Privacy Policy

Effective date: [to be set at launch]

This policy explains what personal information IT Support 101 Inc. ("we", "us") collects through My Company Whiteboard, why, who we share it with, where it's kept, and the choices you have. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Two kinds of information

Account information is what we need to run your account: your name, email address, organisation and billing details. We're responsible for it.

Customer content is what your organisation puts on its boards: drawings, notes, files and chat. It belongs to your organisation, which decides what goes on its boards and who can see them. We hold and process it on your organisation's behalf, under its instructions and our data processing agreement. If you have a question about content on a board, the organisation that owns the board is usually the right place to start.

What we collect

• Your account: name, email address, a scrambled (hashed) version of your password, and, if you turn it on, your authenticator app's secret, which we store encrypted.
• Your organisation: its name, its members and their roles, guests and the boards they're invited to, and its settings.
• What you put on boards: drawings, notes, text, files and chat messages, and who added them.
• Billing: your plan, billing currency and status, and the reference Stripe gives us for your organisation. Stripe collects your card and billing address directly; we never receive your full card number.
• Security and activity records: sign-ins, invitations, changes to settings and other important actions, with the time and the IP address they came from. We also keep a record of the emails we send you (who to, when, and what kind), but not their contents.
• While you're on a board: your cursor position and that you're online, so others can see you. This is kept only for a few seconds.
• Signing up: on the sign-up page only, Cloudflare Turnstile checks that you're a person. Cloudflare may collect information about your browser and device to do this.
• Contacting us: if you use our contact form, your name, email address, company, team size and message, and the IP address it came from. Turnstile checks the form in the same way. We use this only to reply to you and, if you asked for early access, to set up your account.

Why we use it

• to provide the service: signing you in, showing your boards, letting people work together, and sending account emails such as invitations, password resets and billing notices;
• to keep the service and your account secure, including detecting misuse;
• to bill your organisation and keep business records we're required to keep;
• to answer your questions and give you support.

We don't sell or rent personal information, we don't show advertising, and we don't use your boards to build profiles of you.

Cookies

We use one cookie, which keeps you signed in. It's needed for the service to work. We don't use advertising or analytics cookies. Cloudflare Turnstile, on the sign-up and contact pages only, may use its own cookies to check you're a person.

Who we share it with

We use a small number of service providers to run My Company Whiteboard. Each gets only what it needs to do its job, and must protect it.

• Contabo (hosting): the servers that run the service, in a data centre in St. Louis, Missouri, United States. All account information and customer content is stored here.
• Backblaze (backups): encrypted nightly backups, in the United States. The backups are encrypted before they leave our server; Backblaze can't read them.
• Microsoft (email): Microsoft 365 sends our account emails from My Company Whiteboard.
• Stripe (payments): takes card payments and manages subscriptions.
• Cloudflare (bot protection): Turnstile on the sign-up and contact pages.

We may also disclose information where the law requires it, for example under a court order, and to protect the rights and safety of our users or the public. If our business is sold or merged, information may pass to the new owner under this policy.

Where your information is kept

Your information is stored and processed in the United States, by the providers above. While it's there it may be accessed by courts, law enforcement and national security authorities of the United States under its laws. By using My Company Whiteboard, you understand your information will be transferred outside Canada for these purposes.

How long we keep it

• Account information: while your account exists. If you ask us to delete your account, we delete your personal information from the service within 30 days, except where we must keep it by law.
• Customer content: We don't delete boards because they haven't been used. Boards stay until someone with permission deletes them or the organisation's account is closed. If your organisation's subscription ends, we may delete its content 90 days later, after telling its owners first.
• Security and activity records: two years. Email records: 90 days.
• Contact form messages: two years after we've dealt with them.
• Billing records: as long as tax law requires, normally seven years.
• Backups: deleted information disappears from our backups as they're replaced, within about 12 months.

How we protect it

All connections are encrypted. Uploaded files are scanned for malware. Passwords are stored hashed, authenticator secrets encrypted, and backups encrypted. Access is limited to people at IT Support 101 Inc. who need it to run the service. More detail is on our security page.

If a breach of security creates a real risk of significant harm to you, we'll tell you and the Office of the Privacy Commissioner of Canada, as the law requires.

Your choices and rights

You can:

• see and correct your name and email in your account settings;
• ask us for a copy of the personal information we hold about you;
• ask us to correct or delete it;
• withdraw consent to optional uses, though some information is needed to provide the service at all.

Email privacy@itsupport101.com. We'll answer within 30 days. We may need to confirm who you are first.

If you're a guest or member and your question is about content an organisation has put on its boards, we may pass your request to that organisation, since it decides what happens to its content.

Children

My Company Whiteboard is a business service and isn't meant for children. We don't knowingly collect information from anyone under 16.

Changes

We'll post any changes here and update the effective date. If a change matters, we'll also tell your organisation's owners by email.

Contact and complaints

Our Privacy Officer can be reached at privacy@itsupport101.com or by mail at IT Support 101 Inc., 91 King Street East, Suite 135, Bowmanville, Ontario L1C 5E2, Canada.

If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.