Privacy Policy

1Introduction

Toccata Systems Inc. ("Company," "we," "us," or "our"), the maker of CabinPulse, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our services, website, and products.

Toccata Systems Inc. is a Canadian corporation incorporated in Saskatchewan, with its registered office and headquarters in Saskatoon, SK.

2Information We Collect

2.1Personal Information You Provide

We collect information that you voluntarily provide to us when you:

• Create an Account: Name, email address, phone number, password (encrypted)
• Make a Purchase: Billing and shipping addresses, payment information (processed by our payment processor Stripe)
• Contact Us: Any information you provide in customer support inquiries
• Subscribe to Communications: Email address and communication preferences

2.2Device Data

When you use a CabinPulse monitoring device, we automatically collect:

• Temperature readings
• Humidity levels
• Air quality measurements (VOC levels)
• Power status and outage information
• Device health and connectivity status
• Device serial number and firmware version
• Cellular network information
• Add-on sensor data (if applicable)

2.3Automatically Collected Information

We automatically collect certain information when you visit our website:

• Usage Data: Pages visited, time spent and click patterns, via Umami Analytics (cookieless) and, with your consent, Microsoft Clarity
• Device Information: Browser type, operating system, device identifiers
• Location Information: General location based on IP address (country/city level only)
• Cookies and Similar Technologies: See our Cookie Policy for details

2.4Information from Third Parties

We may receive information from:

• Payment processors (transaction confirmations)
• Analytics providers
• Marketing partners (if you interact with our advertisements)

3Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our monitoring services and fulfill our agreement with you
• Legitimate Interests: Improving our services, preventing fraud, network security
• Consent: Marketing communications, analytics cookies (where required)
• Legal Obligations: Compliance with tax, accounting, and legal requirements

4How We Use Your Information

4.1Service Provision

• Operating and maintaining your CabinPulse monitoring service
• Processing and fulfilling orders
• Sending critical service alerts and notifications
• Providing customer support
• Managing your account and subscriptions

4.2Communication

• Sending transactional emails (order confirmations, alerts, service updates)
• Responding to inquiries and support requests
• Sending marketing communications (with your consent, where required)
• Notifying you of important changes to our services or policies

4.3Improvement and Analytics

• Analyzing usage patterns to improve our services
• Conducting research and development
• Testing new features and functionality
• Understanding user preferences and behavior

4.4Legal and Security

• Preventing fraud and unauthorized access
• Complying with legal obligations
• Enforcing our Terms and Conditions
• Protecting our rights, property, and safety

5Data Sharing and Disclosure

5.1Service Providers

We share only what each provider needs to do its job:

• Stripe — payment processing. Card details go to Stripe directly and never reach our servers.
• Canada Post — your postal code and parcel weight, to quote shipping. No name or address is sent to obtain a quote.
• Cloud hosting and email providers — storing your account and sending order, alert and account emails.
• Our support chat and helpdesk — handling the conversations you start with us.
• Formspree — receiving CabinPulse Cares applications, if you submit one.
• Umami analytics — page views, without cookies, as described in the Cookie Policy.
• Microsoft Clarity — how pages are used, only if you accept analytics cookies.

These providers are contractually required to protect your information and to use it only for what we ask.

5.2Advertising Measurement, Including Data Sent From Our Server

We advertise on Meta (Facebook and Instagram), Google and Microsoft. Measuring which ads lead to orders happens in two places, and we want to be plain about the second because it is not something a cookie setting controls.

In your browser. If you accept marketing cookies, the Meta, Google Ads and Microsoft Advertising tags load and report page views, add-to-cart and checkout starts. Decline and none of them load.

From our server. When an order is paid for, our server reports that purchase to Meta's Conversions API. This is how we know which advertising produced revenue when a browser blocks the tag or the customer closes the tab. It sends:

• Hashed before it leaves our server, using SHA-256: your email address, phone number, first and last name, city, province, postal code and country, and the random visitor identifier described in the Cookie Policy. Hashing is one-way; Meta receives these only as irreversible values used for matching, and cannot read them.
• Not hashed, because matching requires the raw value: the Meta browser identifiers _fbp and _fbc if present, your IP address, and your browser's user-agent string.
• Order details: the total, the currency, and the order reference.

We do not send the contents of your cart, your street address, or anything about your device readings. Meta acts as an independent controller for this data under its own terms.

Declining marketing cookies stops the browser tags but does not stop this server-side report, because it is a record of a completed transaction rather than tracking of your browsing. If you would prefer your order excluded, email support@cabinpulse.com and we will exclude it and ask Meta to delete it.

5.3Legal Requirements

We may disclose your information when required by law or in response to:

• Valid legal process (subpoenas, court orders)
• Government or regulatory requests
• Protection of our legal rights
• Prevention of fraud or illegal activity
• Protection of safety of our users or the public

5.4Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the successor entity. We will notify you via email and/or prominent notice on our website before your information is transferred.

