top of page

TreatyX Privacy Policy

Last Updated: November 2025

​

1. Introduction and Scope

TreatyX ("we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile application, and related services (collectively, the "Services").

This policy complies with:

  • Canada's Personal Information Protection and Electronic Documents Act (PIPEDA)

  • Quebec's Act 25 (formerly Bill 64)

  • General Data Protection Regulation (GDPR) for European users

  • California Consumer Privacy Act (CCPA) for California residents

By using our Services, you consent to the data practices described in this policy.

 

2. Information We Collect

 

2.1 Information You Provide

  • Account Information: Name, email address, password, profile information

  • Payment Information: Billing address, payment card details (processed by third-party payment processors)

  • Communications: Messages, feedback, inquiries

  • Demographic Information: Age, location, language preferences (optional)

  • Cultural Information: Indigenous community affiliation, language proficiency (optional, for personalized content)

2.2 Information Collected Automatically

  • Device Information: Hardware model, operating system, unique device identifiers

  • Usage Data: Pages visited, features used, time spent, clickstream data

  • Location Data: GPS coordinates (with your permission), IP address, Wi-Fi network information

  • Cookies and Tracking Technologies: See our Cookie Policy for details

2.3 Information from Third Parties

  • Social media platforms (if you connect your account)

  • Payment processors

  • Analytics providers

  • Indigenous community partners (with consent)

 

3. How We Use Your Information

 

3.1 Primary Purposes

  • Provide and maintain our Services

  • Process transactions and deliver products

  • Personalize your experience

  • Communicate with you about updates, offers, and news

  • Improve our Services and develop new features

  • Ensure security and prevent fraud

3.2 Secondary Purposes

  • Conduct research and analysis

  • Comply with legal obligations

  • Protect the rights and safety of our users and communities

  • Support Indigenous language and cultural preservation efforts

3.3 Cultural and Educational Purposes

  • Map usage patterns to understand engagement with Indigenous content

  • Anonymize data for academic research on reconciliation education

  • Share aggregated insights with Indigenous community partners (never individual data)

 

4. Information Sharing and Disclosure

4.1 With Your Consent

We share information when you give us explicit permission, such as:

  • Connecting with Indigenous community events

  • Participating in research studies

  • Sharing your story (with explicit cultural permissions)

4.2 Service Providers

We share information with trusted partners who assist us, including:

  • Payment processors (Stripe, PayPal)

  • Hosting services (Google Cloud, AWS)

  • Email service providers

  • Analytics companies (Google Analytics)

  • Shipping carriers (Canada Post, UPS)

All service providers are contractually obligated to protect your information.

4.3 Legal Requirements

We may disclose information:

  • To comply with legal obligations

  • To protect our rights, privacy, safety, or property

  • In connection with business transfers (merger, acquisition)

  • To prevent illegal activity or harm

4.4 Indigenous Community Partners

We may share aggregated, anonymized data with:

  • Indigenous Advisory Council (for cultural oversight)

  • Partner Indigenous communities (for program improvement)

  • Educational institutions (for research purposes)

We never share individual user data with community partners without explicit consent.

 

5. Data Security

5.1 Security Measures

We implement appropriate technical and organizational measures, including:

  • Encryption of sensitive data in transit and at rest

  • Regular security assessments and audits

  • Access controls and authentication protocols

  • Employee training on data protection

5.2 Data Breach Response

In the event of a data breach, we will:

  • Notify affected users within 72 hours

  • Report to relevant authorities as required by law

  • Take immediate steps to mitigate harm

  • Provide guidance on protective measures

 

6. International Data Transfers

6.1 Cross-Border Transfers

Your information may be transferred to and processed in countries other than your own. We ensure adequate protection through:

  • Standard contractual clauses

  • Privacy Shield certification (where applicable)

  • PIPEDA adequacy determinations

6.2 Specific Country Provisions

  • European Union: GDPR-compliant data processing agreements

  • United States: Limited transfers with appropriate safeguards

  • Other Countries: Assessment of local privacy laws and regulations

 

7. Your Rights and Choices

7.1 Access and Correction

You have the right to:

  • Access your personal information

  • Correct inaccurate information

  • Request deletion of your information

  • Obtain a copy of your data in portable format

7.2 Marketing Preferences

You can:

  • Opt-out of marketing communications

  • Adjust notification settings in your account

  • Unsubscribe using links in our emails

7.3 Location Data

You can:

  • Disable location services on your device

  • Use app features without location permissions (limited functionality)

  • Delete location history from your account

7.4 Cookies and Tracking

See our Cookie Policy for options to manage tracking technologies.

