Privacy Policy

1.1 Dumeau Home Management Inc. (“Dumeau”, “we”, “us”) is an Alberta corporation operating a family-run residential home-management membership service in and around St. Albert, Alberta.

1.2This Policy explains how Dumeau collects, uses, discloses, retains, and protects personal information in connection with dumeau.ca, the member, staff, and partner portals, and the services, under Alberta's Personal Information Protection Act (“PIPA”), which is the privacy law that governs Dumeau. Because some of our service providers store and process information outside Canada, the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) also applies to those transfers. This Policy is written to comply with both.

1.3This Policy covers members, prospective members, and visitors to our website. Trade contractors who use Dumeau's software are additionally covered by the confidentiality terms of their Trade Services Agreements. Your Membership Agreement governs the services themselves; this Policy governs personal information.

2.1Dumeau's Privacy Officer is Jeremy Martineau. The Privacy Officer is responsible for Dumeau's compliance with privacy law and is also the person who can answer questions about Dumeau's use of service providers outside Canada (Article 7).

2.2 Contact: hello@dumeau.ca. Written information about Dumeau's privacy policies and practices, including its practices with respect to service providers outside Canada, is available on request.

3.1 Account and identity information. Name, service address, email address, phone number, and login credentials. Passwords are stored only as one-way cryptographic hashes: we cannot read them, and a lost password is reset, never recovered.

3.2 Your home's record.The detailed profile of the home we manage: its systems and appliances (make, model, serial number, age, condition), nameplate photographs, maintenance schedules and history, service records, warranties, documents, budgets and set-aside figures, and photographs taken to document the home's systems and completed work. Information about a home that is tied to an identifiable member or household is personal information, and we treat it that way.

3.3 Household information. Information about other people in your household can arise in the record, such as a name on a warranty or a family member in a job chat. Article 10 explains how we handle it.

3.4 Service and billing records. Service requests, quotes, work authorizations, jobs, appointments, completed work, invoices, and payment history. If you choose to relax a recommended safety or manufacturer maintenance schedule, that choice is recorded: what was recommended, what you selected, who made the selection, and when.

3.5 Payment information.Payment is processed by Stripe. Card and bank details are entered directly with Stripe and never enter Dumeau's systems.

3.6 Communications.Messages between you and Dumeau staff, messages with an assigned trade contractor in a job's chat, emails between us, and, where you enable them, web-push notification tokens for your devices.

3.7 Technical information. Essential cookies that keep you signed in, anonymous cookieless visitor statistics (no advertising trackers, no cross-site tracking), and error reports generated when the product malfunctions, configured to exclude personal information.

3.8 Non-member individuals.Limited personal information about individuals who are not members: trade contractors' personnel (names, trade credentials, contact information, compliance documentation) and individuals named in service records.

3.9 What we deliberately do not collect. Gate, alarm, and entry codes are never stored in our systems; no field exists for them. We never see or store full payment card or bank account numbers. For Travel Watch members only, Dumeau may hold keys or codes outside its systems under a separate signed Key and Code Custody Authorization, in an encrypted, access-logged vault and a rated key safe, as described in that document.

4.1 We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances:

• providing and coordinating home-management services, including building and maintaining your home's record and maintenance plan;
• sourcing, engaging, scheduling, and overseeing the outcomes of trade contractors, including the request-for-quote, work authorization, job, and invoice workflow;
• billing and payment processing;
• verifying the quality and outcomes of completed work;
• member support and troubleshooting;
• sending service and transactional communications, such as quotes, bookings, reminders, reports, and receipts;
• operating, securing, and improving the product;
• meeting legal obligations, such as tax record-keeping; and
• with your consent, sending marketing communications (Article 6).

4.2 We identify our purposes at or before the time of collection, and we do not use personal information for new, unrelated purposes without going back to you.

5.1 PIPA permits consent to be express, implied, or given through an opt-out in defined circumstances, and requires express consent where information is sensitive or the use is outside reasonable expectations.

5.2 Service information is collected and used on the basis of your membership relationship and the reasonable expectations that come with it: the services in Section 4.1 cannot be delivered without it.

