Skip to main content
CommunATI

Privacy

Last updated May 14, 2026· 8 min read· PIPEDA + Quebec Law 25 + FIPPA (for school-division orgs)

What we collect

We collect only what a STEM program needs to run an event. Names, emails, school division, competitor age bands, volunteer hours, and photos (with consent).

What we don't collect: What we don't collect: SIN, health data, biometrics, browsing history, location beyond venue.

How we use it

To run events. To deliver scores, hours, and photos to families. To support sponsors with aggregate metrics only.

We do NOT: We do NOT sell data, run ads, profile minors, or share with third parties beyond Stripe (payments) and Supabase (hosting).

Data residency

All competitor data stored in AWS ca-central-1 (Montréal). Backups in Canada.

Retention & deletion

Active events: while the org is registered. Inactive: 7 years for tax and audit. Photos: deletable on demand at any time.

Breach notification

We notify affected families within 72 hours of confirmation, and the Office of the Privacy Commissioner if material.

Your rights

You can request a copy, correction, or deletion at any time via Settings → Privacy → Your data.

How to reach us

privacy@communati.ca — replies within one business day.

FIPPA notice: FIPPA notice: if your org is operated by a Manitoba school division, FIPPA also applies. We follow whichever law is stricter for any given category.