Privacy Policy

Who is responsible for your information

TopQuote is a one-person advisory business serving the GTA and Peel Region, Ontario. The owner is personally accountable for everything in this policy and acts as the privacy officer. There is no team, no data department and nobody else to escalate to — questions, access requests and complaints all go to the same person, through the contact page on this site.

We will confirm receipt of any privacy request and answer it within 30 days, which is the period PIPEDA allows. If a request will take longer than that, we will tell you before the 30 days are up and explain why.

What we collect

We collect the least we can and still do the job. Everything below is either given to us by you or generated by using the site.

• Contact details — your email address, and your name and phone number if you choose to give them.
• Project details — the type of project, the first characters of your postal code (enough to tell whether you are in our service area, not enough to identify your house), your budget range, your timeline, and anything you write in the description field.
• Photographs — any photos of your property you choose to upload. These are optional. A consultation can be done without them.
• Booking and account records — which consultations you have booked, their status, the verdict we wrote for you, and the balance of any credit on your account.
• Payment records — the amount, the date, and an identifier from Stripe that lets us match a payment to a booking. We never receive or store your card number, expiry date or security code.
• Technical records — our web host keeps standard server logs (IP address, browser, page requested, time) for the site, as every web server does. We do not combine these with your booking records.
• Waitlist entries — if your postal code falls outside our service area, we offer to record your email, postal prefix and project type so we can tell you when we cover it. That is a choice, not a requirement.

Why we collect it

PIPEDA requires us to identify our purposes before or at the moment we collect anything. Ours are short and there are no others hidden behind them.

• To decide whether we can serve you at all — that is what the postal prefix is for, and if the answer is no we say so instead of taking your money.
• To do the work you paid for: understand your project, form a verdict, and write it up with a realistic price range.
• To take payment and issue refunds or credits, through Stripe.
• To email you about your own booking — confirmation, a reminder, your verdict, and any cancellation or refund.
• To keep the financial records Canadian tax law requires us to keep.
• To keep the site working and secure.

Consent

You give us your information knowingly: you type it into a booking form, having been told on that form what it is for, and you tick a box to accept the consultation agreement before you pay. That is your consent, and it covers the purposes listed above and nothing else.

You can withdraw it at any time by asking us to delete your information. We will explain any consequence before acting — withdrawing consent for the details of a booking that has not happened yet means we cannot deliver it, and in that case the cancellation and refund rules below apply as normal.

We will never use your information for a new purpose without asking you first, in plain words, and getting a fresh yes.

What we never do with it

This deserves its own section because it is the reason the business exists.

• We never sell, rent or trade your personal information. Not to anyone, for any price.
• We never pass your details to contractors as a lead. We take no compensation from contractors of any kind — if we ever did, our advice would be worth nothing.
• We never send you marketing email without your express, separate consent. Any consent box for that is unchecked by default and stays unchecked unless you tick it, as Canada’s anti-spam legislation (CASL) requires. At launch we send transactional email only: things about your own booking.
• We never publish your photographs, your address or your project without asking you first, in writing, for that specific use.

Payments: we never hold your card

Payments run through Stripe Checkout. When you pay the $150 consultation fee you are on a page hosted by Stripe, and your card details go to Stripe, not to us. We never see them, never receive them and have nothing to store.

What comes back to us is the fact that a payment succeeded, the amount, and an identifier we use to match it to your booking and to issue a refund if one is due. Stripe is an independent company with its own privacy policy and its own security obligations; it processes and stores payment information on its own systems, which are located outside Canada.

Where your information is stored

Your information is held in a Supabase project. Supabase runs on Amazon Web Services infrastructure, and each project lives in one chosen region. We have not yet created the production project, so we cannot yet tell you which region that is — and we would rather say that than name a plausible one. The region will be stated here, by name, before this site accepts its first booking. If it is outside Canada, this paragraph will say so plainly, because that is the part that matters to you.

