Privacy notice
This notice explains what personal information PGR Delta Systems Corp. ("Deltasys", "we", "us") collects when you use the Deltasys website and the Planner, Estimator and Portfolio applications, why we collect it, who we share it with, and the choices you have. It is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and to be clear to users elsewhere.
1Scope
This notice covers the website at which it is published, the Deltasys applications that run in your browser, the cloud workspaces offered through them, and our correspondence with you. It does not cover third-party websites or software that you use alongside Deltasys, such as the scheduling or spreadsheet software you exchange files with.
Where you use Deltasys through a workspace run by your employer or another organization, that organization decides what goes into the workspace and who may see it. It is the controller of that content; we process it on the organization's behalf. Questions about how your organization uses the workspace should go to it first.
2In short
- Without an account, your projects stay on your device. Nothing about them is sent to us.
- With an account, we hold your name, email address, a hashed password, and the projects and setup you put in a cloud workspace.
- We use this to run the service, keep it secure and bill for it when paid plans begin. Nothing else.
- We do not run advertising or behavioural analytics, do not sell personal information, and do not train models that serve other customers on your content.
- Your data is stored in Toronto, Canada, on infrastructure provided by Akamai (Linode). Payments are handled by Stripe.
- You can see, correct, export and delete your information. Write to hello@pgrdelta.com.
3Using the apps without an account
The Planner and Estimator work without signing in. In that mode your projects are kept in your browser's storage and, if you choose a folder, in autosave files on your device. They are not transmitted to Deltasys. Clearing your browser's site data removes the browser copy; the files in your folder are under your control. The only information that reaches our servers in this mode is the ordinary web traffic needed to load the application, described in section 4.
4What we collect
| Information | Where it comes from | Examples |
|---|---|---|
| Account details | You, when you sign up or edit your account | Name, email address, password (stored only as a salted hash), date the account was created |
| Workspace details | You and your workspace's owners | Workspace name, your role, the email addresses of people invited and who invited them |
| Workspace content | You and the members of your workspace | Projects (schedules, activities, resources, costs, baselines, progress, risk analyses, change records), estimates, enterprise setup such as the OBS, resource list and WBS templates, and the summary figures shown in the portfolio. This content may include personal information you choose to put in it, such as the names of managers or crew members. |
| Session and security records | Generated when you use the service | A session token, when it was created and when it expires; a log of account and workspace events (sign-up, sign-in, workspace creation, invitations, project deletion, billing events) with the time and the account involved |
| Billing details | Stripe, when paid plans begin | Stripe customer and subscription identifiers, plan and subscription status. Card numbers are held by Stripe, not by us. |
| Web server records | Generated when your browser connects | IP address, time, requested address, browser type, and the result of the request, as recorded by the web server for security and troubleshooting |
| Correspondence | You, when you write to us | Your messages and contact details |
We do not collect telemetry about how you use the applications, and we do not use tracking pixels, advertising identifiers or fingerprinting.
5Why we use it
- To provide the service: to create and secure your account, to store and synchronize your workspace, to show projects to the members entitled to see them, and to send invitations you ask us to send. We rely on the contract between us for this.
- To keep the service safe: to detect and investigate unauthorized access, abuse and faults, using session and security records and web server records. We have a legitimate interest in doing so.
- To bill for the service: to manage subscriptions and payments when paid plans begin, and to keep the accounting records the law requires.
- To communicate with you: to answer your messages, to tell you about changes to the service or to these documents, and to send service notices such as security alerts. We do not send marketing email unless you ask for it, and you can withdraw that at any time.
- To meet legal obligations and to establish, exercise or defend legal claims.
Where consent is the basis for processing, for example for optional marketing, you may withdraw it at any time without affecting the service.
6Cookies and browser storage
We use one cookie, pgr_session, which keeps you signed in. It holds a random session token, is marked HttpOnly and Secure, and expires after 30 days or when you sign out. It is strictly necessary for the service and is not used for tracking.
