Privacy Policy

Version 2026-10-20

1. Who is responsible

1001549742 Ontario Inc. ("we") is responsible for personal information collected through EvidentGrid. Privacy contact: hello@evidentgrid.com (Rajkumar Singh, Privacy Officer).

2. What we collect

• Access requests: your name, organization, email address and message.
• Accounts: your username, password (stored only as a salted hash), role, and whether multi-factor authentication is on (its secret is stored encrypted).
• Records of acceptance and use: the date, time, IP address and version when you accept our terms; sign-in times and IP addresses; important actions in the portal.
• Monitoring data you or your organization provide or authorize: device inventory, network addresses, syslog and SNMP status data, findings and incidents, and alert recipients' email addresses. Device credentials are stored encrypted.

3. Why we use it

To review and respond to access requests, provide and secure the Service, send alert emails to the recipients your organization designates, keep evidence of your acceptance of our terms, investigate misuse, and meet legal obligations. We rely on your consent and, where permitted, on our legitimate need to operate and secure the Service.

4. Who we share it with

We do not sell personal information. We use service providers to run the Service: hosting (IONOS, with servers in the United States) and email delivery (Resend). They may process data on our behalf under their own commitments. We may disclose information where the law requires it.

5. Where it is stored

Our servers are hosted in a data centre in the United States. Information may be processed in other countries by our providers and may be accessible to authorities there under local law.

6. How long we keep it

Raw log lines received from your devices are deleted after 90 days, except a log line attached to a finding or incident as evidence, which is kept with that record. Findings, incidents and reports are kept for as long as your organization uses the Service, so you keep an evidence history, and are deleted when your account is closed or on request, subject to legal obligations. Security audit records (sign-ins and changes) are kept for about 13 months. Access requests that are declined or marked as spam are deleted after 90 days. Demonstration data is fictional and is reset nightly, and demo logins expire automatically (normally after 14 days).

7. How we protect it

Encryption of stored credentials, encrypted connections, separation between organizations, role-based access, optional multi-factor authentication, rate limiting, and backups encrypted before they leave the server. No system is perfectly secure; we will notify affected people and the regulator where required if a breach creates a real risk of significant harm.

8. Your choices and rights

You may ask to access or correct your personal information, withdraw consent (which may end your access), or ask a question or make a complaint by contacting us. You may also contact the Office of the Privacy Commissioner of Canada.

9. Email

Alert and security emails sent to recipients designated by an organization are service messages. We send marketing email only with consent, which you can withdraw at any time.

10. Changes

We may update this policy; the version above changes when we do.