Photographs you upload are stored in the same project, in private storage. They are not published, not indexed and not reachable by a public link.

Two other companies necessarily hold some of it: Stripe, for payment records, and our web and email hosting provider, which runs this website and the mailbox that sends your confirmation and verdict emails. Both are service providers acting on our instructions; neither is permitted to use your information for their own purposes.

How long we keep it

Nothing is kept forever "just in case". These are the periods we hold ourselves to.

• Booking, payment and verdict records: six years after the end of the tax year they belong to, because Canadian tax law requires a business to keep its records that long. We cannot delete these earlier, and we will tell you so if you ask.
• Photographs and free-text project descriptions: 24 months after your consultation, then deleted. Sooner if you ask — see the next section.
• Waitlist entries: deleted once we open in your area and tell you, or after 12 months, whichever comes first.
• Account and sign-in records: for as long as you have an account. Ask us to close it and it goes, apart from the financial records above.
• Unpaid, abandoned bookings: deleted within 30 days.

Cookies, local storage, and analytics

There is no analytics on this site. No Google Analytics, no advertising pixels, no session recording, no heatmaps, no third-party tracking scripts of any kind. Nobody is watching you read a price guide.

Because of that there is no cookie banner: we set nothing that needs consent, and a banner asking permission for nothing would be theatre.

What the site does store in your browser is functional and stays on your device: if you sign in, your session token is kept in local storage so you are not signed out on every page; while you are booking, your answers are kept in session storage so pressing Back does not wipe the form; and Stripe sets its own cookies on its own checkout page, under its own policy, when you go there to pay.

If we ever add analytics, we will update this policy before it goes live, say exactly what it collects, and choose a tool that does not build a profile of you. This paragraph exists to make that promise checkable: if the site has analytics and this section still says it does not, we have broken it.

Your rights, and how to use them

Under PIPEDA you have the right to see the personal information we hold about you, to have it corrected if it is wrong, and to have it deleted, subject only to records the law requires us to keep.

To exercise any of them, use the contact page on this site and say what you want. We do not require a form, a reason or a fee. We will ask you to confirm you are the person the information belongs to — usually by replying from the email address on the booking — because handing your file to someone else would be its own privacy failure.

You will get a copy in a readable format, an explanation of what we used it for, and a list of anyone we disclosed it to. If we refuse any part of a request we will tell you which part, and why, in writing.

If you are not satisfied with how we handled it, you can complain to the Office of the Privacy Commissioner of Canada, which oversees PIPEDA. We would rather you told us first and gave us a chance to fix it, but that is your choice, not a condition.

Keeping it safe

The site is served over HTTPS. Access to the database is governed by row-level security rules, which means the code that runs in your browser can read your own bookings and nothing else — not another client’s booking, not another client’s photos, not the verdict written for someone else. The keys that can bypass those rules exist only on the server side and are never sent to a browser.

Photographs are stored privately rather than in a public bucket, so a photo of your back garden does not sit at a permanent public URL.

No system is perfect, and we will not pretend otherwise. If information is lost or exposed in a way that creates a real risk of significant harm to you, we will tell you and report it to the Office of the Privacy Commissioner, as PIPEDA requires — promptly, in plain language, and without waiting to see whether anyone noticed.

Children

This service is for property owners and decision-makers. It is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe a child has given us information, tell us and we will delete it.

If your plans change

Cancelling a consultation is covered by the Refund Policy, not this one — in short, cancel at least 24 hours before your appointment for a full refund, and inside that window the fee becomes a credit valid for 12 months. It is mentioned here only so that "delete my information" and "cancel my booking" do not get confused: they are different requests and you can make either, or both.

Changes to this policy

When this policy changes, the revision date at the top changes with it. If a change materially affects what we do with information we already hold, we will email you about it rather than quietly editing the page and hoping.

Previous versions are available on request. We keep them.