Privacy Policy

Who we are

Heat Pump Toronto ("we", "us") runs heatpumptoronto.com and the Heat Pump Toronto apps. We help homeowners in the Greater Toronto Area understand heat pumps and rebates, and connect them with independent, vetted installers. This policy explains how we handle personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

Installers who receive your information are separate businesses. They handle it under their own privacy practices and are responsible for it once they have it.

Who is accountable

Our Privacy Officer is responsible for our compliance with this policy and with PIPEDA. Contact them with any question, request or complaint:

Heat Pump Toronto, Privacy Officer: Ryan Choi · info@heatpumptoronto.com · By mail: Suite 206 - 716 Gordon Baker Rd, North York, ON M2H 3B4

What we collect

• When you ask for quotes, ask for a repair or check a rebate: your name, e-mail, phone number and postal code, and for a repair your street address; details about your home (type, size, heating, cooling, ducts, whether you own it); your project (the system you want or what needs fixing, timeline, priorities, how and when to contact you, times you can be home for a site visit); photos you choose to add; and your rebate estimate.
• If you create an account: your sign-in e-mail and password (stored only as a secure hash by our sign-in provider), your homes and projects, the quotes and documents shared with you, appointments, requests you send, and your notification and language choices.
• From installers: company and contact details, licence and insurance documents, service areas, team members, and the quotes they send you.
• Technical information: the IP address and browser details recorded with each consent and sign-in, for security and as proof of consent; server logs.

We collect only what we need for the purposes below, and we collect it from you, or from the installer working on your project.

Why we use it

• To match your request with installers who serve your area and share it with them
• To run your account: projects, quotes, site visits and documents
• To estimate your rebate and, with your authorization, prepare and file your rebate application
• To send messages about your request, account and appointments
• To keep the service secure, prevent fraud and misuse, and keep records required by law
• To understand and improve the service, using combined information that doesn’t identify you

Your consent

We ask for your express consent before we share your request with installers: the checkbox when you ask for quotes. We keep a record of each consent (its wording, version and time).

You can withdraw your consent at any time by contacting us, subject to legal or contractual limits. We’ll stop sharing your information from then on; information an installer already received stays with them, so please contact them too.

Messages about your request, account and appointments are part of the service. We send promotional e-mails only with your consent, as Canada’s anti-spam law (CASL) requires, and every one includes a way to unsubscribe.

Who we share it with

• Matched installers: they first see your project details without your name or contact information. Your contact details are shared once an installer accepts your request.
• Rebate program administrators: when you ask us to handle your rebate application, we share what the program requires.
• Service providers that run the service for us, under contracts that require them to protect it and use it only for us: hosting (Vercel), database and file storage (Supabase), virus scanning of uploaded files in Toronto (Fly.io), e-mail delivery (Resend) and business e-mail (Microsoft).
• When the law requires it, or to protect people’s rights and safety.
• If the business is sold or reorganized, to the new owner, who must keep protecting it under this policy.

Where it is stored

Our database and files are stored in Canada, and our website runs in a Canadian region. Some providers process information outside Canada, for example to deliver e-mail from the United States. Information processed in another country is subject to that country’s laws and may be accessible to its authorities.

How we protect it

• Encrypted connections (HTTPS) everywhere
• Two-step sign-in for staff, and access limited to what each role needs
• A permanent log of staff actions on your information
• Private file storage: documents open only through short-lived links

If a breach creates a real risk of significant harm, we’ll tell you and the Office of the Privacy Commissioner of Canada as soon as possible, as PIPEDA requires, and keep a record of every breach.

How long we keep it

We keep personal information only as long as we need it for the purposes above or as the law requires:

• Accounts: while your account is open, then for up to 2 years
• Quote requests, projects and quotes: up to 7 years after the last activity, for tax, warranty and legal records
• Consent records: as long as the information they cover, as proof of consent
• Sign-in sessions and e-mailed links: removed when they end or expire (links after one week)

After that, we delete the information or make it anonymous.

Your rights

• Ask what personal information we hold about you and how we have used and shared it
• Ask us to correct information that is wrong or incomplete
• Withdraw your consent, as described above
• Complain about how we handle your information

Send your request to our Privacy Officer. We’ll answer within 30 days, free of charge in most cases. If you’re not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.

Cookies and storage on your device

We use one essential cookie to keep you signed in. Your browser also stores your language choice and an unfinished quote request on your device, so you can continue later, and, for 30 days, the site or ad link that brought you here, which is saved with a quote request you send so we know which of our links work. We don’t use advertising or tracking cookies. If that ever changes, we’ll update this policy and ask for your consent where required.

When you open a rebate news post, your browser remembers that post’s address so we count each reader once. Only the count reaches us, not who read it.

To see how the site is used, we count page visits with Vercel Web Analytics. It uses no cookies and doesn’t identify you or follow you to other sites: it records the page (without any personal details in the address), the site that sent you, and your browser, device type and country, and it is only shown to us as totals.

Age

The service is for adults (18 and older). We don’t knowingly collect information from children.

Changes to this policy

We’ll post any change here with a new date. If a change affects how we use information you already gave us, we’ll tell account holders by e-mail and, where required, ask for consent again.