StakeholderHub Inc. (“StakeholderHub,” “we,” “us”) provides a stakeholder-relationship management platform used by organizations across Canada to plan, track, and document stakeholder and Indigenous-nation engagement, including engagement carried out under Duty to Consult obligations. This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with the StakeholderHub service (the “Service”).
This Policy is written to comply with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable to a customer's activities, substantially similar provincial legislation such as British Columbia's Personal Information Protection Act (PIPA BC) and Alberta's Personal Information Protection Act (PIPA AB).
1. Who this Policy applies to, and two kinds of personal information
StakeholderHub is a business-to-business (B2B) service. Our direct customers are organizations — project proponents, consultants, and government or Indigenous organizations (“Customer,” “Organization”) — who sign up for and administer an account. Two categories of personal information flow through the Service:
- Account/user data — information about the individuals a Customer authorizes to use the Service (name, work email, role, login activity). For this category, StakeholderHub acts as the organization providing the Service directly to those users, and is responsible for it under PIPEDA in the ordinary way.
- Stakeholder data — information a Customer enters about the people and organizations it engages with (stakeholder and Indigenous-nation contacts, engagement records, notes, and related documentation). For this category, the Customer is the controller of that personal information and StakeholderHub acts solely as the Customer's service provider (processor), storing and processing it only as instructed by the Customer and only to provide the Service. If you are a stakeholder or community member whose information appears in a Customer's StakeholderHub account, your relationship — and the right place to direct an access, correction, or withdrawal-of-consent request — is with that Customer organization, not with StakeholderHub directly. We will forward any such request we receive to the relevant Customer and assist them in responding to it.
2. Information we collect
| Category | Examples | Source |
|---|---|---|
| Account & contact information | Name, work email, organization, role, password (hashed) | Provided directly by the user/Customer at signup |
| Stakeholder data | Names, organizations, contact details, engagement history, notes, Support Status, and related consultation records entered by a Customer's users | Entered or imported by the Customer |
| Billing information | Plan, billing status, subscription identifiers | Collected and processed by Stripe on our behalf — StakeholderHub does not receive or store full card numbers |
| Usage & device data | IP address, browser/device type, pages visited, timestamps, audit-log events | Collected automatically by the Service and by Vercel Analytics |
| Support communications | Messages sent to our support email, and any attachments included | Provided directly by the user |
3. How we use personal information
- To provide, operate, and maintain the Service, including authentication and access control;
- To process billing and manage subscriptions (via Stripe);
- To send transactional email — account verification, team invitations, notifications about the Customer's own data (via Resend);
- To provide optional AI-assisted features (drafting suggestions, natural-language reporting) when a Customer enables them, using Anthropic's Claude models — see Section 5;
- To provide optional address-lookup and traditional-territory reference features (via Mapbox and Native Land Digital) — see Section 5;
- To monitor, secure, and troubleshoot the Service, including detecting fraud, abuse, and security incidents;
- To comply with legal obligations and enforce our Terms of Service; and
- To communicate with users about the Service (product updates, security notices, support responses).
We do not sell personal information, and we do not use stakeholder data entered by Customers to train our own or a third party's general-purpose AI models.
4. Where data is hosted
StakeholderHub is built and hosted in Canada. Our primary database and file storage run on Supabase infrastructure in Supabase's Canada (Central) region, and our application is deployed on Vercel. Where a sub-processor listed below operates infrastructure outside Canada for a specific function (for example, Stripe's payment processing or Anthropic's AI inference), personal information may be processed outside Canada solely for that purpose, subject to that sub-processor's own safeguards and contractual commitments.
5. Sub-processors
We rely on the following third-party service providers (“sub-processors”) to deliver the Service. Each is contractually restricted from using personal information for any purpose other than providing its service to us.
| Sub-processor | Purpose | Notes |
|---|---|---|
| Supabase | Database, authentication, file storage | Canada (Central) region |
| Vercel | Application hosting, edge network, product analytics | Also provides Vercel Analytics (see Section 7 — Cookies) |
| Stripe | Payment processing and subscription billing | StakeholderHub does not store full payment card numbers |
| Resend | Transactional email delivery (invites, notifications, waitlist confirmations) | |
| Anthropic | AI-assisted features (optional, Customer-enabled): drafting assistance and natural-language reporting over the Customer's own data | Only used when a Customer enables the relevant AI feature |
| Mapbox | Address geocoding for the mapping/location features | Only used when a Customer uses location features |
| Sentry | Application error tracking and performance monitoring |
We will update this list as our sub-processors change and, where required by a Customer agreement, will provide advance notice of a new sub-processor.
6. Data retention
We retain personal information for as long as a Customer's account is active, and for a reasonable period afterward to allow account recovery, meet legal, tax, and audit obligations, and resolve disputes. On request, and subject to any legal retention requirement, we will delete or anonymize a Customer's stakeholder data within a commercially reasonable time of account closure. Backups are retained on a rolling basis and age out automatically; deleted data may persist in backups for a limited period before being purged.
7. Cookies and similar technologies
The Service uses a small number of cookies and similar technologies:
- Authentication/session cookies (strictly necessary) — used to keep you signed in and to protect your session. These cannot be disabled without breaking sign-in.
- Vercel Analytics — privacy-focused, aggregate usage analytics (page views, general traffic patterns) used to understand product usage. It does not use persistent cross-site tracking cookies in the way conventional ad-tech analytics do.
We do not use third-party advertising cookies or trackers.
8. Your rights and how to exercise them
If you are an individual whose information StakeholderHub holds as part of an account/user relationship (Section 1), you may request access to, correction of, or deletion of that information, or withdraw consent where applicable, by contacting us at hello@stakeholderhub.ca. We will respond within a reasonable time and in accordance with PIPEDA and applicable provincial law.
If your information appears in a Customer's account as stakeholder data (Section 1), please direct your request to that Customer organization directly, as they control that data. If you are unsure which organization holds your information, contact us at the address above and we will do our best to help direct your request.
9. Security
We use technical and organizational safeguards appropriate to the sensitivity of the data we handle, including encryption in transit and at rest, database-level row-level-security data isolation between Customer organizations, rate limiting, audit logging of security-relevant events, and restricted administrative access. No system is completely secure, and we cannot guarantee absolute security.
10. Breach notification
In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm, we will notify affected individuals and/or affected Customer organizations, and report to the Office of the Privacy Commissioner of Canada (and any other applicable regulator), as required by PIPEDA and applicable provincial law. Where StakeholderHub processes stakeholder data as a Customer's service provider, we will notify the affected Customer promptly so they can meet their own notification obligations.
11. Indigenous data and OCAP®
We recognize that stakeholder data entered by Customers may include information about Indigenous nations, communities, and individuals, and that Indigenous data governance (including the principles of Ownership, Control, Access, and Possession — OCAP®) raises considerations beyond standard privacy law. StakeholderHub does not claim ownership over any Indigenous data entered into the Service; it remains the Customer's data, held and processed by us as a service provider under Customer instruction, in Canada.
12. Changes to this Policy
We may update this Policy from time to time. We will post the updated version here with a new effective date and, for material changes, provide additional notice to Customers.
13. Contact us
Questions about this Policy, or requests relating to your personal information, can be sent to hello@stakeholderhub.ca.