Privacy Policy

§1 Introduction

FlowStation AI (“Flowstation,” “we,” “us,” or “our”) is committed to protecting the privacy of individuals and organizations that use our permit compliance pre-checking services. This Privacy Policy explains how we collect, use, store, and protect information when you interact with our platform and services.

Flowstation is a Canadian company headquartered in British Columbia. We are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and the British Columbia Personal Information Protection Act (PIPA). We are committed to compliance with both federal and provincial privacy legislation.

§2 What Data We Collect

Flowstation processes the following categories of data in the course of providing compliance pre-check services:

• Construction drawings and plans: Architectural drawings, site plans, floor plans, and related technical documents submitted by clients for compliance review.
• Public parcel data: Publicly available property information including civic addresses, legal descriptions, lot dimensions, and zoning designations sourced from municipal open data portals.
• Published zoning bylaws: Publicly available municipal zoning bylaws, land use regulations, and development permit area guidelines.
• Contact information: Name, email address, organization name, and role provided voluntarily through our contact forms.

§3 How We Use Your Data

Data submitted to Flowstation is used exclusively for the following purposes:

• To perform permit compliance pre-checks against applicable municipal zoning bylaws.
• To generate bylaw-cited compliance reports for review by our qualified planners and for delivery to clients.
• To respond to inquiries submitted through our contact forms.
• To improve the accuracy and coverage of our compliance checking system (using only aggregated, anonymized data—never individual project files).

§4 Data Storage and Security

All data is processed and stored in Canada on Google Cloud Platform infrastructure in the Montréal, Québec region (Hosted in Canada). Infrastructure is region-locked to Canadian data centers via organizational policy. Your data is not subject to the United States CLOUD Act.

• Encryption at rest: AES-256 encryption provided by Google Cloud Platform.
• Encryption in transit: TLS 1.2 or higher for all data transmission.
• Access controls: Role-based access controls limit data access to authorized personnel only.
• Data retention: All project data (drawings, reports, and associated files) is deleted within 30 days of engagement completion. Contact form submissions are retained for up to 12 months.

§5 No Third-Party Data Sharing

Flowstation does not sell, rent, trade, or otherwise share your data with third parties. Your construction drawings and project data are never disclosed to other organizations, advertisers, data brokers, or any party outside of Flowstation and our qualified expert reviewers. Expert reviewers are bound by confidentiality obligations.

§6 No AI Model Training on Your Data

Your drawing packages and project data are never used to train, fine-tune, or improve AI models. Project data is processed solely for the purpose of generating your compliance report and is deleted in accordance with our 30-day retention policy. We do not use your submissions as training data for machine learning models.

§7 PIPEDA Compliance

In accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Flowstation adheres to the following principles:

• Accountability: Flowstation is responsible for personal information under its control.
• Identifying purposes: We identify the purposes for which information is collected at or before the time of collection.
• Consent: We obtain informed consent for the collection, use, and disclosure of personal information.
• Limiting collection: We collect only the information necessary for the identified purposes.
• Limiting use, disclosure, and retention: Information is used only for the purposes for which it was collected and is retained only as long as necessary.
• Accuracy: We keep information accurate, complete, and up to date as necessary.
• Safeguards: We protect information with security safeguards appropriate to the sensitivity of the data.
• Openness: We make information about our policies and practices readily available.
• Individual access: Upon request, we will inform individuals of the existence, use, and disclosure of their personal information and provide access to that information.
• Challenging compliance: Individuals may challenge our compliance with these principles by contacting our privacy contact below.

§8 FOIPPA Readiness

Flowstation is designed to support municipal clients subject to the British Columbia Freedom of Information and Protection of Privacy Act (FOIPPA). Our Canadian-only data processing, region-locked infrastructure, minimal data collection practices, and 30-day data deletion policy are designed to align with FOIPPA requirements for municipal procurement of digital services.

§9 Cookies and Analytics

Our website may use essential cookies to maintain site functionality. We do not use third-party advertising cookies or cross-site tracking technologies. If we implement analytics, we will use privacy-respecting analytics tools that do not collect personally identifiable information and that process data within Canada.

§10 Your Rights and Data Requests

Under PIPEDA and PIPA, you have the right to:

• Request access to the personal information we hold about you.
• Request correction of inaccurate personal information.
• Request deletion of your personal information (subject to legal and contractual obligations).
• Withdraw consent for the collection, use, or disclosure of your personal information.

To exercise any of these rights, please contact us at support@flowstation.ai. We will respond to all requests within 30 calendar days.

§11 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. If we make material changes, we will provide notice on our website. The “Last Updated” date at the top of this policy indicates when the most recent revision was made.

§12 Contact

For privacy-related inquiries, data access requests, or complaints regarding our handling of personal information: