Privacy Policy

SUCH A SOFTY is the organisation accountable for the personal information described here. Privacy requests go to support@suchasofty.org, which reaches our privacy contact.

Account information

Your name, email address and password (stored only as a secure hash). We need this to create your account, authenticate you, and send account and purchase emails. Legal basis: necessary to provide the service you asked for.

Questionnaire and roadmap answers

Your business type, stage, industry, province and goals, so we can generate your roadmap, software stack and recommended documents. Some of this is stored in your browser rather than on our servers.

Membership and payment information

Your plan, subscription status, trial dates, invoices and payment history. Card numbers never reach our servers — our payment processor collects and stores them directly. We receive non-sensitive records such as the last four digits, card brand, billing country, amount and invoice status so we can show your billing history and grant access.

Product analytics

Pages viewed, features used, and conversion events such as signup, checkout started and purchase completed, along with technical data such as device type, browser, approximate region derived from IP address, and a randomly generated visitor identifier. We use this to understand which parts of the product work and to fix what does not. Analytics only run once you accept them in the cookie notice.

Email delivery records

Whether an app email to you was sent, bounced, was refused, or was unsubscribed, so we can troubleshoot delivery and honour opt-outs.

Support correspondence

What you send us by email, kept so we can answer and keep a record of the resolution.

• We do not sell your personal information.
• We do not rent, trade or share your email list with advertisers or data brokers.
• We do not use your completed business documents or questionnaire answers to train AI models.
• We do not send you marketing email unless you separately opted in, and you can withdraw that at any time.

We use a small number of processors, each limited by contract to processing only for us. Personal information may be stored or processed outside Canada, including in the United States and the European Union, which means it can be subject to lawful access requests by courts and authorities in those countries.

• Cloud hosting, database and authentication — stores your account, roles and membership records.
• Payment processing — collects and stores card data, handles taxes, receipts, refunds and disputes.
• Transactional email delivery — sends account, purchase and access emails from our sender domain.
• Product analytics — records the usage and conversion events described above.
• Site delivery and security infrastructure — serves the site and protects it from abuse.

Strictly necessary cookies and local storage keep you signed in, remember your theme, hold your questionnaire answers and secure the checkout. These cannot be switched off without breaking the site.

Analytics storage is optional. We ask before enabling it, we do not load our analytics scripts until you accept, and you can change your mind at any time from the link in the footer. Declining does not limit your access to anything you have paid for.

• Account records: while your account is open, then up to 12 months after deletion in backups.
• Payment, invoice and tax records: 7 years, as required by Canadian tax and bookkeeping rules — these survive an account deletion request.
• Analytics events: up to 24 months.
• Email delivery logs: as retained by our email provider for troubleshooting, typically 30 days.
• Support email: up to 3 years.

Under PIPEDA you can ask us to:

• Tell you what personal information we hold about you and who we disclosed it to.
• Give you a copy of it.
• Correct anything inaccurate or incomplete.
• Delete your account and associated personal information, subject to records we must keep by law.
• Withdraw consent for analytics or marketing email at any time.

Email support@suchasofty.org from your account address and we will respond within 30 days. To delete your account, say so in that email — we remove your profile, roadmap data and analytics identifiers, cancel any active subscription at the end of the paid period, and retain only the financial records we are legally required to keep.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Access to your data requires authentication, database access rules restrict every record to its owner, administrative screens are limited to explicitly assigned admin roles, and traffic is encrypted in transit over HTTPS. No system is perfectly secure; if a breach creates a real risk of significant harm we will notify affected users and the Privacy Commissioner as PIPEDA requires.

The service is for business owners aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

We will update this policy when our practices change and revise the date above. Material changes will be announced by email or on-site notice. Related pages: Terms of Service and Refunds & Cancellation.