This summary is for convenience. The rest of this Policy governs.
2570211 Ontario Inc. o/a Permit.ca (“Permit.ca”, “we”) operates permit.ca and related applications (the “Platform”), a network connecting people with building projects (“Clients”) to licensed building professionals (“Vendors”).
This Policy explains how we handle personal information under Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and applicable provincial privacy law.
It does not cover how a Vendor handles your information after you engage them. A Vendor is a separate business and an independent controller of what you give it — ask the Vendor for its own privacy policy.
Questions, requests and complaints: privacy@permit.ca.
From you:
| Category | Examples |
|---|---|
| Account | Name, email, phone, password, role, communication preferences |
| Project | Property address, project type, scope, budget range, timeline, photographs, drawings, surveys, municipal correspondence, permit numbers |
| Vendor profile | Business name, licence and authorization numbers, insurance certificates, business and GST/HST numbers, portfolio, service areas, rates |
| Communications | Messages, attachments, support tickets, and call recordings and transcripts |
| Reviews | Ratings, review text, responses |
Automatically: IP address, device and browser type, operating system, pages viewed, links clicked, approximate location from IP, and cookie identifiers.
From others: licence and standing data from regulators and public registers; insurance certificates from brokers; transaction and verification status from our payment provider; and limited attribution data from advertising partners.
Identity documents are collected and held by our payment provider as the regulated party. We receive confirmation of your verification status only — we do not receive or store your identification.
We collect, use and disclose personal information only for purposes a reasonable person would consider appropriate: running the network and matching projects to Vendors; verifying Vendor licences, authorizations and insurance; processing payments through our payment provider; maintaining the project record and supporting disputes; preventing fraud and abuse; customer support; meeting legal, tax and regulatory obligations; improving the Platform; and marketing, subject to Section 11.
We obtain consent at or before collection. Consent may be express, or implied by your use of the Platform. We seek express consent for identity verification, call recording, and marketing messages.
You may withdraw consent at any time, subject to legal and contractual restrictions, by emailing privacy@permit.ca. We will explain what that means — usually that we can no longer provide the Platform to you. Withdrawal does not affect processing already carried out, information we must keep by law, or information needed to complete or defend a transaction you have already entered into.
We will not use your personal information for a materially different purpose without telling you and, where required, obtaining your consent.
Calls placed or received through the Platform are recorded, automatically transcribed, and stored as part of the project record. We do this so that what was agreed can be checked later, to support dispute resolution, and to detect fraud and abuse.
An audible notice plays at the start of every call, and continuing the call is your consent. If you would rather not be recorded, use Platform messaging instead — it is not audio-recorded. If any participant objects, end the call and continue in writing.
You must not separately record a Platform call without the other participants’ knowledge, and must not use any recording or transcript for anything other than the project.
We use automated systems, including machine learning, to match projects to Vendors, summarize long threads and transcripts, and flag risk. No decision with a legal or similarly significant effect on you is made solely by automated means — a person reviews account suspensions, Vendor removals and dispute outcomes before they take effect. You can ask for human review at privacy@permit.ca.
Between Users. A Vendor sees your name, project details, documents, messages and approvals. Vendors do not receive your direct phone number or email address — they reach you through the Platform. Once you engage a Vendor, they will necessarily learn your contact details and property address in order to do the work.
Service providers, to operate the Platform: cloud hosting, our payment provider, telephony and transcription, identity and fraud prevention, email, analytics and advertising measurement, support and e-signature. They may only process personal information on our instructions, under contracts requiring comparable protection.
Regulators and authorities, where required by law, court order or other lawful demand, or to report suspected unlicensed practice or professional misconduct.
The Canada Revenue Agency. Like every network in Canada, we are required by law to report Vendor earnings annually and to give the Vendor the same statement.
Marketing and referral partners, where you ask to be introduced to one — and only the information needed to make that introduction.
Professional advisors, and a buyer or investor in connection with a financing, merger or sale of our business, under confidentiality obligations.
We may also disclose where necessary to protect someone’s safety, to prevent fraud, to establish or defend legal claims, or with your consent.
Some of our service providers store or process personal information outside Canada, including in the United States. While it is there, it is subject to that country’s laws, and courts, law enforcement and government authorities there may be able to obtain access to it. We protect it contractually and technically, but we cannot override foreign legal process. By using the Platform you acknowledge this.
We keep personal information only as long as needed for the purposes in Section 4 and to meet our legal obligations. Account, project and transaction records are generally kept for seven years, as tax and corporate law require. Where a dispute or claim is open or reasonably expected, we keep relevant records until it is resolved. After that we securely delete or anonymize.
We protect personal information with safeguards appropriate to its sensitivity, including encryption in transit and at rest, least-privilege access controls, logging, staff confidentiality obligations and secure deletion. No system is perfectly secure and we cannot guarantee absolute security. If a breach creates a real risk of significant harm to you, we will report it to the Privacy Commissioner of Canada and notify you as soon as feasible.
You may ask us to give you access to the personal information we hold about you, correct anything inaccurate, delete it, or provide it in a portable format. You may also withdraw consent, object to a particular use, or ask for human review of an automated decision.
Email privacy@permit.ca. We may ask you to verify your identity, and we respond within 30 days, free of charge in most cases. If we refuse, we will tell you why in writing.
We may not be able to give you information that would reveal another person’s personal information, that is subject to legal privilege, or that we are required to keep.
We use cookies that are strictly necessary (these cannot be turned off), plus functional, analytics and advertising cookies. We use third-party analytics and advertising tools, including Google and Meta technologies, which set their own identifiers and are governed by their own privacy policies. Manage non-essential cookies through our cookie banner or your browser settings.
We send commercial email only with your express consent, or where consent is implied under Canada’s anti-spam legislation. Every commercial message has a working unsubscribe, actioned within 10 business days. Service messages — quote notifications, approvals, payment confirmations, security alerts — are not marketing and continue regardless.
The Platform is not directed at anyone under 18 and we do not knowingly collect personal information from anyone under 18.
We may update this Policy. The current version is always posted here with its effective date. For material changes we give at least 30 days’ notice by email and in-Platform, and where a change involves a new purpose requiring consent, we will obtain it.
If you are not satisfied with how we have handled your personal information, contact privacy@permit.ca first. If we do not resolve it, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376), or to your provincial privacy regulator if you are in Alberta, British Columbia or Quebec.
This Policy is drawn in English. Les parties ont exigé que la présente politique soit rédigée en anglais.
© 2026 2570211 Ontario Inc. o/a Permit.ca · 290 Caldari Rd, Concord, ON L4K 4J4
