Privacy Policy

SolidGood (Building Waves Tech Ltd, a British Columbia company, "we", "us") makes SolidGood Strata, also called Strata Hub: a private hub where a strata corporation shares information with its owners, residents and council. This policy explains how we handle personal information under British Columbia's Personal Information Protection Act (PIPA) and, where it applies, the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Who is responsible for what

Stratas and councils are our customers. Each strata corporation (the "Strata") decides what goes into its own SolidGood Strata space and who is invited.
Residents, owners, council members and managers are invited users. They can join only when the Strata invites them.
Each Strata controls its own data, and SolidGood is its service provider. For the information a Strata puts into SolidGood Strata, including information about its members, the Strata is responsible for it. We handle it only on the Strata's behalf, to provide, secure, support and improve the service, as set out in our Terms of Service.
Information we control ourselves. This is information about people who contact us, council contacts who set up an account, and basic technical records about how the service is used. This policy applies to that information directly.

If you're an owner or resident and want to see or correct your information, please contact your strata council or manager first. If you contact us instead, we'll pass your request on to the Strata and help it respond (see section 14).

2. Privacy Officer

Our Privacy Officer is responsible for our compliance with privacy law.
Privacy Officer, Building Waves Tech Ltd, email: hello@buildingwaves.tech

3. What information is involved

Information in a Strata's space (the Strata is responsible for it):

member details: name, email, unit or lot number, role (member, manager or council admin), and when the person joined or left;
invitation records: who was invited, by whom, and when;
content the Strata posts: announcements, maintenance updates, house rules, recycling information, deadlines and documents (documents can contain personal information, depending on what the Strata uploads);
supplier and contractor details the council records, including contact details. These are hidden from residents unless the council chooses to show them;
a record of changes made in the Strata's space (who changed what, and when), and records of the Strata's support requests;
records of which versions of our terms and privacy policy you accepted, and your choices about notices by email; and
records of emails sent for the Strata (see section 9).

Information we control:

account and sign-in details (managed with our sign-in provider, Clerk): name, email, and sign-in sessions;
messages you send us and our replies; and
technical information such as IP address, browser type and the pages or requests made, which our hosting and sign-in providers record to run and secure the service.

During the free pilot we don't take payment and don't collect card details.

4. Why we use it

We use personal information to:

set up and run each Strata's space, including inviting members and showing each person what their role allows;
send invitations, sign-in codes and the notices a Strata asks us to send;
keep the service secure, prevent abuse and fix problems;
give support when the Strata asks;
improve the service, using information that doesn't identify people where we can; and
comply with the law.

We don't sell personal information. We don't use it for advertising or to train AI models. Our app doesn't currently include advertising, analytics or third-party error-tracking tools.

We collect, use and disclose personal information with consent, unless the law allows or requires otherwise. When a Strata invites you and you sign in, you agree to the uses in this policy that are needed to provide the service. You can withdraw your consent at any time, subject to legal limits, by contacting the Privacy Officer or your strata council. If you withdraw consent to uses that the service needs, we may not be able to keep your account open.

Stratas: you're responsible for giving your members any notices, and getting any consents, that the law requires before you put their information into SolidGood Strata, and before you allow AI apps that can see it. Section 10 includes a short notice a Strata can share with its members.

6. Keeping each Strata's information separate, and who can see it

Invitation only. Nobody can sign in to a Strata's space without an invitation from that Strata.
Kept separate. Each Strata's records are kept apart from other stratas' records. The database applies access rules on every request, so a member sees only the stratas they belong to.
Roles. What a member can see depends on their role. Owners and residents see published resident information. Council members and managers also see council-only content. The council chooses who sees what.
Supplier details. Supplier and contractor contact details are hidden from residents unless the council chooses to show them.

