Privacy policy

Rowlock is a service of ITACC Inc., based in Ontario, Canada. We handle personal information in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). This policy explains what we collect, why, who we share it with, how long we keep it, and your rights.

1. What we collect

• When you order: your name, email, and optionally your company, job title, company size and country; your repository URL, app name, the tool you built it with, any notes you add, and whether you need an NDA.
• When you contact sales: your name, work email, company, and optionally your job title, company size, number of apps and message.
• Payments: handled entirely by our payment processor. We receive the payment status, amount, and reference numbers for the customer, payment and subscription. We never see or store full card numbers.
• Your code: only what you choose to share with us for a review or for Rowlock Watch.
• Spam protection: a one-way scrambled (hashed) version of your IP address and email, used only to limit repeated form submissions.
• Cookies: our site does not set tracking or advertising cookies and does not use analytics. Our payment processor’s checkout and customer portal use their own cookies for payments and fraud prevention.

2. Why we use it

• To deliver the service you bought: reviews, reports, monitoring, and the related emails.
• To take payments, issue receipts and invoices, and manage subscriptions.
• To reply to enquiries.
• To prevent fraud and abuse of our forms.
• To keep the records Canadian tax law requires.

We do not sell personal information. We send you transactional emails about your order or subscription only; we will ask for your consent before sending any marketing, as Canada’s anti-spam law (CASL) requires.

3. Who we share it with

We use trusted service providers to process payments, host our website and database, and send emails. They handle personal information only on our behalf and under their own security and privacy commitments. Some of them store or process information outside Canada, including in the United States, where it may be accessible to authorities under local law. A list of our current providers is available on request.

We may also disclose information when the law requires it.

4. How long we keep it

• Your code: deleted within 30 days of delivering an audit; access removed within 30 days of a Rowlock Watch subscription ending.
• Order, payment and invoice records: kept for at least six years, as Canadian tax law requires.
• Enquiries that don’t become orders: deleted after two years, or sooner if you ask.
• Spam-protection records: deleted automatically, usually within a day.

5. How we protect it

Access to our database is restricted to authorised staff, data is encrypted in transit, payment details stay with our payment processor, and our website uses security headers and rate limits. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

6. Your rights

You can ask us to access, correct or delete your personal information (subject to records we must keep by law), or withdraw consent to optional uses. Email us at info@itacc.ca and we will respond within 30 days. If you’re not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

7. Children

Our services are for businesses and developers and are not directed at children.

8. Changes

We will post any changes here with a new date, and email customers about significant changes.

9. Contact

Privacy questions: ITACC Inc. (Rowlock), Ontario, Canada · info@itacc.ca