Legal agreements and Canadian compliance

Provider will make the Van Permit Audit platform available to Customer on a subscription basis as described in the applicable Order Form. Provider may update the platform at any time provided that material reductions in functionality are communicated with 30 days' notice.

Customer may use the platform solely for its internal business purposes. Customer may not resell, sublicense, or white-label the platform without a separate written agreement. Customer is responsible for ensuring all users comply with the Terms of Service.

Fees are set out in the Order Form. Subscription fees are billed monthly or annually in advance. All fees are in Canadian dollars (CAD) unless otherwise stated, and are non-refundable except as expressly stated. Provider may increase fees on 60 days' written notice; Customer may terminate without penalty before the increase takes effect.

Provider targets 99.5% monthly uptime for the API and analysis pipeline, excluding scheduled maintenance (notified 48 hours in advance) and events outside Provider's reasonable control. If monthly uptime falls below 99.5%, Customer's sole remedy is a service credit equal to 5% of the monthly fee per full percentage point below the target, up to a maximum of 30% of the monthly fee. Credits do not accrue as cash and expire 90 days after issuance.

Customer retains all rights to documents uploaded and reports generated. Customer grants Provider a limited, non-exclusive licence to process Customer data solely to deliver the service. Provider will not use Customer data to train AI models or share it with third parties except as necessary to operate the service (see the DPA below).

Each party agrees to keep the other party's non-public business information confidential for the term of this agreement and for two years after termination. Confidential information does not include information that is publicly known, independently developed, or disclosed by a third party without restriction.

Provider retains all rights to the platform, models, knowledge base, and underlying technology. Customer retains all rights to its uploaded documents, extracted data, and generated reports. No rights are granted beyond those expressly stated.

Provider warrants that the platform will perform materially as described in the documentation. The platform is an AI-assisted decision-support tool and does not constitute professional engineering, architectural, or legal advice. All compliance outputs must be reviewed by a licensed professional before use in a permit application.

EXCEPT FOR THE EXPRESS WARRANTY ABOVE, THE PLATFORM IS PROVIDED "AS IS". PROVIDER DISCLAIMS ALL IMPLIED WARRANTIES INCLUDING MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, except to the extent such disclaimers are prohibited by BC consumer-protection law.

Neither party is liable for indirect, incidental, consequential, or punitive damages. Provider's total aggregate liability arising out of or related to this agreement is limited to the greater of: (a) fees paid by Customer in the 12 months preceding the claim, or (b) CAD $5,000. Nothing in this clause limits liability that cannot be limited by BC law, including liability for willful misconduct or for breach of statutory consumer rights.

Customer will indemnify Provider against claims arising from Customer's violation of applicable law, misuse of the platform, or infringement of third-party rights through Customer's uploaded content.

This agreement continues until all Order Forms have expired or been terminated. Either party may terminate for material breach on 30 days' written notice if the breach is not cured within that period. Provider may suspend service immediately for non-payment or violation of the acceptable-use policy.

This agreement is governed by the laws of British Columbia, Canada, without regard to conflict-of-law principles. Disputes will first be submitted to good-faith negotiation for 30 days, then to binding arbitration in Vancouver, BC under the BC Arbitration Act.

Processor will process personal information solely as instructed by Controller and solely to provide the compliance-analysis service. Personal information that may be processed includes: names and addresses appearing in uploaded permit documents; email addresses of registered users; and billing contact information.

Processor will not use personal information for any purpose other than delivering the service. This explicitly prohibits: using inputs to train AI or ML models, building marketing profiles, or sharing data with third parties except the sub-processors listed in clause 4.

Uploaded PDFs are extracted to plaintext in memory and not persisted to disk beyond the analysis run. Only the extracted text and analysis results are stored. Processor will not retain personal information beyond the periods specified in the retention schedule:

Controller authorizes use of the following sub-processors:

Cross-border transfers to US sub-processors occur under contractual safeguards consistent with PIPEDA's accountability principle. Processor will notify Controller of any material changes to this sub-processor list with 30 days' notice.

Processor maintains the technical and organizational measures described on the Security & Trust page, including: TLS 1.3 in transit, AES-256 block-storage encryption at rest, bcrypt password hashing, JWT session management, rate limiting, and server-side input sanitization.

Processor will assist Controller in responding to data-subject requests under PIPEDA (access, correction, deletion). Requests should be submitted to privacy@vanpermitaudit.com. Account deletion requests are fulfilled within 30 days.

Processor will notify Controller without undue delay (and in any event within 72 hours of becoming aware) of any personal-data breach that poses a real risk of significant harm to individuals, as required under PIPEDA's mandatory breach-reporting obligations. Breach reports are made in writing and include the facts available at the time of notification, the likely consequences, and the mitigation steps taken or planned.

Controller may, on 30 days' written notice and no more than once per year, request a written summary of Processor's security controls or the results of any third-party security assessment. On-site audits are available to Enterprise customers by arrangement.

On termination of the service agreement, Processor will delete all Controller personal information within 30 days, except where retention is required by law. On request, Processor will provide a written confirmation of deletion.