The applications also use your browser's local storage to keep your projects when you are not using a cloud workspace, and to remember preferences such as the theme, open windows, layouts and the last workspace you used. This data stays in your browser and is not sent to us except as part of a cloud workspace you have chosen to use. There are no advertising or analytics cookies.
7Who we share it with
We share personal information only as follows:
- Members of your workspace see your name and email address, and the content in the workspace.
- Service providers that process information on our behalf under contract and only on our instructions:
- Akamai Technologies (Linode), which hosts our servers and storage in Toronto, Canada;
- Stripe, which processes payments and holds card details when paid plans begin. Stripe is a controller of the payment information it collects, under its own privacy policy;
- Google Fonts, which serves the typefaces on the public website. Your browser's request for a font sends your IP address to Google. The applications themselves do not load fonts from Google.
- Successors, if Deltasys is involved in a merger, acquisition or sale of assets, in which case we will notify you before your information becomes subject to a different notice.
- Authorities and others where the law requires it, to respond to a valid legal process, or where necessary to protect the rights, safety or property of Deltasys, our users or the public.
We do not sell personal information and do not share it with advertisers or data brokers.
8Where it is stored
Our servers and backups are located in Toronto, Ontario, Canada. Stripe processes payment information in the United States and other countries under its own safeguards. Google serves fonts from locations near you. If you use the service from outside Canada, your information is transferred to Canada, whose privacy law the European Commission has recognized as adequate for commercial organizations. Where a transfer leaves Canada we rely on the recipient's contractual commitments and, for the European Economic Area and United Kingdom, on standard contractual clauses or an adequacy decision.
9How long we keep it
| Information | Kept for |
|---|---|
| Account details | While the account exists, then deleted within 30 days of a deletion request |
| Workspace content | While the workspace exists. A deleted project or workspace is removed from the live database at once and falls out of backups within 30 days |
| Session records | 30 days from creation, or until sign-out |
| Account and workspace event log | 12 months |
| Web server records | Up to 30 days |
| Billing records | 7 years after the transaction, as required for tax and accounting |
| Correspondence | Up to 3 years after the last exchange |
We may keep information longer where the law requires it or where it is needed for a legal claim, and we may keep anonymized data, which no longer identifies anyone, indefinitely.
10Security
We protect personal information with measures appropriate to its sensitivity, including encryption in transit (TLS for every connection), password hashing with a modern key-derivation function, HttpOnly and Secure session cookies, role-based access to workspaces, firewalled servers with access limited to named administrators, and regular backups. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as the law requires.
11Models and your data
Deltasys includes forecasting and risk models that run on the projects in your workspace. These models compute results for you from your own data. We do not use your content to train models that are offered to other customers, and we do not share it with model providers for their own purposes. Where a feature in future would send part of your content to a third-party model provider, we will say so in the feature, name the provider, and give workspace owners the choice to enable it.
12Your rights and choices
Subject to the law that applies to you, you may:
- access the personal information we hold about you and learn how it has been used and disclosed;
- correct information that is inaccurate or incomplete. Your name can be changed in your account; write to us for anything else;
- export your content. Every project and table in the service can be exported to standard formats at any time;
- delete your account and the content you own. Workspace content shared with others is owned by the workspace; its owners can delete it;
- withdraw consent where processing is based on it, and object to or ask us to restrict processing where the law allows;
- complain to a supervisory authority. In Canada this is the Office of the Privacy Commissioner of Canada. Users elsewhere may contact their local authority.
To exercise these rights, write to hello@pgrdelta.com from the email address on your account. We will respond within 30 days and may ask for information needed to confirm your identity. There is no charge, except where the law allows one for repeated or excessive requests.
13Children
The service is for business and professional use and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.
14Changes to this notice
We may update this notice from time to time. The effective date at the top shows the current version. For material changes we will give notice by email to account holders or in the service before the change takes effect. Earlier versions are available on request.
15Contact
Our privacy officer is responsible for this notice and for answering questions and requests about personal information.
Privacy Officer
PGR Delta Systems Corp.
Ontario, Canada
hello@pgrdelta.com