CANalitica

Privacy Policy

CANalitica Professional Services Inc. Last Updated: July 29, 2026

Who We Are

Our website address is https://canalitica.ca. Our application, CANalitica PMBI (“PMBI” or the “Service”), is accessed at https://app.canaliticapmbi.ca.

CANalitica Professional Services Inc. (“CANalitica”, “we”, “us” or “our”) is a Canadian company that develops and operates PMBI, a cloud-hosted software-as-a-service application for capital project analytics. We take the protection of personal information seriously.

This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in connection with:

(a) our website, canalitica.ca; and (b) the PMBI application and related support services.

This Policy is written to be consistent with the Personal Information Protection and Electronic Documents Act (Canada), S.C. 2000, c.5 (“PIPEDA”) and is governed by the laws of Ontario and the laws of Canada applicable therein. It is not a contract and does not create contractual rights; it is a statement of our practices consistent with Schedule 1 of PIPEDA.

If you are located outside Canada, see “International Users” below.

Contact Information / Privacy Officer

If you have questions about this Policy, wish to exercise a privacy right, or want to make a complaint, contact us at info@canalitica.ca.

The identity of our Privacy Information Officer (“PIO”) is available upon written request, as required under Principle 4.1.2 of PIPEDA. Our PIO is always a single individual who is a CANalitica owner and is responsible for:

(a) implementing the procedures in this Policy; (b) enforcing this Policy and correcting any breach; and (c) reviewing and responding to communications relating to this Policy or PIPEDA.

Written responses to privacy inquiries will include the name and contact details of the person providing the response.

For questions specifically about using PMBI — platform features, data uploads, or account access — please instead contact pmbisupport@canalitica.ca.

Our Purpose

We collect, use, and disclose personal information in order to:

  • Provide, operate, and support the PMBI application, including provisioning workspaces, managing user access, and processing data uploads and reporting snapshots;
  • Communicate with you about your subscription, account, and service-related matters, including planned maintenance, outages, or security incidents;
  • Respond to support requests sent to pmbisupport@canalitica.ca or general inquiries sent to info@canalitica.ca;
  • Maintain the security, integrity, and proper functioning of our website and the Service;
  • Meet our legal, regulatory, and accounting obligations.

We do not use personal information for marketing purposes. We do not currently send, and do not plan to send, newsletters or promotional email campaigns. Any email we send to your account’s registered address will relate to your subscription, your account, or the operation of the Service — including time-sensitive notices we consider important for you to receive promptly.

If we change our Purpose, we will post an updated Privacy Policy on our website.

Personal Information We Collect, Use, and Disclose

Account and Subscription Information When your organization subscribes to PMBI through Microsoft Marketplace, we receive the email address associated with the Microsoft account used to complete the purchase, and we use it to provision your organization’s workspace and create the first administrator account.

User Directory Information PMBI uses Microsoft Entra ID for authentication. When your administrator adds a user, they provide that person’s Microsoft Entra ID email address (User Principal Name); a display name is populated automatically at first sign-in. We use this information to authenticate users, apply role-based access, and maintain a record of workspace activity. Deactivated users’ records are kept rather than deleted, to preserve historical activity records, unless your organization requests removal or your subscription ends.

Customer Project Data To generate your dashboards, your organization uploads or connects project data to PMBI — cost, schedule, and work-breakdown-structure information — via Excel/CSV upload or a direct SQL Server connection. This data is primarily organizational and financial in nature, but it may incidentally include personal information (for example, names associated with project tasks or ownership).

For this category of data, your organization is the party responsible for the personal information, and CANalitica acts only as a service provider processing it on your organization’s instructions, for the purpose of providing the Service. Your organization is responsible for having the necessary rights and authority to upload this data, and for informing your own personnel as appropriate. CANalitica does not use Customer Project Data for any purpose other than providing, maintaining, and supporting PMBI, and does not sell or independently repurpose it.

SQL Connection Credentials If you connect PMBI to a SQL Server data source, connection credentials are encrypted and used solely to retrieve data during uploads and reporting snapshots. We recommend using a dedicated, read-only database account for this connection.

AI Summary Feature (Optional) On select plans, PMBI offers an optional “AI Summary” feature. If you choose to use it, a structured summary of your project’s EVM metrics — not your raw uploaded files — is submitted to a third-party AI model provider (such as Anthropic and OpenAI) to generate a plain-language narrative. This feature only runs when a user actively requests it for a given report view. Available model providers may change over time as we add or update supported models.

Website and Device Information When you visit canalitica.ca, we (and our cookie/analytics tools) may collect standard device information: browser type and version, IP address, time zone, cookie identifiers, pages viewed, and similar technical data. See “Cookies” below.

Communications If you contact us by email (e.g., pmbisupport@canalitica.ca or info@canalitica.ca), we retain that correspondence, including any personal information you choose to include, in order to respond to and keep a record of the request.

Information We Do Not Collect CANalitica does not collect or store payment card, banking, or billing details. All PMBI transactions are processed entirely through Microsoft Marketplace; we never see or handle your payment information directly.

A Note on Roles: Your Organization vs. CANalitica

For Account and User Directory Information, CANalitica is responsible for that personal information under PIPEDA, and this Policy describes our practices directly.

