Privacy Policy

Tetra Inspection Inc. ("Tetra", "we", "us") provides third-party quality inspection services, operates the client portal at portal.tetrainspection.com (the "Portal") and publishes the website at tetrainspection.com (the "Website"). This policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have.

We are based in Alberta, Canada. We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).

1. Who this policy covers

This policy covers people who use the Portal — our business clients' staff, supplier and factory contacts invited to a booking, and our own personnel — and people who visit the Website, submit a form on it, request a quotation, subscribe to our newsletter, or book a call with us. Most information in the Portal is business information — company names, factory addresses, purchase orders, product specifications. Some of it is personal information, and that is what this policy is about.

2. What we collect

Information you give us

• Account details — name, work email address, phone number, job title, the organization you belong to, and your role within it.
• Booking details — the information needed to perform an inspection: supplier and factory names, contact people at those sites, addresses, product and style descriptions, quantities, purchase order references, inspection dates and instructions.
• Billing details — billing contact, billing address, tax treatment and currency preference.
• Enquiries and quotation requests — when you submit a form on the Website, ask for a quotation, subscribe to our newsletter, book a call, or send a message to the chat assistant on the Website, we collect your name, work email address, phone number, company name, the messages you send, and what you tell us about your enquiry.
• Communications — messages you send us through the Portal, including inspection chat and support requests, and any documents or images you attach, and email correspondence with our team.

Information generated by the service

• Inspection records — reports, findings, measurements, defect records and photographs taken by inspectors at a site. Photographs of a production floor may incidentally include people.
• Account and audit records — sign-in events, and a log of actions taken on bookings, invoices and reports, including who took them and when. These records exist so that changes to commercial and financial records are traceable.

Information collected automatically

• Technical data — IP address, browser and device type, operating system, and pages requested, recorded in server logs for security and troubleshooting.
• Website usage — on the Website only: pages visited, time spent on a page, referring and exit URLs, device identifiers and screen resolution, location at country or region level, and interaction patterns such as clicks, scrolling and navigation paths. This is collected through the analytics providers named in section 4, and only where you have allowed analytics cookies.
• Cookies — see section 7.

What we do not collect

We do not collect payment card numbers. Card details are entered directly into Stripe's hosted checkout and never reach our servers; we receive only a payment confirmation, the amount, the currency, and a token identifying the transaction. We do not sell personal information. If you allow personalisation cookies, Meta Platforms and LinkedIn may use them to show you our advertising on their platforms and to measure its effect.

3. Why we use it, and our legal basis

We rely on your consent, on the necessity of processing to perform our contract with your organization, and on our legitimate business interest in operating and securing the service. Where consent is the basis, you may withdraw it — see section 8.

4. Who we share it with

We share personal information with service providers who process it on our behalf, under contract, only for the purposes we specify. We do not sell it or disclose it for anyone else's marketing.

Artificial intelligence

Two Portal features use a large language model: a booking assistant that helps you describe an inspection in your own words, and a drafting step that turns an inspector's photographs, measurements and defect records into readable report text. Booking details and inspection content are sent to the language model providers named in the table above for that purpose, through our workflow automation service.

The chat assistant on our website also uses a large language model. What you type into it, and the conversation it produces, are sent to OpenAI so it can answer you. Do not put anything confidential into the chat; use the contact form or email for that.

Information sent through these features, including the website chat assistant, is not used to train AI models, and these features do not send accounting or payment data to a model. Invoices, payments and the QuickBooks integration run in a separate part of the system that these features never touch.

Our staff and internal workflow tools may also use AI tools to help prepare correspondence and internal work.

We also share information where we are required to by law, where necessary to establish or defend a legal claim, and — if Tetra is ever involved in a merger, acquisition or sale of assets — with the party to that transaction, subject to this policy.

Information stored outside Canada

As the table shows, most of our providers process and store data in the United States, and some in Canada, the United Kingdom and the European Union. Information held in another country is subject to the laws of that country, and may be accessible to its courts and law enforcement. By using the Portal you acknowledge this transfer. Our providers are bound by contract terms that protect personal information.

To perform inspections, booking details, including factory contacts and site addresses, are also shared with our inspectors and operations team outside Canada, including in Hong Kong, mainland China, India and the other countries where a client books an inspection. They use this information to schedule and carry out inspections and to prepare reports. For more information about our practices outside Canada, contact our Privacy Officer.

