Privacy Policy

Last updated: September 12, 2026

This policy explains what personal information EXCIVY collects when you use our website and application, why we collect it, who we share it with, where it is kept, and the choices you have.

1. Scope

This policy applies to excivy.com and to the EXCIVY application (together, the “Service”). EXCIVY is based in Ontario, Canada, and handles personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy law.

The business records a customer company keeps in the Service (inventory, stamps, recipes, documents, reports) belong to that company and are governed by our Terms of Service. This policy covers the personal information of the people who use the Service and of the contacts at our customer companies.

2. What we collect

Account details. Name, work email address, phone number and role for each person who has a login.
Company details. Business name, excise licence number, address and the contact person’s name, email and phone.
Usage. Pages visited within the Service, the referring page, device type, browser and operating system, and an approximate location (city, region and country) derived by our hosting provider. We do not store your IP address.
Sign-in activity. The time of each sign-in, the device and browser used, and records of sessions ended because a newer sign-in replaced them.
Security records. One-time sign-in codes sent to your email, and a hashed token that lets us recognise a device you have recently verified.
Error logs. Technical details of errors that occur while you use the Service, which may include your user and company identifiers.
Support correspondence. Emails you send to us and our replies.
Documents you upload. PDF files attached to your records, which may contain personal information about your staff or business partners.
Billing records. Invoices, receipts and payment status for your company.

3. Why we use it

To provide the Service and let you sign in securely.
To enforce one named person per seat and detect shared logins.
To bill your company and send invoices and receipts.
To answer support requests and fix problems.
To understand how the Service is used and improve it.
To meet our legal obligations and protect the Service from misuse.

We do not use your information for advertising and we do not sell it.

4. Cookies

The Service sets only the cookies it needs to work:

Sign-in session cookies, which keep you signed in and expire when the session ends.
A trusted-device cookie (excivy_2fa_trust) set after you complete email verification, so you are not asked for a new code on the same device for the next 8 hours. It contains a random token only.

We do not use third-party analytics, advertising or tracking cookies. Page-view statistics are collected by our own software and are not shared with any analytics provider.

We use a small number of service providers to run the Service:

Supabase for our database, user authentication and file storage.
Vercel for hosting and delivering the application.
EXCIVY’s own email server for sending sign-in codes, invoices, receipts and notices.

These providers process information only on our instructions. We may also disclose information where the law requires it, for example in response to a valid court order or a request from a regulator, or to protect the rights, safety or property of EXCIVY, our customers or others.

6. Where it is stored

Your information is stored in Canada.

7. Support access

EXCIVY staff may access a company’s data for support sessions or to fix problems.

8. How long we keep it

Account, company and business records: for as long as your company’s account is active.
Page-view statistics: 13 months.
Error logs: 90 days.
One-time sign-in codes and trusted-device records: until they expire, then removed.
After an agreement ends: your company has 30 days to export its data, after which we delete it.

9. How we protect it

All traffic between your browser and the Service is encrypted.
Each company’s data is isolated from every other company’s at the database level.
Sign-in requires a password and a one-time code sent to your email.
Only one active session per user is allowed; a new sign-in ends the previous one.
Changes to business records are logged so your company can see who did what and when.

10. Your rights

You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it. If you use the Service through a customer company, contact your company’s account owner first, since they manage your account. You can also write to us at support@excivy.com. We will respond within 30 days.

If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner of Canada.

11. Changes and contact

We may update this policy from time to time. For any material change we will email your company’s account owner at least 30 days before it takes effect, and we will update the date at the top of this page.

Questions about privacy: support@excivy.com.