Privacy Policy

Form55 (“we,” “us,” “our”) is committed to protecting your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial privacy legislation. This policy explains what information we collect, why we collect it, and how it is used and protected.

Form55 is operated by Hunter Paish, a sole proprietor based in Vernon, British Columbia, Canada. We provide a Canadian alternative data platform that aggregates publicly available government data — insider trading filings (SEDI), federal lobbying registrations (OCL), and government contracts (CanadaBuys and provincial open data portals) — for TSX-listed companies.

Privacy enquiries: privacy@form55.ca

We do not collect names, postal addresses, government identification, or any sensitive personal information as defined under PIPEDA.

• Service delivery. Your email and account data are used to authenticate you and provide access to the features included in your subscription tier.
• Transactional emails. We send account-related emails (password reset, plan confirmation). These are not marketing messages and do not require CASL consent.
• Marketing emails (with consent only). If you opted in at signup, we may send the weekly signal digest and product updates. You can withdraw this consent at any time (see section 6).
• Security and abuse prevention. Server logs and IP addresses are used to detect and prevent unauthorised access and to diagnose technical issues.
• Legal compliance. Consent records are retained to demonstrate compliance with PIPEDA and CASL as required by the Office of the Privacy Commissioner (OPC).

We do not sell, rent, or trade your personal information. We share data only with the following service providers, and only to the extent necessary to operate the platform:

• Supabase (authentication) — stores your email address, encrypted password, and account metadata. Servers are located in the United States. Supabase processes data under a Data Processing Agreement aligned with GDPR, which meets PIPEDA’s comparable-protection standard.
• Stripe (payment processing, paid plans only) — handles payment card data directly under PCI-DSS. Form55 receives only a non-sensitive payment reference; we never store or transmit full card numbers.
• Finnhub (market data) — receives ticker symbols in API requests. No personal information is transmitted.
• TradingView (price charts) — the chart widget on company pages loads from TradingView’s servers. TradingView may set cookies or collect usage data governed by their own privacy policy.

• Account data is retained while your account is active.
• On account deletion request, personal data (email, account metadata, consent records) is removed within 30 days. Anonymised usage aggregates may be retained indefinitely.
• Server access logs are retained for 90 days for security purposes, then deleted.

You have the right to:

• Access. Request a copy of the personal information we hold about you.
• Correction. Ask us to correct inaccurate or incomplete information.
• Withdrawal of consent. Withdraw your consent at any time. Note that withdrawing consent to the service agreement (section 3, service delivery) will require account deletion.
• Deletion. Request deletion of your account and associated personal data (fulfilled within 30 days).
• Complaint. File a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca if you believe your rights have been violated.

To exercise any of these rights, email privacy@form55.ca. We will respond within 30 days.

Canada’s Anti-Spam Legislation (CASL) requires express consent before sending commercial electronic messages. If you opted in at signup, you have provided express consent to receive the weekly Form55 signal digest and product updates.

You may withdraw CASL consent at any time by:

• Clicking “Unsubscribe” in any marketing email, or
• Emailing privacy@form55.ca.

Withdrawal of CASL consent does not affect your account or access to the platform. Transactional emails (password reset, billing notices) are not commercial messages under CASL and will continue regardless of marketing consent.

Passwords are hashed using industry-standard algorithms and never stored in plaintext. Data in transit between your browser and our servers is encrypted via TLS. Account authentication is delegated to Supabase, which implements industry-standard session management including short-lived JWTs and refresh-token rotation.

We implement rate limiting on public API endpoints to prevent systematic data extraction and protect third-party API quota (Finnhub). In the event of a privacy breach affecting your personal information, we will notify you and the OPC within 72 hours as required by PIPEDA’s breach-of-security-safeguards rules.

Form55 uses a single session cookie to maintain your login state. This cookie is essential to the service and cannot be declined while using the platform. We do not use advertising cookies or third-party tracking pixels. The TradingView chart widget may set cookies governed by TradingView’s own policy.

We will post material changes to this policy on this page and update the “Last updated” date above. For changes that affect how we use your personal information, we will notify account holders by email at least 14 days before the change takes effect. Continued use of the platform after that date constitutes acceptance of the revised policy.

Privacy officer & general enquiries:
privacy@form55.ca  ·  Form55, Vernon, British Columbia, Canada