5. How we protect it

• Traffic between you and the Portal is encrypted with TLS.
• Data is encrypted at rest by our storage providers.
• Particularly sensitive values, such as accounting-system credentials, are encrypted by us before they are stored, so they are unreadable in the database itself.
• Access is controlled at the database level: rules enforce that one organization cannot read another organization's bookings, reports or invoices, independently of the application.
• Staff access is limited by role to what each person needs, and actions on commercial and financial records are recorded in an audit log.

Report links

Inspection report files are served from long, unguessable web addresses so that you can forward a report to a supplier or customer who has no account with us. Anyone holding the link can open that report without signing in. This is deliberate — it is what makes a report shareable — but it means a link is worth treating like the report itself. Tell us if one needs to be withdrawn.

No system is perfectly secure. If a breach occurs that creates a real risk of significant harm, we will notify affected individuals and report it to the Office of the Information and Privacy Commissioner of Alberta and the Office of the Privacy Commissioner of Canada, as the law requires.

6. How long we keep it

We keep personal information only as long as needed for the purposes above, or as long as the law requires.

• Account information — for as long as the account is active, plus 2 years after the last activity.
• Inspection records and reports — at least 5 years, as the commercial record of work performed, since clients rely on them long after an inspection.
• Invoices, payments and accounting records — at least 6 years, as required by Canadian tax law.
• Marketing consent records — for as long as the consent is valid, plus 1 year after withdrawal.
• Enquiries and leads — for as long as we are in contact about the enquiry, plus 2 years, after which an enquiry that never became an order is deleted.
• Server and audit logs — retained for a limited period for security and troubleshooting.

When information is no longer needed we delete it or render it anonymous. Note that deleting an account does not delete the financial records the law requires us to keep.

7. Cookies

On the Portal we use only cookies that are necessary for it to work: keeping you signed in, maintaining your session, and protecting against cross-site request forgery. The Portal uses no advertising cookies and no third-party tracking cookies. Blocking essential cookies in your browser will prevent you from signing in.

On the Website we use three categories: essential cookies, which the site needs to work and which cannot be disabled; analytics cookies, which help us understand how visitors use the site and which enable session recording, a replay of a visit's clicks, scrolling and navigation with form fields and other privacy-sensitive content masked; and personalisation cookies, which let Meta (Facebook, Instagram) and LinkedIn show you our advertising on their platforms and measure whether it worked. Analytics and personalisation cookies, and session recording, are used only if you allow them. You can accept, decline, or change your choice at any time through the cookie banner on the Website or through your browser settings, and your choice is remembered for one year.

8. Your rights

Under PIPEDA and Alberta PIPA you may:

• ask what personal information we hold about you, and get a copy;
• ask us to correct information that is inaccurate or incomplete;
• withdraw your consent to a use, subject to legal and contractual limits — withdrawing consent to essential processing may mean we can no longer provide the service;
• ask us to delete information we no longer have a legal or business reason to keep;
• complain about how we have handled your information.

Write to us at the address in section 10. We will respond within 30 days. We may need to verify your identity first. If information was provided to us by your employer as part of a business relationship, we may direct your request to them.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.

For EU/EEA residents (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR). We process your data on one or more of the following legal bases: your consent, performance of a contract, compliance with legal obligations, or our legitimate business interests. You have the right to lodge a complaint with your local data protection authority. Our providers are bound by contract terms that protect personal information. Where EU or EEA personal data is transferred outside the EU or EEA, we use the safeguards required by law.

For California residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale or sharing of personal information. We do not sell personal information. Allowing personalisation cookies may count as "sharing" for cross-context behavioural advertising under the CCPA; declining them, or using the cookie banner to withdraw that choice, is how you opt out.

9. Children

The Portal is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18.

10. Contact us

Questions, requests and complaints about privacy go to our Privacy Officer:

• Email: info@tetrainspection.com
• Tetra Inspection Inc., 407 9 Ave SE, Calgary, AB T2G 2K7, Canada

11. Changes to this policy

We may update this policy as the service changes. The effective date at the top shows when it was last revised. If a change materially affects how we handle your personal information, we will notify you through the Portal or by email before it takes effect.