5.3 Marketing is separate and requires your express opt-in (Article 6).

5.4 Photographs of your home in marketing always require your separate, specific, express consent, which you may decline or withdraw at any time without affecting your service.

5.5 You may withdraw consent on reasonable notice, subject to legal and contractual limits. We will explain the consequences of a withdrawal for the service before acting on it.

6.1 Service communications are part of the membership and are sent while your membership is active.

6.2Marketing email is sent only where you have opted in or where Canada's anti-spam legislation otherwise permits it. Every marketing message identifies Dumeau, includes our mailing address and a contact method, and contains a functioning unsubscribe mechanism that remains valid for at least 60 days. Unsubscribe requests are processed within 10 business days and are free. Unsubscribing does not affect service communications or your membership. We record the date and source of each consent.

7.1 Dumeau uses established service providers that process personal information on its behalf. Dumeau remains accountable for personal information in their hands and uses contractual and other means to require comparable protection.

7.2 The providers, what each does, and where each stores and processes information:

7.3 Service providers outside Canada (PIPA notice). The providers above store and process personal information in the United States, for the purposes stated in the table. While information is outside Canada, it may be accessible to the courts, law enforcement, and national security authorities of that jurisdiction. You may obtain written information about Dumeau's policies and practices with respect to service providers outside Canada from the Privacy Officer (Article 2), who can answer your questions about how those providers collect, use, disclose, or store personal information for Dumeau. This notice is also given at or before the time we first collect your information.

7.4 Trade contractors.When work is quoted or authorized at your home, the assigned trade contractor sees what the job requires: the scope of work, relevant details of the affected system, the service address and schedule, known hazards, and the job's chat. Trade contractors never see your billing or payment details, and are bound by confidentiality obligations in their Trade Services Agreements.

7.5 Legal requirements. Dumeau will disclose personal information where a law, court order, or authority with jurisdiction validly requires it, and otherwise only with consent.

7.6 No other sharing. We do not sell personal information, do not share it for third-party advertising, and do not provide it to data brokers.

8.1 What we use, and for what.Dumeau uses Anthropic's Claude, a third-party AI service, to assist its staff: reading nameplate photographs to help build and organize your home's systems record, assisting troubleshooting and maintenance planning, drafting communications and documents for staff review, and streamlining internal workflows.

8.2 The data boundary.AI tools access Dumeau's records through restricted, read-only access. They do not receive your login credentials, and they do not receive payment card or bank details, which Dumeau itself never holds. Records the AI may read include names, addresses, home systems, service requests, quotes, and invoices.

8.3 Human review. Any communication drafted with AI assistance is reviewed and approved by a person before it is sent. Any machine-generated claim about your home, such as a product-recall match, is confirmed by a person before it reaches you. AI output can be inaccurate, and it is checked.

8.4 No automated decisions. No decision that affects you is made by automated processing alone.

8.5 Where and on what terms.Anthropic processes data in the United States (Article 7). Dumeau uses Anthropic's commercial services, under which Anthropic's Commercial Terms of Service provide that Anthropic “may not train models on Customer Content from Services”, where customer inputs and outputs together are “Customer Content”, and under which API data is deleted on Anthropic's default schedule of approximately 30 days, subject to Anthropic's stated exceptions.

8.6 If this changes. If Dumeau introduces an AI feature that members interact with directly, or ever uses AI to make a decision with legal or similarly significant effect about a member, this Policy will be updated first and members notified before the change takes effect.

9.1 Access arrangements for service visits are yours to make, and our systems store no entry, gate, or alarm codes under any arrangement. Travel Watch custody, where you choose it, is governed by the signed Key and Code Custody Authorization and held outside our systems, as described in Section 3.9. Away dates and visit schedules are treated as confidential, are visible only to Dumeau staff, and are never used in marketing.

10.1 Your household. We collect personal information about other adults in your household only with their consent, and we record the minimum the service requires.