7.5 Exercising Your Rights

To exercise your rights, contact our Privacy Officer at [privacy@treatyx.org]. We will respond within 30 days.

 

8. Data Retention

8.1 Retention Periods

We retain information only as long as necessary:

  • Account data: While account is active + 7 years for tax purposes

  • Transaction data: 7 years for financial record-keeping

  • Usage data: 3 years for service improvement

  • Location data: 30 days for app functionality (unless you save locations)

8.2 Deletion Procedures

When data is no longer needed:

  • Secure deletion from active systems

  • Archival of required records

  • Anonymization for research purposes

 

9. Children's Privacy

9.1 Age Restrictions

Our Services are not intended for children under 13. We do not knowingly collect information from children under 13.

9.2 Educational Use

For school or educational use:

  • Teachers may create accounts for students over 13

  • Parental consent is required for students under 16

  • Special privacy settings apply to educational accounts

9.3 Parental Rights

Parents may:

  • Review their child's information

  • Request deletion of their child's information

  • Refuse further collection of their child's information

 

10. Indigenous Cultural Data Protection

10.1 Special Protections

Recognizing the sensitivity of Indigenous knowledge:

  • Cultural stories and language data receive enhanced protection

  • Access controls based on cultural protocols

  • Special retention rules for sacred or ceremonial content

10.2 Community Rights

Indigenous communities have the right to:

  • Review how their cultural knowledge is used

  • Request modification or removal of content

  • Receive reports on usage of their cultural materials

  • Participate in privacy impact assessments

10.3 Ethical Research Practices

When using data for research:

  • Community approval required for studies involving Indigenous knowledge

  • Benefits sharing with participating communities

  • Indigenous-led research priorities

 

11. Cookies and Tracking Technologies

11.1 Types of Cookies We Use

  • Essential cookies: Required for basic functionality

  • Performance cookies: Help us improve our Services

  • Functionality cookies: Remember your preferences

  • Advertising cookies: Support our free educational content

11.2 Your Choices

You can manage cookies through:

  • Browser settings

  • Our cookie consent banner

  • Third-party opt-out tools

 

12. Third-Party Services

12.1 Integrated Services

Our Services may include:

  • Social media features

  • Mapping services (Mapbox, Google Maps)

  • Payment processors

  • Analytics tools

12.2 External Links

We are not responsible for the privacy practices of third-party websites. We encourage you to review their privacy policies.

 

13. Changes to This Policy

13.1 Notification of Changes

We will notify you of material changes by:

  • Posting a notice on our website

  • Sending an email to registered users

  • Updating the "Last Updated" date

13.2 Continued Use

Your continued use after changes constitutes acceptance of the revised policy.

 

14. Contact Information

14.1 Privacy Officer

For privacy-related inquiries:
TreatyX Privacy Officer
[Your Address]
[Your City, Province, Postal Code]
Email: [privacy@treatyx.org]
Phone: [Your Phone Number]

14.2 Data Protection Authority

You have the right to lodge a complaint with:
Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
Website: www.priv.gc.ca

 

15. Definitions

15.1 Key Terms

  • Personal Information: Information that identifies, relates to, or could reasonably be linked with you

  • Processing: Any operation performed on personal information

  • Data Controller: TreatyX determines the purposes and means of processing

  • Data Processor: Third parties that process data on our behalf

15.2 Cultural Terms

  • Indigenous Knowledge: Traditional knowledge, stories, languages, and practices of Indigenous peoples

  • Cultural Protocols: Community-specific rules governing access to and use of cultural materials

  • Indigenous Contributor: Knowledge holders who share cultural content with TreatyX

 

16. Language

This policy is available in English and French. In case of discrepancy, the English version prevails.

 

17. Acknowledgment

By using TreatyX Services, you acknowledge that:

  • You have read and understood this Privacy Policy

  • You consent to our data practices as described

  • You understand your rights and how to exercise them

  • You recognize the special protections for Indigenous cultural data

TreatyX is committed to protecting your privacy while advancing truth and reconciliation through technology. We believe that ethical data practices are fundamental to our mission.

This Privacy Policy was last updated on [Date]. Please check back regularly for updates.

 

Quick Reference Guide

Your RightHow to Exercise ItResponse Time

Access your dataEmail privacy@treatyx.org30 days

Correct errorsUpdate in account settings or contact us30 days

Delete your accountSettings → Delete Account or contact us30 days

Opt-out of marketingUnsubscribe link or account settingsImmediate

File a complaintContact our Privacy Officer or OPCVaries

​

bottom of page