Privacy Policy

Last updated: 11 September 2026

Draft, not reviewed by a lawyer

This document was written to reflect how the software actually works and to cover the obligations a small Canadian software business would normally address. It has not been reviewed by a lawyer, and it should be before this company takes on a material customer. If you are relying on this for anything, talk to us first.

Most of what you put into Sitka is personal information about other people, which makes this document more important than the usual boilerplate. It describes what the software actually does today, verified against the code, rather than what a privacy policy usually says.

1.Who this policy is from, and who is responsible for what

Sitka Systems is a product of Brendan Jones, carrying on business as Orca Jones, a sole proprietorship based in British Columbia, Canada. This policy covers the Sitka Systems website and application. In it, "we" and "us" mean that business, and "you" means the brokerage, team, or agent using the service.

Canadian privacy law splits the responsibility here, and the split matters, so it is worth being clear about it before anything else.

For your own information (your name, your login, your billing, your support requests) we are the organization responsible. This policy is our commitment to you about it.
For information about your clients that you enter or upload, you are the organization responsible and we handle it on your behalf, under your instructions, to run the features you use. If one of your clients asks what is held about them, that question is yours to answer, and we will help you answer it.

We are subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, for our British Columbia customers, the BC Personal Information Protection Act (PIPA). Our commercial email is subject to Canada's Anti-Spam Legislation (CASL).

If your workspace needs a signed contract governing our processing of your clients' personal information, rather than just this policy, that is our Data Processing Agreement. Our Security page describes how we detect and respond to a breach.

2.What we collect

Account and profile. Your email address, your password (stored only as a hash, by our authentication provider, never in a form we can read), and your display name. If you sign in with Google, we receive the email address on that Google account.

Workspace. Your brokerage or team name, the market you work in, your website address, a logo if you upload one, and a free-text description of how your brokerage writes, which is fed into the AI prompts so generated copy sounds like you.

Client records that you enter. This is the largest category, and it is personal information about other people. The fields the product provides are:

Name, email address, phone number, and mailing address
Whether they are a buyer or a seller, their budget range, the neighbourhoods they are interested in, and their preferred way of being contacted
A spouse or partner name, a date of birth, and an anniversary date, if you choose to record them
How they were referred to you, free-text notes, tags, and when you last contacted them

Listings and activity. Property addresses and details, price history, and showing records.

Files you upload. Strata documents, contract PDFs, and listing photographs. What happens to each is different, and section 5 sets it out tool by tool.

Generated output. The emails, reports, listing descriptions, strata risk summaries, and staged photos the product produces for you, plus your contextual assistant conversations. Assistant conversations are personal to your seat and are not visible to your workspace admins.

Billing. A customer reference and a subscription reference from Stripe, your subscription status, and the relevant dates. We never receive or store your card number, expiry, or security code. Stripe holds those.

Connected email account. If you connect Google to send from your own address, we store the email address of that account and the access tokens, encrypted. We do not store, and cannot read, anything in your inbox.

Support requests. The email address on your seat, the subject and messages of your ticket, and which page of the app you were on when you asked for help.

Enquiries from our website. If you fill in the early-access form on our home page, we store your name, email address, your message, and, to guard against abuse of a public form, the IP address and browser user agent the submission came from.

Logs. Every write to workspace data is recorded in an audit log: who did it, what changed, when, the IP address it came from, and a short description. Every AI call is recorded in a usage log: which seat, which tool, which model, token counts, and cost. These logs are our operating records rather than your content, and they are append-only by design, so neither we nor you can quietly edit them after the fact.

3.Why we use it

We use the information above to do the things you are here for, and not for other things:

To run the features you use, including sending what you write and approve to your clients
To authenticate you and keep one workspace's data separate from every other one
To meter AI usage against your allowance and to bill you correctly
To answer your support requests
To keep an audit trail, detect abuse, and investigate security incidents
To email you about your account, your billing, and material changes to the service
To meet legal and tax obligations

Our lawful basis under PIPEDA and PIPA is your consent, given when you create an account and accept these documents, together with the reasonable purposes of operating a service you have asked for.