7. When our own team can access a Strata's information

Our team doesn't browse a Strata's information. We access it only to help when the Strata asks, to keep the service secure and working, or when the law requires it. In practice, access works at different levels:

Support. If we need to see inside a Strata's space to help, we do it through a support grant that the council approves. The grant is time-limited, the council can see it, and it is logged.
Account status. Our platform administrators can see account status across all stratas: which stratas exist, membership, invitations and billing status. They can't see a Strata's content (announcements, documents and similar) without a support grant.
Engineering and operations. Members of our engineering team, including the owner of our database account and people who use administrator ("service-role") tools, can reach the underlying systems directly. They do this only for maintenance, security and operations. These direct accesses aren't recorded in a Strata's own audit log. We don't claim that every access to the underlying systems is logged.
Server code with elevated rights. Some of our server code runs with elevated rights so that it can send email, process payment events (once paid plans exist) and run the AI app connector (which acts within each member's own permissions; see section 8).
Hosting providers. Our hosting and database providers store data under their own terms and security practices, and their staff can have access as those terms allow. For example, our database provider says its support staff may access customer data when we ask for help or to respond to a security incident. Section 9 lists our providers.

We limit the information we share with anyone to what they need for their task, and we require our providers to protect it by contract. No system is perfectly secure.

8. AI apps you connect

Where AI app connections are switched on for a Strata, a member can connect an AI app (an assistant that supports the Model Context Protocol, or MCP) to their own account. This is off by default for each Strata. We switch it on only when a Strata is set up for it, and the Strata can ask us to switch it off. Nothing is connected unless the member does it, and they can disconnect at any time.

How it works. The member approves the connection using their sign-in (through Clerk) and can choose read only. The app acts with that member's permissions, never more, so it sees only what that member can see. Actions that change information show a preview first, and publishing and similar actions ask for approval each time.
What an AI app can't do. It can't delete content, change roles, set legal holds or change strata settings.
Who receives information. When an AI app looks something up, the results go to the AI app's provider. From then on the provider handles them under its own terms and privacy policy, and they may be stored outside Canada. We don't control how the provider stores or uses them. We recommend that members read the provider's terms before they connect.
What we keep. We keep a log of each AI app request (when it happened, which connection and tool, whether it worked) for security and accountability. That log doesn't include the content of requests or access tokens.
What we don't do. We don't sell information obtained through an AI app connection, use it for advertising, or use it to train AI models.
Built-in AI features. SolidGood Strata doesn't currently send a Strata's records to any AI provider as part of the service itself. If we add built-in AI features, we'll update this policy first.

9. Service providers

We use these providers to run SolidGood Strata. Each one gets the information it needs for its task.

Provider	What it does	Information involved	Where it processes information
Supabase	Database and file storage for each Strata's records and uploaded documents and images	All the information in section 3 that a Strata puts in its space	Canada (Amazon Web Services, Canada Central region). Supabase says it may process some data outside that region in limited cases: support requests, usage logs and service metadata, and content delivery caches.
Clerk	Sign-in, invitation and sign-in-code emails, and AI app connection approval	Name, email, sign-in sessions, IP address and device information	United States. Clerk is a US company. It says it hosts data primarily in Google Cloud and Cloudflare data centres, and may process data anywhere it or its sub-processors have facilities.
Vercel	Hosts the app and the AI app connector's server code	Requests made to the app (such as IP address and page addresses) and, when an AI app is used, the results passing through it. Strata records are stored in our database, not on Vercel.	United States and elsewhere. Vercel says its primary processing facilities are in the US and that it may process data anywhere it or its sub-processors operate.
Resend	Sends email for invitations, announcements and notices	Recipient email addresses and email contents	United States. Resend says it stores customer data in the US. The sending region it offers doesn't change where data is stored.
Cloudflare	Runs a bot check (Turnstile, through Clerk) when a sign-up looks suspicious	IP address, browser details and similar technical signals	Cloudflare operates a global network. It doesn't state processing locations for this check.
The AI app provider a member connects	Receives the results of the member's AI app requests (section 8)	What the member's app asks for	Under that provider's own terms. May be outside Canada.

Payments. There is no billing during the free pilot, so no payment provider is processing any information about Strata members. If we introduce paid plans and use Stripe for card payments, Stripe would process the payer's details in the United States, card details would go directly to Stripe, and we'll update this policy before we take any payment.

We may update this list. We'll post changes here with a new effective date.