For Customer Project Data your organization uploads into PMBI, your organization determines what is uploaded and remains responsible for it as between us; CANalitica processes it strictly as your service provider, at your direction, for the purpose of operating PMBI on your behalf.

Consent

By subscribing to PMBI through Microsoft Marketplace and completing workspace setup, your organization’s administrator consents to this Policy on behalf of the organization. When an administrator adds additional users, those users’ basic contact information (their Entra ID email address, and later their display name) is collected and used as necessary to give them access to the Service at their administrator’s direction; administrators are responsible for informing their own personnel that their information will be used this way.

For our website, if you submit information to us directly (for example, by email), your provision of that information is your consent for us to use it to respond to you.

You may withdraw consent at any time by emailing our Privacy Information Officer at info@canalitica.ca. We will explain any implications of withdrawing consent — for example, that we may not be able to continue providing the Service without certain account information.

Limiting Collection, Use, Disclosure, and Retention

We only collect, use, and disclose personal information reasonably necessary to operate PMBI, support our customers, and run our website. We do not use deceptive, fraudulent, or unlawful means to collect information.

Disclosure to Third Parties (Service Providers) We disclose personal information to the following categories of third parties, only as needed to provide the Service:

  • Microsoft — for cloud hosting (Azure), authentication (Microsoft Entra ID), report rendering (Power BI), and subscription billing (Microsoft Marketplace).
  • Third-party AI model providers (such as Anthropic) — solely when a user actively uses the optional AI Summary feature, and limited to structured EVM metric summaries rather than raw uploaded data.

We do not sell personal information, and we do not disclose Customer Project Data to any third party except as described above or as required by law.

Cross-Border and International Data Transfers PMBI’s core application data — including data submitted through Excel/CSV upload and SQL Server connections, and the report data generated from it — is hosted on Microsoft Azure in the Canada Central and Canada East regions. Some ancillary processing occurs outside Canada: Microsoft Marketplace billing is managed by Microsoft globally, and the optional AI Summary feature relies on third-party AI providers that may process data in the United States or other jurisdictions. As a result, some personal information may be transferred to, stored, or processed outside Canada, and may be subject to the laws of those jurisdictions, including lawful access requests by foreign authorities.

Retention

  • User Directory records are retained for as long as your organization’s subscription is active. Deactivated users’ records are kept, rather than deleted, to preserve historical activity, unless you request deletion.
  • Customer Project Data is retained for up to 90 days after your subscription is cancelled or terminated, to allow for reactivation or export, after which it is deleted from our production systems, followed by removal from backups per our standard backup rotation.
  • Support correspondence and account records may be retained longer where necessary to meet legal, accounting, or audit obligations.

Destruction of Personal Information We destroy electronic information by deletion. If any physical hardware is decommissioned, we ensure it is securely wiped or physically destroyed.

Our Safeguards to Protect You

We protect personal information using measures including:

  • Authentication via Microsoft Entra ID rather than separately managed passwords;
  • Encryption of data in transit and at rest, including SQL connection credentials;
  • Role-based access controls within PMBI, and dedicated Power BI datasets for tenant-level data isolation on select plans;
  • Restricting internal access to personal information to what is needed to operate and support the Service;
  • Ongoing review of our safeguards as our infrastructure and the threat landscape evolve.

No transmission over the Internet or electronic storage method can be guaranteed 100% secure, and we cannot guarantee absolute security of information transmitted to us.

In the event of a data breach involving personal information that poses a real risk of significant harm, we will notify affected individuals and report to the Privacy Commissioner of Canada, as required under PIPEDA.

Your Ability to Access Your Information

If you are a user within a PMBI workspace, your organization’s administrator manages your basic account information (name, email, role, project access) directly within the application and is your first point of contact for corrections.

For any other request to access, correct, or delete personal information we hold — including a request from an administrator regarding your organization’s data, or a request related to our website — contact our Privacy Information Officer at info@canalitica.ca with enough detail to identify the information you’re asking about. We will respond within 30 days of a signed request.

We will provide access as required by PIPEDA, subject to standard exceptions (for example, information that would reveal another individual’s confidential information, or information we’re legally required to withhold). Summary information is provided at no cost; requests requiring significant retrieval effort may be subject to a reasonable fee, which we will disclose in advance.

Cookies

Our website, canalitica.ca, uses cookies and similar technologies to operate certain features and to understand how visitors use the site. You can manage your cookie preferences using the consent banner on our site. Declining non-essential cookies may limit some website functionality but will not affect your ability to use the PMBI application, which relies on authentication session tokens rather than marketing cookies.

Children

PMBI is a business-to-business product intended for use by working professionals within our customer organizations, and our website is intended for a business audience. Neither is directed at, nor knowingly used to collect information from, individuals under the age of 18.

International Users

PMBI is available to any organization that can access it through Microsoft Marketplace, regardless of location. While our practices are grounded in Canadian privacy law, we will make reasonable efforts to honour privacy requests consistent with the law applicable to you. If you are located outside Canada and have questions about how local law applies to your use of PMBI, please contact us at info@canalitica.ca.

Changes to This Policy

We reserve the right to change this Privacy Policy at any time by posting a new version on our website. In the event of a conflict between versions, the version later in time prevails.

Questions or Concerns

If you have questions or concerns about this Privacy Policy or how we’ve handled an access request, please contact our Privacy Information Officer at info@canalitica.ca. We will investigate and respond.