4.What we do not do

We do not sell your personal information, or your clients', to anyone, ever.
We do not use your data, or your clients', to train AI models. Our AI provider's commercial terms mean the content you send is not retained beyond generating your response and is not used to train their models.
We do not use your workspace data to build a shared or cross-brokerage dataset, or to improve the product for anyone other than you.
We do not read your inbox. The access we request from Google is send-only.
We do not run advertising trackers, and we do not have a third-party analytics tool watching what you click.

5.Files: what is deleted straight away, and what is kept

This is the question we get asked first, so here it is tool by tool rather than as one blanket sentence.

Strata documents. Your PDFs are uploaded to temporary storage, sent to our AI provider for analysis, and then deleted from both places as soon as the analysis finishes. That deletion runs on every path, including when the analysis fails partway through. What is kept afterwards is the risk report itself, in your workspace, until you delete it. The original documents are not kept.

Listing photographs. Photos you attach when generating listing marketing are sent straight through with the request and are never written to storage at all. When the request finishes, they are gone.

Virtual staging. The photo you upload is held in temporary storage, sent to our image provider, and deleted from our temporary storage once the image comes back, whether it succeeded or failed. The staged image that comes back is kept in your workspace, in a private bucket, until you delete it. Every staged image carries a disclosure watermark composited into the pixels themselves, so it cannot be removed by editing a caption. See the caveat about the image provider in the next section.

Contract PDFs. These are different, and deliberately so: a contract you are working on is kept. The original PDF is stored in a private bucket and is never overwritten, your annotations are stored separately from it, and each export is written to a new file so an earlier one is never destroyed. It stays there until you delete it.

Tenant logos. Kept, in a private bucket, until you replace or remove them.

Files in private buckets are reachable only through short-lived signed links generated for a signed-in seat on the workspace that owns them. They are not public URLs.

6.The service providers we use

Running Sitka means some information passes through other companies. These are all of them, what they see, and why.

Anthropic, for AI text generation and document analysis. Sees the prompt content for the feature you are using: client and listing details for reports, strata PDFs for analysis, listing details and photos for marketing copy, and whatever your assistant queries touch. Under their commercial terms this content is not used to train models.
Leonardo.ai, for virtual staging image generation. Sees the room photograph you upload and the styling instruction.
Supabase, for the database, authentication, and file storage that hold your workspace.
Vercel, for hosting the application and for the temporary storage that uploads pass through.
Stripe, for payments. Sees your billing and card details directly. We do not.
Resend, for outgoing email sent from our own address, which is the fallback when you have not connected your own Google account.
Google, if you choose to connect an account for sending, or to sign in with Google.

Virtual staging works by uploading your source photo to our image provider and downloading the edited result. When that finishes - whether it succeeded or failed - we delete both the photo we uploaded and the generated result from their servers, and we delete our own temporary copy. We keep the finished image, because it is yours; we do not leave your original sitting on a third party's system.

Draft note: the deletion described above is what our software does, and it has been implemented. What remains to be confirmed against the provider's own terms is how long a deleted item persists in their backups after the deletion call, and that sentence may need a qualifier once we have their answer in writing.

Most of these providers operate outside Canada, principally in the United States, which means your information and your clients' may be stored or processed there and may be accessible to foreign courts and authorities under the laws of those countries. Our own database and file storage are hosted in Canada (ca-central-1) and the application runs in the United States (Vercel's default region).

We will keep this list current, and it appears again, in the same form, in our Data Processing Agreement. If we add or change a sub-processor that handles personal information, we will give at least 30 days notice by updating that page and emailing your account address, so you have a real chance to object before the change takes effect.

7.How we protect it

Every workspace's data is separated at the database level by row-level security, not by application code remembering to filter. A query made on behalf of one workspace cannot return another workspace's rows.
The whole application sits behind an authentication check that runs before any page or route handler, and the session is revalidated against the authentication provider on every request rather than trusted from a cookie.
The credentials we hold on your behalf, meaning your Google send tokens, are stored encrypted in a managed secrets vault. They are never in a plaintext column and never in an environment variable.
Uploaded files live in private buckets scoped to the owning workspace, reachable only through short-lived signed links.
Card details never touch our systems.
Every write to workspace data is recorded in an append-only audit log.

