Privacy

Almost every question about privacy on this service has two answers, because there are two kinds of information and we hold them under different rules.

• Information about you, held by us. Your account: your email address, your name if you give one, which sign-in method you used, and the record of your own activity. We decide how this is handled, and this policy governs it.
• A Nation's records, held for that Nation. Members, housing, staff, finances, council business, files. That belongs to the organization that entered it. We hold and process it on their instructions, and we do not decide what happens to it. If you are a member of a Nation asking what that Nation holds about you, ask the Nation — we cannot answer for them, and we will not hand their records to anyone but them.

The rest of this page says which of the two it is talking about.

The public pages — the home page, Get help now, the services directory, the jobs board, the Nation directory and every Nation's own site — do not require an account and do not ask for one.

• No advertising, no third-party analytics, no tracking pixels, no cookie banner, on any page of this service.
• No cookie is set at all until you sign in. The only cookie this service ever sets is the sign-in session cookie described below.
• The crisis pages carry no measurement of any kind — not even a page count. Someone looking for a phone number at two in the morning leaves no record with us, and that is deliberate.
• Nothing on the public pages is a form except Ask for access and a Nation's own contact and application forms, and each of those says what it does before you fill it in.

Our hosting provider keeps ordinary server logs — the request, the time, and an IP address — for about 30 days for security and debugging. We do not build profiles from them and we do not join them to anything else. That is the floor for any website on the internet, and it is the only record a public visit leaves.

An account holds the least we can run a sign-in on.

• Your email address, and your name if you provide one.
• How you sign in: a password we never see in plain text, or Google or Microsoft, which tell us your email address and name and nothing else. We do not receive your contacts, your calendar or your files from them, and we do not ask to.
• If you switch on two-step sign-in, the shared secret for your authenticator app.
• A log of what you did inside the service: what you opened, what you changed, what you exported.

That activity log is not for us. It is the audit trail a Council, an auditor or a funder can ask an organization for, and the organization's own administrators are the people who read it — live, on the Trust page. We use it to answer support questions and to investigate abuse.

A free account with no organization can read public-record intelligence only: federal funding history, programs, procurement, lobbying registrations, officials and treaties. It holds no Nation's own records and cannot reach them.

One cookie, one purpose: it keeps you signed in and it is set only after you sign in. It is strictly necessary to operate the service, so there is no consent banner to click and nothing to opt out of except signing out.

There are no advertising cookies, no analytics cookies, and no third-party cookies of any kind. We do not sell or share anything with data brokers, advertisers or anyone else, in any form.

When an organization uses this service to run its office, the records it enters belong to that organization. We hold them to provide the service and for nothing else.

• We do not use them to train any model, and no feature sends them to any AI provider today.
• We do not aggregate one organization's records with another's, for analytics, benchmarking, research, publication or any other purpose.
• We do not sell them, rent them, or share them with anyone the organization has not chosen.
• Nation-to-Nation sharing exists only where the organization switches it on, and even then a tribal council sees counts, not records.
• Access inside an organization is set by that organization: by role, by department, and for pay and honoraria by a named permission plus a re-authentication that expires in minutes and is logged every time.

Our own staff do not browse organization records. Access to production data is limited to what is needed to run and support the service, and support access happens on request. Every action inside an organization is written to that organization's activity log, ours included.

Exact, not marketing. Each of these is a subprocessor, and this is the list to attach to a data-sharing agreement.

Accounts, records and files are stored in Canada. Two things are not: email leaves through a United States provider, and text messages would if an organization switched them on. That is stated plainly rather than described as Canadian hosting, because an invitation email or a digest genuinely does cross the border. An organization that cannot accept that should not switch on email notifications, and should tell us so we can turn them off for them.

If we ever add a provider, this table changes before the provider is switched on, not after.

• An organization's records: as long as the organization keeps them. Documents carry their own retention dates, set by the organization, because records retention for a band office is a legal question we do not get to answer for them.
• Activity and access logs: retained while the organization is on the service, because their whole value is being able to look back.
• Your account: until you or an administrator deletes it. Removing a person from an organization does not erase the records they touched, and the history keeps their name — an audit trail that can be rewritten is not an audit trail.
• Server logs at our hosting provider: about 30 days.
• Email at our mail provider: per its own retention, which is short. The copy that matters is stored as a record in Canada.

On termination we delete an organization's data on request and confirm it in writing. Before that, export everything — every table as one file, every uploaded document as one archive — from the Trust page, at any time, without asking us. Leaving is meant to be possible.

Canadian federal privacy law (PIPEDA) and Alberta's Personal Information Protection Act both give you the right to know what an organization holds about you, to get a copy, to have mistakes fixed, and to complain.

• For your account with us — the email address, the sign-in method, your own activity — write to privacy@nationworks.ca. We will answer within 30 days.
• For what a Nation holds about you as a member, an employee or a tenant, ask that Nation. They control those records; we hold them on their behalf and will not release them to anyone else, including to you, without their instruction. This is not evasion — it is the same rule that stops anyone else getting at them.
• You can complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner of Alberta, at any time, and you do not have to come to us first.

If personal information is exposed in a way that creates a real risk of significant harm, we will tell the affected organizations and the Privacy Commissioner as the law requires, and we will say what happened rather than issuing a statement about how seriously we take security.

The Trust page inside the app shows the current state of the controls this depends on — who has access, who has two-step sign-in on, when the tenant-isolation test last ran, and what has been exported. It is live, not a claim. Two things on it are honest gaps today: a backup restore has not been rehearsed, and no external penetration test has been run. Both are named there, and both will be done before a real member registry is loaded.

This service is for people doing the work of a Nation government, and accounts are not offered to children. A Nation's own records may of course include information about children — a household, a school program, a family file — and that information is the Nation's, held under the rules in this policy like every other record.

When this changes in substance, the date at the top changes and organizations on the service are told by email. We do not quietly widen what we are allowed to do with records that already exist.

NationWorks is operated by a sole proprietor based in Edmonton, Alberta, Canada. It is not yet incorporated; when it is, the registered name and mailing address will be published here.

Privacy questions and requests: privacy@nationworks.ca. Anything else: hello@nationworks.ca.

This page is written in plain language on purpose, and it is written by the people who built the software rather than by a law firm. It is accurate about what the product does. It has not been reviewed by a lawyer, and it will be before the first paid agreement is signed.