Privacy Policy
Our privacy policy and how we use your data
01Who we are, and what this covers
778 Dev Canada provides software development, hardware and IT services to businesses, organisations and government in British Columbia. This policy is intended to cover the personal information we handle through this website and the client portal on it — when you ask us for a price, create an account, accept an estimate, or contact us.
It is not intended to cover information we handle as a service provider inside a client’s own systems. When we work on your systems under a services agreement, that agreement governs what we may see and do.
To be drafted
- Confirm the legal entity name and any registration number that should appear here.
- Confirm the scope split above is the one we want, and whether a separate processor addendum is needed for client-system work.
02What we collect when you give it to us
If you ask us to price something, we hold the answers you gave the configurator — device counts, locations, which options you chose — and the estimate they produced. We need them to quote the work and to explain later how a figure was reached.
If you create an account, we hold your email address, your name if you give one, and the organisation you belong to. Authentication is handled by our database provider; we never see or store your password.
If you use the contact form, we hold what you wrote and the address you asked us to reply to.
03What we collect automatically
Three cookies, and no others. A session cookie set by our authentication provider, which keeps you signed in; a signed cookie named 778dev_quote, which carries a configuration you priced before signing in so it is not lost at the sign-in step, and which expires by itself; and a small preference cookie recording whether you chose the light or dark theme.
We set no advertising cookies, no third-party analytics and no tracking pixels. Our hosting provider records ordinary server request logs, as any web host does.
The quote cookie holds a service identifier and the answers you gave. It holds no prices: a quote is always recalculated on our side, so a cookie cannot change what something costs.
To be drafted
- Confirm whether server request logs held by our hosting provider need describing in more detail, and for how long they persist.
04Why we collect it
To price work you asked us to price, to issue and honour estimates, to deliver and support what you buy, to invoice for it, and to answer you when you write to us. We also keep what we need to meet our own tax and record-keeping obligations.
We do not sell personal information, and we do not use it to advertise to you.
05Consent
To be drafted
- How consent is obtained and recorded for each purpose above, and how it may be withdrawn — PIPEDA and PIPA both require this to be explicit.
- Whether any purpose relies on an exception to consent rather than consent itself.
06Who else handles it
We use a small number of service providers to run this software, and each sees only what its function requires: Supabase for the database and authentication, Vercel for hosting, and Resend for transactional email such as sign-in and account messages.
We will add payment processing to this list when it goes live, and a domain registrar when we register names on clients’ behalf. Neither is in use today.
To be drafted
- Name each provider’s role in the language the legislation expects, and confirm what contractual protections are in place with each.
- Confirm whether any of them constitutes a transfer outside Canada that has to be disclosed.
07Where it is stored
To be drafted
- The region our database and backups actually sit in, confirmed against the provider’s configuration rather than assumed, and whether that needs to change for public-sector clients.
- Whether any client or contract requires data residency in Canada, and how that is honoured.
08How long we keep it
To be drafted
- A retention period for each category: accounts, estimates, contact messages, server logs.
- What happens to an estimate that is never accepted, and to an account that is closed.
09How we protect it
Access to data in our database is enforced by the database itself rather than by application code: every table carries row-level security, so a client can read the estimates on their own account and nothing else, and staff access additionally requires two-factor verification. Prices are calculated only on our servers — a request cannot supply an amount.
No system is immune. If personal information in our care is lost or exposed in a way that creates a real risk of significant harm, we will report it as the law requires and tell the people affected.
To be drafted
- The breach-response commitment above needs to match our actual obligations and a process we can carry out.
10Your rights
You may ask what personal information we hold about you and why, ask us to correct it if it is wrong, and ask us to stop using it. Write to the address at the foot of this page and we will respond.
To be drafted
- The response deadline we commit to, and the identity-verification step before we release information.
- How a complaint escalates, including the relevant Commissioner.
11Children
To be drafted
- Whether we state a minimum age for an account, and what happens if we learn we hold a child’s information.
12Changes to this policy
When the final version of this policy is ready it will replace this draft, and the date it takes effect will be shown here. We will not apply a change retroactively to information we have already collected without saying so.
13How to reach us
Write to us at the address in the footer of this site and mark it for the attention of privacy. We will tell you who is handling it.
To be drafted
- PIPEDA requires a designated individual accountable for privacy compliance. Name them, and give the address a request should go to.