Privacy Policy

Last updated: March 15, 2026

Nimpact Environmental Ltd is a Canadian company. This policy explains what personal information we collect through nimpact.ca and our services, how we use it, and your rights under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

We've written this in plain language because we believe you should actually understand what you're agreeing to.

What We Collect

The data we collect depends on which of our services you use:

Visitor Analytics

• IP address and approximate geographic location
• Pages visited, referral source, and visit timestamps
• Browser and device type

Farm Report Accounts

• Email address
• Password (stored as a secure hash, never in plain text)
• Order history and report data
• Farm/property coordinates submitted for reports

Beach Report System

• Report job data (coordinates, report parameters, generated outputs)
• Email address (for report delivery)

Tutor Sessions

• Session data including questions asked and responses generated
• Session timestamps and duration

How We Use Your Data

• To create and deliver the reports and services you request
• To maintain your account and process orders
• To understand how visitors use our site (analytics)
• To improve our services and fix issues
• To communicate with you about your orders or account

We do not sell your personal data. We do not share it with third parties for marketing purposes.

Payment Processing

All payments are processed by Stripe. We never see, store, or have access to your credit card number or full payment details. Stripe handles all card data in compliance with PCI-DSS standards. We only receive confirmation of payment status and basic transaction information (amount, date, product purchased).

Cookies

We use session cookies to keep you logged in to your account. These are essential for the service to function. We do not use third-party tracking cookies, advertising pixels, or cross-site tracking.

Data Retention

• User accounts: retained until you request deletion
• Report data: retained for 1 year after generation
• Visitor analytics: retained for 90 days, then automatically deleted
• Tutor sessions: retained for the duration of active service use

You can request deletion of your data at any time.

Where Your Data Is Stored

All data is stored on servers located in Canada. We do not transfer personal data outside of Canada except through Stripe's payment processing infrastructure, which operates under its own privacy and data protection policies.

Your Rights Under PIPEDA

Under Canadian privacy law, you have the right to:

• Access the personal information we hold about you
• Correct any information that is inaccurate or incomplete
• Delete your personal data (subject to any legal retention obligations)
• Withdraw consent for data collection going forward

To exercise any of these rights, email us at info@nimpact.ca. We will respond within 30 days.

Children's Privacy

Our services are not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Security Practices

We take the security of your data seriously. Our systems undergo regular security audits covering payment flow integrity, access control, data isolation, and vulnerability assessment. Specifically:

• All payment processing is handled by Stripe with server-side verification — we never store card details
• Sensitive files and source code are blocked from public access via server-level rules
• API endpoints require authentication and are rate-limited to prevent abuse
• User data is isolated — users can only access their own reports and account information
• Promo codes and payment sessions are protected against replay and race-condition attacks
• Nightly encrypted backups ensure data resilience

Last security audit: March 2026.

Changes to This Policy

If we make significant changes to this policy, we will post a notice on nimpact.ca and update the "Last updated" date at the top of this page. For material changes that affect how we handle your personal information, we will notify affected users by email where possible.