Privacy Policy

1. Information We Collect

We collect information you provide directly:

• Account information (name, email, password, business name, business category, jurisdiction)
• Profile documents and credentials you upload (such as proof of insurance, licences, and certifications), including the information contained in them
• Requests you send or receive through the Service

We automatically collect:

• Usage data (pages visited, features used, links shared and viewed)
• Device information (browser type, operating system, IP address)

2. How We Use Your Information

• To create and host your profile and generate your shareable link
• To check the currency of the documents you provide and display their status
• To let you send and receive credential requests
• To send you service communications (such as account, expiry, and request notifications)
• To operate, secure, and improve the Service
• To comply with legal obligations

3. Documents That Describe Other People

The documents you upload may contain information about individuals (for example, a named insured or licence holder). You are responsible for having a lawful basis to upload that information. We process it on your behalf only to provide the Service and do not use it for any independent purpose.

4. Data Storage and Security

Your data is stored on secure servers hosted in Canada (AWS ca-central-1, Montreal). We use industry-standard encryption in transit (TLS) and at rest. Passwords are hashed using bcrypt and are never stored in plain text. Documents are private to your account and are shared only through links or requests that you control.

5. Data Sharing

We do not sell your personal information. We may share data with:

• Service providers who help us operate the platform (hosting, email delivery, payment processing), who are bound to protect it and use it only to provide their service to us
• Businesses you choose to share your link or documents with, or whom you request from
• Brokers, carriers, or issuers, only where you use a feature that expressly confirms a credential and only with your direction
• Law enforcement or regulatory bodies when required by law

6. Anonymized Data

We may use anonymized, aggregated data that cannot identify you or your business to understand demand and improve the Service. This data cannot be traced back to an individual user.

7. Data Breach

We maintain safeguards designed to protect your information. If a breach of security safeguards creates a real risk of significant harm, we will notify affected users and the Office of the Privacy Commissioner of Canada as required by law, and keep records of breaches as required.

8. Your Rights

Under Canadian privacy law (PIPEDA), you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Withdraw consent for non-essential communications

To exercise these rights, contact hello@cavait.com.

9. Cookies

We use essential cookies for authentication and session management. We do not use third-party tracking cookies or advertising pixels.

10. Data Retention

We retain your data while your account is active. If you request deletion, we remove your personal information within 30 days, except where we must retain certain records to meet legal obligations. Anonymized, aggregated data may be retained.

11. Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes by updating the "Last updated" date and, where appropriate, by email.

12. Contact

Privacy inquiries: hello@cavait.com