5.5With Your Consent

We may share your information for other purposes with your explicit consent.

6International Data Transfers

We primarily serve customers in the United States and Canada. Your account and monitoring data are stored on servers located in Canada. Some service providers described in this policy, such as our payment processor and, where you have consented, analytics and advertising providers, may process limited information in other countries, including the United States. If you are accessing our services from outside these countries, please be aware that your information may be transferred to, stored, and processed in Canada.

For users in the EEA, UK, or Switzerland, we ensure appropriate safeguards are in place for any international transfers, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions by the European Commission
• Other lawful transfer mechanisms under applicable data protection laws

7Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption: All device data is encrypted during transmission using industry-standard protocols (TLS 1.2+)
• Password Protection: Passwords are hashed and encrypted using bcrypt
• Access Controls: Strict internal access controls limit who can access your data
• Secure Infrastructure: Regular security audits and monitoring
• Employee Training: All employees receive data protection training

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

8Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Specific Retention Periods:

• Account Information: For the duration of your active account
• Device Data: For the duration of your active subscription
• Transaction Records: 7 years for tax and accounting purposes
• Marketing Data: Until you unsubscribe or request deletion
• Support Communications: 3 years after case closure

After account closure, we will delete or anonymize your personal information within 90 days, except where we are required to retain it for legal, tax, or accounting purposes.

9Your Privacy Rights

9.1General Rights (All Users)

You have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal obligations)
• Data Portability: Receive your data in a structured, machine-readable format
• Opt-Out: Unsubscribe from marketing communications
• Account Closure: Close your account at any time

9.2European Union / EEA Rights (GDPR)

If you are located in the EU/EEA, you have additional rights:

• Right to Restrict Processing: Limit how we use your data
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time (where processing is based on consent)
• Right to Lodge a Complaint: File a complaint with your local data protection authority

9.3California Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know: Request disclosure of personal information we collect, use, and share
• Delete: Request deletion of your personal information
• Opt-Out of Sale: We do not sell personal information
• Non-Discrimination: We will not discriminate against you for exercising your rights
• Correct: Request correction of inaccurate personal information
• Limit Use: Limit use and disclosure of sensitive personal information

9.4Canadian Rights (PIPEDA)

As a Canadian company, we comply with PIPEDA. You have the right to:

• Access your personal information
• Challenge the accuracy and completeness of your information
• File a complaint with the Privacy Commissioner of Canada

9.5How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: support@cabinpulse.com
• Subject Line: "Privacy Rights Request"

We will respond to your request within 30 days (or as required by applicable law). We may need to verify your identity before processing your request.

10Children's Privacy

Our services are not intended for children under 13 years of age (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately, and we will delete such information.

11Text Message Communications

By providing your mobile phone number, you consent to receive transactional text messages (SMS) from CabinPulse, including:

• Critical device alerts (temperature, power outage, etc.)
• Service notifications
• Account security messages

Message and data rates may apply. You can opt out of non-critical messages at any time by replying STOP. However, you cannot opt out of critical alert messages while maintaining an active subscription, as these are essential to the service.

Text messaging originator opt-in data and consent will not be shared with any third parties for marketing or promotional purposes.

12Marketing Communications

We may send you marketing emails about our products, services, and promotions. You can opt out at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Adjusting your email preferences in your account settings
• Contacting us at support@cabinpulse.com

Please note that even if you opt out of marketing communications, we will still send you transactional emails related to your account and service.

13Cookies and Tracking Technologies

Our Cookie Policy lists everything we store on your device, what loads only with your consent, and what does not. You can change your choices at any time using the Cookie Preferences link in the footer.

Two things are worth pointing out here rather than leaving in that policy alone:

• Declining marketing cookies means those scripts are never fetched at all, not merely switched off after loading.
• When an order is paid for, our server reports the purchase to Meta for advertising measurement, with the personal fields hashed. That happens on our server, so a cookie setting or a blocker does not affect it. Section 5.2 sets out exactly what is sent, and how to have your order excluded.

14Do Not Track Signals

Some browsers have a "Do Not Track" feature. Because there is no common understanding of how to interpret Do Not Track signals, our website does not currently respond to browser Do Not Track signals.

15Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and relevant authorities as required by applicable law. Notification will be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

16Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to review the privacy policies of any third-party sites you visit.

17Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending an email notification to your registered email address
• Displaying a prominent notice on our website or in our service

Your continued use of our services after the effective date of the updated Privacy Policy constitutes your acceptance of the changes.

18Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Toccata Systems Inc.
Email: support@cabinpulse.com
Attention: Privacy Officer
Address: 350 103rd St E #104, Saskatoon, SK S7N 1Z1, Canada

For EU/EEA data protection inquiries, you may also contact your local data protection authority.

19Accessibility

We are committed to ensuring this Privacy Policy is accessible to all users. If you need this policy in an alternative format, please contact us at support@cabinpulse.com.