10. Where information is stored, and transfers outside Canada

Stored in a Canadian data centre. A Strata's records (our database and file storage) are stored in Canada (Canada Central region).
Some processing happens outside Canada. Our sign-in, hosting, email and bot-check providers, and any AI app a member connects, may process some information outside Canada, including in the United States. Section 9 shows which information goes to which provider. So not all information stays in Canada.
What that means. When information is processed outside Canada, it is subject to the laws of that country, and its courts, law enforcement and national security authorities may be able to access it. Our providers are bound by contract to protect it. We remain responsible for personal information we've transferred to a provider for processing, and we take reasonable steps to protect it, as the Privacy Commissioner of Canada's guidance on processing across borders expects.
Questions. The Privacy Officer can answer questions about how our providers handle information (section 2).

A short notice a Strata can share with its members:

"We use SolidGood Strata, provided by Building Waves Tech Ltd (SolidGood), a BC company, to share strata information with owners, residents and council. SolidGood is our service provider and handles your information on our behalf. Our records are stored in a Canadian data centre, but providers that handle sign-in, hosting and email may process some information (such as your name, email address and the emails we send you) outside Canada, including in the United States. Information processed there may be accessible to that country's courts and authorities. For questions or requests about your information, contact the strata council or manager. SolidGood's privacy policy is available on the SolidGood Strata site."

11. Disclosure

We don't sell personal information. We disclose it only:

to the service providers in section 9;
to the Strata whose space it belongs to;
to an AI app's provider, if a member connects an AI app (section 8);
if the law requires or allows it, for example a court order, or to protect someone's safety; or
to a buyer or successor, if our business is reorganised or sold, under confidentiality terms and this policy.

12. Security

We use reasonable security safeguards suited to how sensitive the information is. These include encrypted connections (HTTPS/TLS), invitation-only sign-in, role-based access rules in the database, separation between stratas, and logs of changes made in a Strata's space and of AI app actions. Section 7 explains the limits of that logging. No system is perfectly secure. If you think there is a problem, please email hello@buildingwaves.tech.

13. How long we keep information

We keep personal information only as long as needed for the purposes above or as the law requires. Right now:

A Strata's records: for as long as the Strata uses SolidGood Strata. When it stops, we'll tell it by email how long it has to export its records, and then we delete them, unless the law requires us to keep them or a legal hold applies.
Invitations that were never accepted, or were cancelled: deleted 90 days after they expire or are cancelled.
Members who have left: a member's profile is deleted 12 months after their membership ends, and the email address saved with their membership record is cleared at the same time. A person who was invited but never became a member has their profile deleted after 30 days.
Withdrawn consents: records of a withdrawn consent are deleted 2 years later, if the person has no active membership.
Change history in a Strata's space: 2 years.
AI app request logs: 90 days.
Email delivery records: about 90 days. We keep unsubscribe records for as long as we need them to respect the person's choice.
Support messages: as long as needed to help and keep our records.

Our providers keep their own logs and records under their own terms.

14. Access and correction

You can ask to see the personal information held about you, how it has been used, and who it has been disclosed to, and you can ask for it to be corrected. Send your request to your strata council or manager, or to our Privacy Officer at hello@buildingwaves.tech. We'll reply within 30 days. We may need to confirm your identity first. Sometimes the law lets us refuse access to some information. If so, we'll explain why. For information a Strata controls, we'll pass your request to the Strata and help it respond.

15. Privacy breaches

If a breach of security safeguards involves personal information we control, we'll assess it promptly. Where PIPEDA applies and the breach creates a real risk of significant harm, we'll report it to the Office of the Privacy Commissioner of Canada, notify the affected people as soon as feasible, and keep a record (PIPEDA ss. 10.1 to 10.3). We'll tell the Office of the Information and Privacy Commissioner for BC where appropriate. If a breach involves information we hold for a Strata, we'll tell the Strata without undue delay so it can meet its own obligations, and we'll help it do so.

16. Complaints

Please contact our Privacy Officer first, and we'll investigate and respond. If you aren't satisfied, you can contact:

Office of the Information and Privacy Commissioner for British Columbia (PIPA): https://www.oipc.bc.ca/
Office of the Privacy Commissioner of Canada (PIPEDA): https://www.priv.gc.ca/en/report-a-concern/