Privacy Policy

This Privacy Policy explains how 1333701 BC Ltd., doing business as Retrolux ("Retrolux", "we", "us" or "our"), handles personal information. It covers the Retrolux web application, the mobile apps, support, our sales and marketing, and www.retrolux.com. Retrolux is a company based in British Columbia, Canada.

1. Our role

When we act as controller. We decide how and why we use information about website visitors, prospects, billing contacts, and the people who use Retrolux through a customer's account ("users"). This includes users' account, usage and support information. This policy describes that processing.

When we act as processor. Our customers put their own data into Retrolux, such as their clients' building addresses, site contacts, photos, financing applications and proposals ("Customer Data"). We process Customer Data only on our customer's instructions, under our Data Processing Agreement. If your information is in a Retrolux customer's account, for example because a contractor audited your building, that customer is responsible for it. Please contact them first; we will help them respond to you.

2. Information we collect

Account and profile information

When an account is created for you, we collect your name, work email, phone number, company, job title, role, location and preferred language. We also store a profile photo if you add one, any company details you provide, such as industry, size and supplier relationships, and your password in hashed form.

Billing information

We keep billing contact names and emails, company details, plan and invoice history. Payments are processed by Stripe. We do not store full payment card numbers.

Activity, device and diagnostic information

• Security and activity logs. We record sign-in times and IP addresses, the pages and actions you use in the application, and a history of changes to records, including who made them and from which IP address. We use these logs for security, troubleshooting, support and to show customers an audit trail.
• Product analytics. In the web application, we use PostHog to record product events, such as pages viewed and features used, and session replays of how you interact with the application. Session replays mask what you type into form fields. We link this activity to your user ID, name and email so we can help with support and improve the product.
• Error reports. When something goes wrong, Sentry receives an error report with technical details about the error and the request that caused it.
• Mobile apps. The mobile apps store data on your device so you can work offline. They send us the app version, a device identifier, the device make, model and operating system version, available storage and sync activity, so we can support you and diagnose sync problems.

Support and meetings

When you contact support by email or in-app chat, we keep the conversation. The chat also tells us your name, email, phone number, profile photo, company, role, plan and account status, and the page you opened it from. When you book a meeting with us through HubSpot, we receive the details you enter. We may use Granola, an AI note-taking tool, to transcribe and summarize sales and support calls. We will ask for your agreement at the start of the call and will not use it if you decline.

Website and contact form

When you submit the contact form on www.retrolux.com, we collect your name, work email, company, role if you give it, and your message. Cloudflare hosts the website and processes the form. Its Turnstile service checks whether a submission comes from a person. Cloudflare also records standard request data such as IP address, browser and pages requested, for security and reliability. With your consent, we use Google Analytics to understand how visitors use the website (see Section 8).

Sales and marketing

We keep records of our business relationships in HubSpot and Attio. These include contact details, the company you work for, our correspondence and meetings, and whether you open our marketing emails or click their links.

3. How and why we use information

Where data protection laws such as the GDPR require a legal basis, we rely on the basis listed for each purpose.

We do not sell personal information. We do not share it for cross-context behavioural advertising, and we do not use it for automated decisions that have legal or similarly significant effects on you. We do not use Customer Data, or personal information in it, to train artificial intelligence models.

4. How we share information

• Service providers. We use providers for hosting, storage, payments, analytics, error monitoring, support, email, internal alerts and customer relationship management. Each one is listed, with its purpose and location, on our subprocessors page. They may use personal information only to provide their services to us, under written contracts.
• Your organization. Administrators of your company's Retrolux account can see your profile and the work you do in the account.
• Partners you choose. If you send a project or a financing application to a financing partner, or use another integration in the Service, we share the information needed to do that.
• Legal and safety. We may disclose information when the law requires it, or when it is needed to protect the rights, property or safety of Retrolux, our customers or others.
• Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred under confidentiality obligations, and this policy will continue to protect it.
• Professional advisers such as lawyers, accountants and auditors, under confidentiality obligations.