10.2 Memberships arranged for someone else. Where a membership is arranged or paid for on behalf of another adult, the member whose home and information it is must consent to the collection and use of their personal information; paying for the service does not transfer that right. Where the member wants Dumeau to report to family members, the reporting is set up in writing with the member first: who receives what, and how it can be changed or revoked. Where an adult cannot consent for themselves, Dumeau requires the legal authority that speaks for them, such as a guardianship or trusteeship order or an enduring power of attorney in effect, and follows its scope.

10.3 Trade contractors' personnel.We collect the information needed to vet, engage, schedule, and pay trade contractors, including their personnel's names, trade credentials, and compliance documentation, and we handle it under this Policy.

11.1 We retain personal information only as long as reasonably required for the identified purposes or for legal requirements, and then destroy it or render it non-identifying.

11.2 Once a membership ends and offboarding completes:

11.3Offboarding includes an export of your home's documentation, provided to you before deletion. Data-portability mechanics are described in the Terms of Use and your Membership Agreement.

12.1 Dumeau protects personal information with safeguards appropriate to its sensitivity:

• all traffic is encrypted in transit;
• passwords are one-way hashed; nobody at Dumeau can read them;
• every portal is scoped to its user: members see only their own home, trade contractors see only their own jobs, and files are served only to the people entitled to them, with these boundaries covered by automated tests that run on every change to the product;
• AI access to records is read-only and excludes credentials and payment details (Section 8.2);
• staff access follows least privilege;
• payment details never enter Dumeau's systems; and
• records held outside the product, such as Travel Watch custody, are governed by the written procedures described in this Policy and the Key and Code Custody Authorization.

13.1If personal information under Dumeau's control is lost, or accessed or disclosed without authorization, and a reasonable person would consider that a real risk of significant harm to an individual exists, Dumeau will report the incident to the Information and Privacy Commissioner of Alberta without unreasonable delay, as PIPA requires, with the assessment of harm the regulation prescribes, and will notify affected individuals directly: what happened, what information was involved, what Dumeau has done, and what you can do. Dumeau maintains an internal breach-response procedure so that this response is immediate.

14.1 You may ask Dumeau at any time to:

• provide access to the personal information it holds about you;
• correct information that is inaccurate;
• withdraw consent as described in Section 5.5; and
• delete your information, subject to the retention rules in Article 11. Dumeau will identify what must be kept and on what basis, and delete the rest.

14.2 Requests go to the Privacy Officer at hello@dumeau.ca. Dumeau responds within 45 days, as PIPA requires. PIPA permits that period to be extended in limited circumstances; if an extension applies, Dumeau will tell you before the initial 45 days expire, with the reason and the new date. Access requests are normally processed without charge; where a request is unusually large, Dumeau may charge a reasonable cost-based fee and will provide a written estimate before proceeding. Correction is always free of charge.

14.3If you are not satisfied with Dumeau's response, you may complain to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or, for matters under federal law, the Office of the Privacy Commissioner of Canada (priv.gc.ca).

15.1 Dumeau uses essential cookies that keep you signed in, and anonymous, cookieless visitor statistics. Dumeau uses no advertising cookies, no cross-site tracking, and no third-party ad networks. If that ever changes, this Policy will be updated and appropriate consent obtained first.

16.1Dumeau's services and website are directed to adult homeowners, not children, and Dumeau does not knowingly collect personal information from anyone under 18.

17.1 PIPA also governs employee personal information. If you apply to work at Dumeau or join its staff, Dumeau collects and uses your personal information for recruitment, employment administration, and legal compliance, and will provide an employee privacy notice at or before hiring.

18.1 If this Policy changes materially, for example new categories of information, new sharing, new countries, or new uses, Dumeau will notify members by email before the change takes effect and update the effective date and version above. The current version is always available at this address, and prior versions are retained.

18.2 Members.For members, this Policy forms part of the Membership Agreement (its Section 1.3). Where a change to this Policy would increase your obligations or reduce Dumeau's obligations under that Agreement, the change takes effect for you under Article 18 of the Membership Agreement — itemized written notice at least 30 days in advance, taking effect at the start of a billing period — and not merely on posting or email notice under Section 18.1.