RebateOnEnergy

Privacy Policy

Last updated · Version v0.2-draft

Draft, pending lawyer review

This page is a plain-language draft. It becomes final once a New Brunswick lawyer has reviewed it and the defaults in docs/legal/DECISIONS.md are confirmed.

Last updated: 2026-10-14 RebateOnEnergy (rebateonenergy.ca) is run by [your operator name], [your mailing address], New Brunswick ("we"). This policy explains what personal information we collect, why, who we share it with, and your choices. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and its 10 fair information principles.

1. Accountability: our privacy officer

Cameron Brioux, Privacy Officer — privacy@rebateonenergy.ca, [your mailing address], [phone]. They're responsible for our compliance with this policy and PIPEDA.

2. What we collect and why

What When Why
Name, email, phone, postal code/address, home details (heating fuel, home type, project, timing), message You request quotes To pass your request to the installers you choose and let them contact you
Email, province, (optional) first name You sign up for the newsletter or rebate alerts To send the emails you asked for
Business name, contact, billing details Advertisers sign up To run ads and bill; card details are handled by Stripe, not stored by us
Pages viewed, referrer, device/browser type, approximate location (province/city) derived from your IP address You browse To show the right province's rebates and local installers, measure site use, prevent abuse
Emails you send us You contact us To reply

We collect only what's needed for these purposes (we don't ask for income, SIN, or banking details on quote forms). If you use our optional income-band question to estimate eligibility, your answer is used only in your browser and is not sent to us or stored.

  • Quote requests: we ask you to tick a box giving express consent to share your request with the up to 3 installers named on screen. We won't send it to anyone else.
  • Newsletter: you tick a separate, unchecked box and confirm by email (double opt-in).
  • Browsing/analytics: we use privacy-friendly, cookie-free analytics (Plausible) and a geo lookup; see section 9.
  • You can withdraw consent at any time (section 8). Withdrawing doesn't undo a quote request already sent, but we'll tell those installers you've withdrawn where possible.

4. Who we share with

  • Installers you choose: your quote details, only to respond to your request. Our Advertiser Terms require them to use it only for your quote, protect it, and not add you to marketing lists without your own consent. Once they have it, they are also responsible for it under privacy law.
  • Service providers who process data for us under contract: Vercel (hosting, geo headers), Stripe (payments), Resend (email delivery), Plausible (analytics, EU-hosted), [database provider]. They may only use it to provide services to us.
  • Legal reasons: when required by law, or to protect against fraud or abuse.
  • Business sale: to a buyer of the business, under the same protections.
  • We never sell your personal information.

5. Storage outside Canada

Some of our service providers store or process information in the United States and possibly other countries. While there, it is protected by contract but may be accessible to courts, law enforcement and national-security authorities of that country.

6. How long we keep it

  • Quote requests: 24 months, then deleted or anonymized (we need some history for lead billing and disputes).
  • Newsletter: until you unsubscribe, then the address is kept on a suppression list so we don't email you again, plus consent records for 3 years after you withdraw consent.
  • Analytics: aggregated only; Plausible stores no personal data.
  • Billing records: as long as tax law requires (we keep advertiser and billing records 7 years).

7. Safeguards

Encryption in transit (HTTPS), access limited to those who need it, multi-factor authentication on admin accounts, reputable providers, and regular review. No system is perfectly secure.

8. Your rights: access, correction, withdrawal

Email privacy@rebateonenergy.ca to: see what we hold about you and who we've shared it with; correct it; withdraw consent; or ask us to delete it. We'll answer within 30 days (as PIPEDA requires) and may need to confirm your identity. Unsubscribe links are in every email.

9. Cookies and analytics

  • Essential cookies: keep the site working and secure.
  • Analytics: Plausible, a cookie-free tool, counts visits without cookies or tracking you across sites. We use no ad pixels or Google Analytics, so no cookie banner is needed. (If that ever changes, add a cookie banner and opt-out.)
  • Approximate location: Vercel tells us your likely city/province from your IP address so we can show local rebates. We don't store your IP with your quote details. When you tick a consent box, we record your IP address in our consent log as proof of consent, as Canada's anti-spam law expects.
  • Browser settings let you block cookies.

10. Children

This site is for adults (homeowners and businesses). We don't knowingly collect information from anyone under [16].

11. Privacy breaches

If a breach of our safeguards creates a real risk of significant harm to you, we'll notify you directly as soon as feasible, report it to the Office of the Privacy Commissioner of Canada, notify any organization that can reduce the harm, and keep a record of every breach for at least 2 years.

12. Questions and complaints

Contact our Privacy Officer first. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca , 1-800-282-1376.

13. Changes

We'll post updates here with a new date, and email subscribers about significant changes.