5. Where information is stored

Retrolux is based in Canada. Our application and its data are hosted in the United States, and some of our providers operate in other countries, as listed on our subprocessors page. Information stored outside Canada is subject to the laws of the country where it is held, and the authorities there may be able to access it.

The European Commission and the United Kingdom have recognized Canada as providing adequate protection for personal information handled by businesses like ours. When we transfer information from the European Economic Area, the United Kingdom or Switzerland onward to providers in other countries, we rely on an adequacy decision, such as the EU-US Data Privacy Framework, or on Standard Contractual Clauses.

6. How long we keep information

• Account information and Customer Data: for as long as the account is active. After a subscription ends, customers have 30 days to export their data, and we permanently delete it from production systems within 90 days of the end date. Backups are overwritten on their normal rotation.
• Billing records: for at least six years after the end of the tax year they relate to, as Canadian tax law requires.
• Contact-form messages and sales records: up to 24 months after our last contact with you, unless you become a customer.
• Support conversations and meeting notes: for as long as the customer relationship lasts, plus 24 months.
• Analytics, session replays and error reports: according to each provider's retention settings, which we keep no longer than we need for the purposes above.
• Website request logs: according to Cloudflare's standard retention.

We may keep information longer when the law requires it or to resolve a dispute. When we no longer need information, we delete or anonymize it.

7. Security

We protect personal information with safeguards appropriate to its sensitivity, including encryption of connections over public networks, access limited to people who need it, hashed passwords, account lockout after repeated failed sign-ins, and backups. No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the relevant regulators as the law requires. We keep a record of every breach of security safeguards for at least 24 months.

8. Cookies and similar technologies

• Strictly necessary: cookies that keep you signed in to the application and that Cloudflare uses for security and bot protection. These cannot be turned off.
• Product analytics and support: PostHog and our in-app support chat use cookies and local storage inside the application to measure use, record sessions and keep your support conversations together.
• Website analytics: Google Analytics cookies on www.retrolux.com, loaded through Google Tag Manager. Neither is loaded until you accept analytics cookies in the banner, and you can change your choice at any time with the Cookie settings link in the footer.

We do not use advertising or cross-site tracking cookies. You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop the application from working.

9. Marketing email

We send marketing email to business contacts in line with Canada's anti-spam law (CASL) and similar laws: with your consent, or where the law allows it based on an existing business relationship. Every marketing email includes an unsubscribe link, and we act on unsubscribe requests within 10 business days. You will still receive service and account messages while you use Retrolux.

10. Your privacy rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct inaccurate or incomplete information;
• delete your information, or restrict or object to how we use it;
• receive your information in a portable format;
• withdraw consent at any time, without affecting processing that has already happened; and
• not be treated differently for exercising these rights.

To make a request, email support@retrolux.com. We may need to verify your identity. We respond within 30 days, and tell you if we need more time as the law permits. If your information is Customer Data, we will refer your request to the Retrolux customer responsible for it.

If you are not satisfied with our response, you can complain to a privacy regulator. In Canada, that is the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia or, in Quebec, the Commission d'accès à l'information. In the European Economic Area or the United Kingdom, it is your local data protection authority. We would appreciate the chance to resolve your concern first.

11. Children

Retrolux is a business service and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, email support@retrolux.com and we will delete it.

12. Other websites

Our website and application link to services run by others, such as financing partners and utility programs. Their own privacy policies apply to them.

13. Changes to this policy

We will post any update on this page and change the date at the top. If a change is material, we will also email customer account administrators, or show a notice in the application, before it takes effect.

14. Contact us

Our Privacy Officer, Matthew Hall, is responsible for our compliance with this policy. Contact them at support@retrolux.com.

1333701 BC Ltd., doing business as Retrolux, British Columbia, Canada.