Privacy Policy
1. Who we are and what this covers
PFP Works Inc. ("PFP Works", "we", "us") is an Alberta corporation based in Oyen, Alberta, Canada. This policy covers the websites and services we operate, which we call the "Services":
- prairieline.ca — this website;
- Prairieline (app.prairieline.ca and operator storefront domains) — a multi-tenant point-of-sale, inventory and online-ordering platform for regulated retail in Canada;
- FarmApp (farm.prairieline.ca) — a farm-operations application for crews, fields, equipment and livestock;
- any other application that links to this policy, including applications that connect to Google services through the Google API.
We are subject to Alberta's Personal Information Protection Act (PIPA) and, where it applies, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
Two roles. For the Prairieline platform, the retail business that uses it (the "Operator") controls its customers' and staff members' personal information; we process that information on the Operator's behalf under our agreement with them. For this website, FarmApp and Google-connected features, we control the information ourselves. If you are a customer of a store that uses Prairieline, that store's own privacy policy also applies to you.
2. Information we collect
Information you give us
- Account details: name, email address, phone number, role, and sign-in credentials (passwords are stored only as salted hashes; passkeys as public keys).
- Business details for Operators: business name, locations, licence numbers, tax and banking details needed to run the platform.
- Retail records entered into Prairieline by Operators and their staff: products, inventory, sales, customer accounts, age and ID verification results, and the records regulators require retailers to keep.
- Farm records entered into FarmApp: fields, crops, loads, equipment, crew shifts, messages, photos, voice notes and livestock records.
- Correspondence when you contact us.
Information collected automatically
- Device location in FarmApp, only while a crew member has a shift running and only with the device's permission, to show machine positions and record field coverage.
- Technical data: IP address, browser and device type, pages requested, timestamps and error reports, from standard web-server logs and the content-delivery service in front of our servers.
- Usage counts on storefronts, such as page views, used to show Operators how their store is doing. These are aggregated and are not sold.
Information from Google
If you choose to connect a Google account, we receive the data described in section 4. We do not receive it unless you connect.
3. How we use it
- To provide, operate, secure and support the Services and to carry out the functions you or your Operator ask for.
- To keep the records that cannabis, liquor and tax regulators require retailers to keep.
- To communicate with you about your account, service changes and security.
- To diagnose problems and improve the Services, using logs and aggregated usage.
- To comply with law and to establish, exercise or defend legal claims.
We do not sell personal information. We do not use it for advertising, and we do not build advertising profiles.
4. Google user data
Some of our Services can connect to your Google account so that you can work with your own Google Drive files and Google Docs from inside the Service. When you connect, Google asks you to grant the following permissions ("scopes"):
https://www.googleapis.com/auth/drive— see, edit, create and delete your Google Drive files;https://www.googleapis.com/auth/docs— see, edit, create and delete your Google Docs documents;https://www.googleapis.com/auth/drive.metadata.readonly— see information about your Google Drive files (names, types, folders, modification dates).
What we access and why
- We list your Drive files and folders so you can choose which ones to use with the Service.
- We read the files and documents you select, to import their contents into the Service (for example a spreadsheet of products or fields, or a document template).
- We create or update files and documents in your Drive when you ask the Service to export or save something there (for example a report, a record export or a generated document).
- We read file metadata to show you the file's name, location and last change, and to keep an exported file linked to the record it came from.
We access only the files you select or that the Service creates for you. We do not scan, index or analyse the rest of your Drive, and we do not read files unrelated to the action you asked for.
What we store
- An OAuth access token and refresh token, encrypted at rest, so the connection keeps working without asking you to sign in every time. Tokens are deleted when you disconnect.
- The Google file IDs and names of files you have linked, so the Service can find them again.
- The content you chose to import, which then becomes part of your records in the Service like anything else you entered.
We do not keep copies of Google files beyond the content you imported, and we do not retain file contents from listings or previews.
Limited Use
Our use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- we use Google user data only to provide and improve the user-facing features described above;
- we do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition with notice to you;
- we do not use it for advertising;
- no human at PFP Works reads your Google data unless you ask us to for support, it is needed for security or to comply with law, or it has been aggregated and anonymised;
- we do not use Google user data to develop, improve or train generalised artificial-intelligence or machine-learning models.
Disconnecting
You can disconnect Google at any time from the Service's settings, which deletes our stored tokens, or by removing the Service from your Google account at myaccount.google.com/permissions. Files already imported into the Service stay in your records until you delete them there.
5. Sharing
We share personal information only with:
- Your Operator and its authorised staff, for information held in that Operator's Prairieline tenant;
- Service providers that host and protect the Services: our hosting provider (Web Hosting Canada, Montreal), a content-delivery and DDoS-protection service in front of our servers, payment processors chosen by the Operator, and SMS or push-notification providers for messages you have asked for. Each may use the information only to provide its service to us;
- Regulators and authorities where the law requires it, such as provincial cannabis and liquor regulators and tax authorities;
- Anyone you direct us to share with, such as Google when you export a file to your Drive.
6. Where data is stored and for how long
Our servers are in Canada. Personal information is stored in Canada unless you yourself send it elsewhere (for example by exporting to Google Drive, whose servers may be outside Canada and are governed by Google's own policies).
We keep information for as long as your account or your Operator's tenant is active, and afterwards only as long as needed to meet legal record-keeping requirements (regulated retail records are typically kept for six years) or to resolve disputes. Backups are kept for up to 90 days. Server logs are kept for up to 12 months. Google tokens are deleted on disconnect.
7. Security
Connections use TLS. Passwords are hashed; passkeys are supported. Each Operator's data is kept in its own database, separate from other Operators. Access to production systems is limited to the people who run them, by key-based authentication. Audit records of sensitive actions are kept and protected against tampering. No system is perfectly secure; if we learn of a breach that creates a real risk of significant harm, we will notify you and the Alberta Information and Privacy Commissioner as PIPA requires.
8. Your rights and choices
You may ask to see the personal information we hold about you, to correct it, or to have it deleted, subject to the records we are required by law to keep. Operators can export and delete their own data from within Prairieline; customers of an Operator should ask that Operator first, since it controls their records. You may withdraw consent to optional uses, such as a Google connection or marketing messages, at any time. To make a request, contact us at the address below. We will respond within 45 days as PIPA requires. You may also complain to the Office of the Information and Privacy Commissioner of Alberta.
9. Cookies
The Services use cookies and similar storage only for things that are necessary to run them: keeping you signed in, remembering a cart or a draft, and protecting against cross-site request forgery. We do not use third-party advertising or tracking cookies. This website (prairieline.ca) sets no cookies at all.
10. Age
The Services are for businesses and adults. Prairieline storefronts for cannabis and liquor require customers to be of legal age in their province (18 in Alberta, 19 in most other provinces) and verify this. We do not knowingly collect personal information from minors; if you believe we have, contact us and we will delete it.
11. Changes
We may update this policy. The effective date at the top shows when it last changed. If a change materially affects how we use personal information, we will tell account holders by email or in the Service before it takes effect.
12. Contact
PFP Works Inc.
Oyen, Alberta, Canada
Privacy contact: Jason Jorgenson, jjorgenson@gmail.com
See also our Terms of Service.