CastPlan Privacy Policy
Version 1.0 — Effective September 24, 2026
Robert Agarand, operating as CastPlan ("CastPlan", "we"), is a business run from Calgary, Alberta. We follow Alberta's Personal Information Protection Act (PIPA) and, where personal information crosses provincial or national borders, the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Where the two differ, we follow the stricter rule.
1. What we collect
| What | Examples | Why |
|---|---|---|
| Account details | name, work email, company, role, password (stored hashed) | create and secure your account, contact you about it |
| Billing details | billing name and address, plan, invoices. Card numbers go directly to Stripe; we never see or store them | take payment, issue receipts, meet tax rules |
| Project content | briefs you type, drawings you upload, generated drawings, bar lists and reports | provide the service |
| Usage and device data | log-ins, features used, errors, IP address, browser type | keep the service secure and working, fix bugs |
| Messages | support emails, feedback | answer you |
| Marketing preferences | whether you agreed to product news | send news only with consent |
Uploaded drawings can contain names and contact details of other people (for example engineers on a title block). We process these only to provide the service to you.
2. Consent and your choices
We collect only what we need for the purposes above. By creating an account you consent to those uses. You can withdraw consent at any time, subject to legal or contractual limits; if you do, we may not be able to provide the service. Marketing emails are sent only with your consent under Canada's anti-spam law (CASL), and every email has an unsubscribe link that we action within 10 business days.
3. Service providers, including outside Canada
We use these providers to run CastPlan. They process personal information only on our instructions and under contracts that require comparable protection:
| Provider | Service | Where data may be processed |
|---|---|---|
| Lovable / Supabase | website hosting, accounts, database, file storage | United States / European Union |
| Stripe | payments and invoicing | United States and Canada |
| Google (Gemini) and/or OpenAI, through the Lovable AI gateway | reading briefs and uploaded drawings | United States |
| Lovable / Supabase (account emails such as password resets) | account emails such as password resets | United States |
Because some processing happens outside Canada, your information may be accessible to courts, law-enforcement and national-security authorities in those countries under their laws. For more about how our providers handle personal information, contact our Privacy Officer by emailing robertagarand@castplan.ai or using our contact form.
Our AI providers do not use your content to train their models under the API terms we use. We do not sell personal information.
4. How long we keep it
We keep account and project data while your account is open. When it closes we delete project content within 60 days (30 days for you to export, then deletion), except backups, which expire on their normal cycle. We keep billing records for 6 years, as tax law requires, and security logs for 12 months.
5. How we protect it
We use encryption in transit, access controls with least privilege, multi-factor authentication for staff accounts, and regular backups. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify the Information and Privacy Commissioner of Alberta and/or the Privacy Commissioner of Canada and the people affected as the law requires, and we keep a record of every breach for at least 24 months.
6. Your rights
You can ask to see the personal information we hold about you, ask how it has been used and disclosed, and ask us to correct it. We reply within 45 days. Contact our Privacy Officer by emailing robertagarand@castplan.ai or using our contact form.
7. Quebec
If you are in Quebec, the person in charge of the protection of personal information is our Privacy Officer, below. We tell you at collection that information may be processed outside Quebec, and we assess the privacy impact of such transfers.
8. Cookies
We use only the cookies needed to keep you signed in and keep the service secure. If we add analytics cookies, we will update this policy and ask for consent where required.
9. Contact and complaints
Privacy Officer: Robert Agarand, operating as CastPlan · Calgary, Alberta · robertagarand@castplan.ai · contact form
If you are not satisfied with our response, you can contact the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).
We will post any changes here with a new date, and email account holders about material changes.