Privacy Policy

BackflowFiled is a business name of Ethan Kerr, sole proprietor, 425 Simcoe Street, Victoria, BC, Canada. This policy explains what personal information we handle, why, and what you can do about it. It is written to meet our obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA).

The two kinds of information here

This matters more in our service than in most, so we want to be plain about it.

Your information. When you create an account we collect your name, email address, phone number, company name, professional certification number, and test equipment details. We need these because they are printed on the regulatory forms you produce, and because they identify you as the certified tester who performed the work.

Your customers' information. To produce a test report we hold records about the buildings you service and the people responsible for them — site names, addresses, contact names, email addresses and phone numbers. This information belongs to you, not to us. We hold it on your behalf so that we can produce your documents and send the reminders you ask us to send. We do not sell it, we do not use it to market to your customers, and we do not use it to contact them for any purpose other than the reminders you configure.

The free tools. The compliance audit keeps nothing about you or your list unless you tick its “email me my deadlines” box; if you do, we keep your email, the exact words you agreed to and when, and only the buildings the audit could date (the label you gave, the authority and the due date), so we can remind you before each one. A deadline check or a request for help with a notice keeps the address, due date and email you enter so we can answer you. Every email we send because of these has a stop link, and stopping ends them.

What we do with it

• Produce the inspection and test documents you create, on the layout the authority requires.
• Deliver those documents to the recipients you nominate.
• Send the retest reminders the regulation requires, in your name, to the contacts you record.
• Operate your account: signing you in, billing you, and answering you when you contact us.
• Keep the service secure and working.

We do not sell personal information. We do not use your data, or your customers' data, to train machine learning models.

Document verification

Every document we produce carries a verification code. Anyone holding that code can look it up and see a limited confirmation: the site name and address, the date, the result, and the firm that issued it. This exists so that a building owner or an inspector can confirm a document is genuine.

The verification page shows only information that is already printed on the document itself. It does not show contact details, test readings, notes, or anything about your other customers. Codes are not guessable and the pages are not indexed by search engines.

Where your data lives

Your database records and your documents are stored in Canada, in the Canada (Central) region, through our infrastructure provider. Some processing — serving the website and generating documents — happens on servers in the United States, which means data passes through the United States in transit. We are telling you this because a compliance-minded customer will ask, and because it would be misleading to say “your data is in Canada” without the qualification.

Who else touches it

We use a small number of service providers to run BackflowFiled. Each handles data only to provide their service to us:

• Supabase — database, file storage and authentication (Canada Central region)
• Vercel — application hosting
• Resend — sending email on our behalf
• Stripe — payment processing, if and when you pay by card
• Anthropic — reads the photo or PDF of a test report you email to file@ and transcribes it, and classifies replies to our emails; it does not train on this data
• Cloudflare — receives email sent to our addresses and passes it to us
• ntfy (ntfy.sh) — a short notice to our own phone when you reply to us or pay: your name or email address, your organisation and the first line of your reply, or the amount and what it was for; ntfy keeps it for up to 12 hours
• Province of British Columbia (BC Geocoder) — to place an address in the right municipality, the street and town of each audit row, deadline check or help request are sent, one address at a time; the list is never sent and nothing is kept
• Google — only if you arrived from one of our Google ads: the ad's click id, and the name, time and value of what you did (a deadline check with your email, a booking, a purchase), so we can count which ads work. Never your name, email or address

We do not disclose personal information to anyone else, except where the law requires it of us.

Cookies

We set no third-party cookies and run no advertising pixels or tracking scripts. Our own pages count how many times a day each main button is pressed and each form is started: a number per button, with nothing about who pressed it. The cookies we do set are our own: one that keeps you signed in, if you have an account; one that remembers a partner's referral code for 90 days if you followed their link; and one that remembers which ad or link brought you here, for 90 days — the campaign names in the link, the landing page and, for a Google ad, its click id, which may be sent to Google to count conversions as described above.

How long we keep it

We keep your account and your records for as long as your account is open. Regulatory documents are retained while your account is open because you may need to produce them later — retention periods for backflow, fire and radon records are set by the authority having jurisdiction, and are often several years.

If you close your account we will delete your data within 90 days, except where we are required to keep something for legal or accounting reasons. If you want your data exported before you go, ask and we will send it to you.

Reports emailed to file@backflowfiled.com: the photo or PDF you send, the transcription we make of it and the document we prepare are kept as the record of that filing for as long as the record is, because the verification link and any question from the authority rely on them. An email that carried no readable report, and a filing you discard before approving it, are deleted — the files and the row — within 30 days.

Security

Access to your records is restricted at the database level so that one firm cannot read another firm's data. Connections are encrypted in transit. We do not store passwords — you sign in through a one-time email link or through Google.

No system is perfectly secure. If we ever become aware of a breach that creates a real risk of significant harm to you, we will tell you and report it as required.

Your rights

You can ask us what personal information we hold about you, ask us to correct it, ask for a copy of it, or ask us to delete it. Write to us and we will respond within 30 days.

If you are not satisfied with how we have handled your information, you can complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner for British Columbia.

Contact

BackflowFiled, a business name of Ethan Kerr, sole proprietor
425 Simcoe Street, Victoria, BC V8V 4T3, Canada
help@backflowfiled.com

Changes

If we change this policy in a way that materially affects you, we will tell you by email before the change takes effect.

See also our Terms of Service.