Plain-language summary, not legal advice. We wrote this to be read. If anything here is unclear, ask us.
Last updated: October 31, 2026
Who we are
FileSignal (“we”) is an independent company based in Markham, Ontario. We are responsible for the personal information described here. For any privacy question or request, use our contact form and mention “privacy” — it reaches the person accountable for privacy at FileSignal.
What we collect
When you create an account
- Your email address (used to sign in), and optionally your name and company.
- Your account's plan, team members and settings: saved filters, alert schedules, webhooks and API keys (keys are stored only as a hash).
- Usage records needed to run your plan: export logs (how many rows, which filters), API request counts and webhook delivery logs.
When you send a form
- What you type: name, email, company, phone and message, plus the plan or territory you asked about.
- Context: the page you sent it from, campaign (UTM) parameters, the referring site, your IP address and browser user agent. We use these to prevent abuse and to understand which pages bring enquiries.
When you subscribe to a newsletter
- Your email, which newsletter, the exact consent wording you agreed to, the time and your IP address, and the page you signed up on.
- When you confirm (double opt-in) and, if you do, when you unsubscribe. CASL requires us to be able to prove consent.
When you browse
- First-party analytics events. Our own server records a small number of events (for example, a form submitted or a tool used) with the page path, campaign parameters and referrer. They are stored in our database and are not shared with ad networks.
- Vercel Web Analytics and Speed Insights. Cookieless, aggregated page-view and performance measurement. They don't set cookies or build cross-site profiles.
- Cookies. If you sign in, authentication cookies keep you signed in. If you arrive from a campaign link or another website, an
fs_utmcookie remembers that source for 30 days so a later enquiry can be attributed. We use no advertising or third-party tracking cookies.
Why we use it
- To provide the service: sign-in, your feed, exports, digests, webhooks and the API.
- To reply to enquiries, set up accounts and send invoices.
- To send newsletters you have expressly asked for — and only those.
- To keep the service secure: rate limiting, abuse prevention and audit logs.
- To understand, in aggregate, which pages and channels work, so we can improve them.
We don't sell personal information, and we don't use it for purposes you wouldn't reasonably expect from the list above.
How long we keep it
| Information | Kept for |
|---|---|
| Account data and settings | While your account is open, then deleted within 90 days of closure |
| Billing and invoice records | As long as Canadian tax law requires (generally six years) |
| Form submissions | Up to 24 months after our last contact with you |
| Newsletter consent records | While you're subscribed, and for 3 years after you unsubscribe, to evidence consent |
| Analytics events, export and API logs | Up to 24 months |
Who processes it for us
We use a small number of service providers, under contracts that limit their use of your information to providing their service to us:
- Supabase — database and authentication, hosted in Canada (AWS
ca-central-1, Montréal). - Vercel — website hosting, Web Analytics and Speed Insights. Requests may be processed in the United States and other countries.
- Resend — sending transactional email and newsletters. Email addresses and message content pass through its servers in the United States.
Information processed outside Canada is subject to the laws of those countries, and may be accessible to their authorities. If we turn on self-serve card payments, we will name the payment processor here before it goes live. We never store card numbers ourselves.
Your rights
You can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct anything that's inaccurate;
- delete it, unless we have to keep it (for example, invoices);
- withdraw consent — every newsletter has a one-click unsubscribe link.
Send requests through the contact form. We'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.
Business records from public data
The signals FileSignal delivers come from public records that municipalities publish as open data — business licences and permits. A record can include a business's operating and legal name, address, phone number (only when the publisher includes one), licence category and dates. We keep the source and fetch time for every field.
- We remove records at residential addresses and licence types tied to someone's home before anything is shown or delivered.
- We never publish personal names on public pages. Where a registrant appears to be an individual, the record is kept off public pages.
- We don't add contact details from other sources, and we don't scrape websites or use Google Places data.
To request suppression of a record, use the contact form with the business name and address as it appears. We'll review the request and, where appropriate, suppress the record from public pages and future customer deliveries. We keep a minimal suppression marker so the record doesn't reappear the next time the publisher releases it. Records already delivered to customers before suppression are their responsibility under our terms. To correct the underlying public record itself, contact the municipality that published it.
Security
Data is encrypted in transit and at rest. Access to our database is restricted by row-level security; staff access is limited to what's needed to run the service. API keys are stored as hashes. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify you and the Privacy Commissioner as PIPEDA requires.
Changes
If we change this policy in a meaningful way, we'll update the date above and, for account holders, tell you by email before the change takes effect.