union, or elsewhere, you acknowledge and consent that your personal information may be transferred to, stored in, and processed in the United States or other countries where these providers operate. We rely on appropriate safeguards, including contractual commitments from our processors, to protect data in transit and at rest.

5. Data Retention

We retain your personal data only for as long as necessary to provide the Service and comply with our legal obligations:

• Active accounts: Retained for the duration of your account.
• Free trial without subscription: If you do not subscribe after your 7-day free trial ends, your project data will be retained for 30 days from trial expiry and then permanently deleted.
• Account deletion: Upon deletion of your account, your personal data and project data are removed from our production systems. Residual copies may persist in backup systems for up to 90 days before being purged. Design-Suite Unlocks are tied to the project and the owning user account; deleting your account removes the unlock record.
• Audit logs: Security and billing audit logs are retained for up to 12 months for fraud prevention and compliance purposes.
• Legal obligations: We may retain certain records for longer periods where required by law (e.g., tax or accounting records).

6. Your Rights

Depending on your jurisdiction — including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the European Union's General Data Protection Regulation (GDPR) — you may have the following rights regarding your personal information:

• Access & Portability: Request a copy of your personal data in a machine-readable format.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (the "Right to be Forgotten").
• Objection & Restriction: Object to or restrict certain processing activities.
• Withdrawal of Consent: Withdraw previously given consent for optional processing.

How to Exercise Your Rights: You can export a full copy of your account data and delete your account directly from Settings → Profile within the application. For other requests — including access, correction, or questions about your rights — contact us at the email address in Section 11. We will respond within the timeframes required by applicable law.

7. Cookies and Tracking

We use cookies and similar technologies in two categories:

• Essential Cookies: Required for the Service to function, including authentication (__session) and user preferences. These cannot be disabled if you use the Service.
• Analytics Cookies: Optional. Used by PostHog to gather usage data that helps us improve the Service.

You can manage your cookie preferences at any time using the Cookie Settings link in the footer of any page. Rejecting analytics cookies will not affect your ability to use the Service.

8. Security & Breach Notification

We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS), encrypted data storage, authenticated API access, and restricted administrative access. While no system is completely secure, we continually review and improve our practices.

In the event of a personal data breach that is reasonably likely to create a risk of significant harm, we will notify affected users and the relevant regulatory authorities — including the Office of the Privacy Commissioner of Canada where required by PIPEDA — without undue delay.

9. Children's Privacy

The Service is not intended for users under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by email at least 30 days before the changes take effect. Continued use of the Service after the effective date constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

• Email: [email protected]
• Website: darkhorsematrix.com
• Entity: Dark Horse Matrix Inc., Winnipeg, Manitoba, Canada