Privacy Policy

1. Introduction

Cornerstone Contracts Inc. ("we", "us", or "our") operates the Cornerstone Contracts platform at cornerstonecontracts.com. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our service, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

2. Information We Collect

We collect the following categories of personal information:

• Account information: Email address, password (hashed), company name or full name, and role (contractor or subcontractor).
• Professional profile: Trade specialties, certifications, insurance details, preferred regions, crew size, bonding capacity, and other details you provide during onboarding.
• Usage data: Pages visited, features used, and interaction timestamps for improving the service.
• Device data: IP address, browser type, and operating system collected automatically via server logs.

3. How We Use Your Information

• Matching: We match you with relevant bid opportunities using our own deterministic scoring algorithm. It runs on our own infrastructure and does not send your data to any third-party AI service.
• Proposal generation: When you generate a draft proposal, the specific match details and the relevant fields from your profile are sent to third-party AI providers (listed in Section 4) to draft the text. This is the only feature that shares your data with an AI provider, and only when you initiate it.
• Communications: We send transactional emails including daily match digests and account notifications via our email provider (Resend).
• Service improvement: We analyze usage patterns to improve the platform.

4. Third-Party Services (Subprocessors)

We use the following service providers that may process your data on our behalf. Providers marked cross-border process data outside Canada, primarily in the United States. We rely on contractual and technical safeguards for these transfers, as permitted under PIPEDA.

• Supabase — authentication, database, and file storage (SOC 2 Type 2; Canadian/US data centres). Cross-border.
• Stripe — payment processing for Pro and Intelligence subscriptions and one-time purchases. Card details are transmitted directly to Stripe and are never stored by us. Cross-border.
• AI proposal-drafting providers — used only when you generate a proposal, and only the specific match plus the relevant fields from your profile are sent per request. Our primary provider is Anthropic (Claude) (United States). If it is unavailable we fall back to the DeepSeek V4 Flash model hosted by Fireworks AI (United States) and the Kimi K2.6 model hosted by Together AI (United States); we deliberately use these US hosts rather than the model developers' own servers. If you configure your own AI key (bring-your-own-key), your requests go to the provider you choose (for example, Google AI or OpenAI) instead of ours. Cross-border.
• Resend — transactional and opt-in email delivery (match briefs, account notifications). Cross-border.
• Vercel — application hosting and serverless functions. Cross-border.
• Upstash — rate limiting to protect against abuse. Cross-border.
• Sentry — error monitoring and performance telemetry (IP, user agent, stack traces; no profile data). Cross-border.
• PostHog & Google Analytics — product and web analytics, loaded only after you accept our cookie banner. Page views, feature usage, and aggregated funnels. Cross-border.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide our services. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law or for legitimate business purposes (such as fraud prevention).

6. Your Rights

Under PIPEDA and applicable provincial legislation, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Withdraw consent for non-essential data processing.
• Request deletion of your account and associated data.
• Opt out of marketing communications at any time via your account settings.

You can delete your account and its associated data yourself at any time from your account settings (Settings → Delete account); we remove your data within 30 days, subject to the retention exceptions in Section 5. To exercise any of the other rights above, contact our Privacy Officer (Section 10).

7. Cookies

Essential cookies are required for authentication and session management and cannot be disabled. Analytics cookies (PostHog, Google Analytics) are loaded only after you accept the cookie banner on your first visit and can be cleared from your browser or revoked by settinglocalStorage['cookie-consent'] = 'declined' and reloading. We do not use third-party advertising cookies.

8. Security

We implement industry-standard security measures including encrypted connections (TLS), hashed passwords, row-level security on our database, rate limiting, and timing-safe secret comparisons to protect your data.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on our website. Your continued use of the service after changes constitutes acceptance of the updated policy.

10. Contact Us

For privacy questions or to exercise your rights under PIPEDA, contact our Privacy Officer at contact@cornerstonecontracts.com. We respond within 30 days as required by PIPEDA.

Cornerstone Contracts Inc.
Privacy Officer, c/o Joseph Morrison
Edmonton, Alberta, Canada