Privacy Policy

When you register, we collect your name, email address, and a password credential stored using one-way password hashing. We verify your email address before enabling billing or product access. During password setup, Have I Been Pwned receives only the five-character prefix of a SHA-1 password hash through its padded k-anonymity range service; it never receives your password or the complete hash from us. You may optionally upload brand assets (logo, business name) to personalize reports — these are stored on your behalf and are not used for any other purpose.

All payment card data is collected and processed directly by Stripe, Inc. We do not store card numbers, CVVs, expiry dates, or full payment credentials on our systems. We retain non-sensitive billing metadata returned by Stripe, including your Stripe customer and subscription identifiers, plan, trial status, trial end date, billing status and dates, scheduled first charge, and invoice history. To prevent repeated free-trial abuse, we retain keyed pseudonymous identifiers derived from verified email addresses and Stripe-provided card fingerprints. These identifiers cannot be used to reconstruct the original email address or a card number and are retained only as long as justified by the one-trial policy and fraud, dispute, or legal requirements under our reviewed retention schedule.

When you use the Service, we automatically collect technical data including your IP address, browser type and version, operating system, pages visited, features used, search queries you run within the platform (including listing IDs and geographic filters you interact with), and session timestamps. Listing IDs in this context refer to property-record identifiers and do not contain your personal financial decisions.

If you contact us by email or through support channels, we retain your messages and our responses to resolve your inquiry and improve the Service.

When you use Princeps Assistant, we collect and store your prompts, assistant responses, model and usage metadata, tool traces, generated artifacts, and related errors so we can provide support, debug issues, monitor abuse, and improve the Service.

We use your account information to authenticate you, personalize your dashboard, and deliver analytics and reports. This is the primary purpose for which information is collected and the reason you entered into a subscription agreement with us.

We use billing metadata to administer free trials, schedule the first subscription charge after a trial ends, charge for your subscription, issue invoices, maintain billing records, and assess and configure applicable Canadian sales-tax obligations. Launch prices are tax-inclusive and automatic tax calculation is disabled; we will obtain qualified advice and update our configuration and disclosures before changing that treatment.

We analyze usage patterns, trial activity, billing metadata, and IP data to detect unauthorized account access, fraudulent subscription or trial activity, and abuse of the platform. This is a legitimate interest that is proportionate to and does not override your privacy interests.

We use aggregated, de-identified usage statistics to understand how the platform is used, prioritize new features, and fix defects. Where we use individual-level data for this purpose, we will obtain your consent or rely on de-identification prior to analysis.

Under Quebec Law 25, we collect information only for explicit, defined purposes. We do not use personal information for any purpose incompatible with those stated here without seeking fresh, informed consent.

Stripe processes subscription payments and collects your payment card data directly. Stripe may process information in the United States and other jurisdictions under its published service, privacy, and security documentation. See Stripe's privacy policy at stripe.com/privacy. We remain accountable for personal information transferred under our arrangement as required by applicable Canadian privacy law.

Cloudflare hosts the Princeps web application and serves it via a global edge network. Cloudflare processes network traffic — including IP addresses and HTTP metadata — in data centers across the United States and other jurisdictions as part of normal content delivery and security functions (DDoS protection, DNS). See Cloudflare's privacy policy at cloudflare.com/privacypolicy.

We use Resend to deliver transactional account emails, such as verification, password-reset, billing, deletion, and security messages. Your email address and the minimum message metadata needed for delivery are transmitted to Resend solely for that purpose under its applicable terms.

Your name, email, and trial and subscription history are retained for the duration of your active trial or subscription and for twelve (12) months after your account is closed or your subscription ends. This period covers potential billing disputes, tax record requirements, and any support inquiries arising after cancellation.

IP addresses, session data, and feature usage are retained for ninety (90) days, after which they are deleted or de-identified.

Non-sensitive billing and trial metadata from Stripe is retained only for the period justified by applicable tax, accounting, fraud-prevention, dispute, and legal obligations under our reviewed retention schedule; this is not a blanket retention period for every billing field.

After applicable retention periods expire, personal information is securely deleted or anonymized. You may request earlier deletion subject to the limitations described in Section 7.

Princeps Assistant transcripts and related metadata are retained only under a bounded, documented schedule reviewed for support, debugging, abuse prevention, and product-improvement needs. We delete or de-identify them when that period ends, unless a shorter deletion request applies or a specific legal hold requires longer retention.

You have the right to know what personal information we hold about you and to receive a copy of it in an intelligible format.

You have the right to request correction of inaccurate or incomplete personal information. Account information such as your name can be corrected directly in your account settings.

You may request that we delete your personal information. We will fulfill deletion requests subject to legal obligations that require us to retain certain records (e.g., tax records). Deletion of your account will be processed upon request and confirmed by email.

You have the right to receive your personal information in a structured, commonly used, machine-readable format and to have it transmitted to another organization where technically feasible. Submit portability requests to privacy@princep.org.

You may withdraw your consent to any non-essential data processing at any time, subject to legal or contractual restrictions. Withdrawal of consent to processing required to deliver the Service may result in termination of your subscription.

If you believe we have handled your personal information in a manner inconsistent with PIPEDA, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca. If you are a Quebec resident, you may also file a complaint with the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca.

Princeps has designated a Privacy Officer responsible for compliance with Quebec Law 25 and PIPEDA. The Privacy Officer can be reached at privacy@princep.org. If you are a Quebec resident and wish to submit a privacy request or complaint, contact the Privacy Officer directly.

Before a relevant project or cross-border disclosure begins, we assess whether Quebec Law 25 requires a privacy impact assessment and complete and document one when required. This statement describes our obligation and does not claim that every possible assessment has already been completed.

In the event of a confidentiality incident (data breach) that presents a risk of serious harm to an individual, we will promptly notify the CAI and affected individuals, as required by Law 25. Notice will describe the nature of the incident, the categories of personal information involved, the number of individuals affected, and the measures we have taken or plan to take in response.

Princeps's analytics engine produces market-intelligence outputs (price indices, absorption rates, days-on-market trends). These outputs are informational and are presented to you as one input among many in your professional decision-making. We do not make consequential automated decisions about individual Subscribers — such as creditworthiness determinations, eligibility decisions, or employment decisions — based solely on automated processing of your personal data.