No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that creates a real risk of significant harm, we will report it as PIPEDA and PIPA require and tell the people affected. Our Security page describes that process in more detail, and how to report a vulnerability.

8.Who at Sitka can see your data

We think you should know this rather than have to infer it. A small number of named operator accounts can reach workspace data across the whole platform, so that support requests can actually be answered, billing problems can be diagnosed, and the service can be kept running. That access is limited to an explicit list of people, not granted by a role anyone can assign themselves.

We use it for support, billing, security, and legal obligations, and not for anything else. We do not browse your client records out of curiosity, and access leaves a trail.

The people who currently hold that access are named at legal@sitkasystems.ca on request.

9.How long we keep it

Your workspace content is kept for as long as your workspace exists, and until you delete it. Nothing expires on its own while you are a customer.

When a subscription is cancelled there is a grace period of 30 days during which everything is retained and remains exportable. After that, access ends.

You can ask for the whole workspace to be deleted at any time, from the data settings page in the app. The request is scheduled rather than immediate, so you can cancel it if it was a mistake, and we run the deletion itself by hand: it removes your database records, your stored files across every bucket, and the encrypted tokens for any connected email account, and it cannot be undone once it has run.

Some categories have their own timelines:

Audit and usage logs, which are our operating records: kept for 24 months.
Support tickets and their messages: kept for 24 months.
Enquiries from the website form, including the IP address recorded with them: kept for 24 months.
Billing records, which we are required to retain for tax purposes: kept for seven years, as required by Canadian tax law.
Backups: overwritten on a rolling 30 days cycle, which means deleted data can persist in a backup for that long after deletion.

These periods are enforced by a job that runs every night, not just stated here. It deletes rows past their cutoff and reports what it did; a permissions problem on one table does not stop it from running the others.

Draft note: one thing is deliberately NOT automated. When a workspace's grace period ends, the platform reports it as due for deletion rather than purging it itself. A person still has to run that step. An irreversible cascade across every table and every stored file for a whole workspace is the kind of action we want a human to confirm, not one that fires unattended from a nightly job.

10.Your rights, and how to use them

You can:

Ask what personal information we hold about you and get a copy of it.
Export your clients and listings to CSV yourself, from inside the app, whenever you like and without asking us.
Have information corrected if it is wrong. Most of it you can edit directly.
Ask us to delete your workspace and the data in it, from the data settings page in the app.
Withdraw your consent to our using your information, understanding that for most of it, withdrawing consent means we can no longer provide the service.
Complain if you think we have got this wrong.

To do any of these, email legal@sitkasystems.ca or open a support ticket in the app. We will respond within 30 days, which is the limit PIPEDA sets, and usually much sooner. Deletion requests are confirmed in writing once they are done.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or, in British Columbia, to the Office of the Information and Privacy Commissioner for BC. You do not need our permission to do that, and we would rather you did it than stayed unhappy.

11.Cookies and tracking

Sitka uses very few cookies, and all of them are functional.

Session cookies set by our authentication provider, which are what keep you signed in.
A small marker cookie recording that you have visited the site before, so a returning visitor is taken to the sign-in page rather than the full marketing page again.

There are no advertising cookies, no third-party analytics, no tracking pixels, and no cross-site tracking of any kind. Your theme preference is stored in your own browser and never reaches us.

13.Changes to this policy

We will update this page as the product changes, and the date at the top will always tell you when the words last changed. For a change that materially affects how we handle personal information, we will email your account address before it takes effect rather than relying on you to notice.

14.How to reach us

Our privacy contact is Brendan Jones, reachable at legal@sitkasystems.ca, or by post at 4210 Almondel Road, West Vancouver, British Columbia, Canada. PIPEDA and PIPA both require an organization to name an individual accountable for privacy compliance, so this is a person, not a shared inbox with nobody behind it.

For questions about the agreement rather than about privacy, see the Terms of Service. To report a security vulnerability, email legal@sitkasystems.ca or see our Security page. For prohibited uses of the product, see the Acceptable Use Policy.