Legal notice: This Privacy Policy describes how TrustBrig Inc. collects, uses, and discloses personal information. TrustBrig Inc. recommends that you read this policy carefully. Questions may be directed to privacy@trustbrig.com.
1. Introduction
TrustBrig Inc. ("TrustBrig", "we", "us", or "our") is committed to protecting the privacy of the individuals and organisations that use our escrow platform and services. This Privacy Policy explains what personal information we collect, why we collect it, how we use and disclose it, and what rights you have with respect to your personal information.
This Privacy Policy applies to personal information collected through TrustBrig's website, web application, and related services (collectively, the "Platform"). It does not apply to information collected by third parties that we link to or that integrate with our Platform.
TrustBrig is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Our designated privacy officer is the Chief Operating Officer, reachable at privacy@trustbrig.com.
2. Information we collect
2.1 Information you provide directly
When you register for an account or use our services, we collect:
- Identity information: full legal name, date of birth, government-issued identification numbers (for identity verification purposes)
- Contact information: email address, phone number, mailing address
- Corporate information: company name, registration number, articles of incorporation, beneficial ownership information (for corporate users)
- Financial information: bank account details for fund transfers, source of funds documentation
- Transaction information: details of escrow transactions initiated through the Platform, including counterparty information, Goods descriptions, escrow amounts, and Release Conditions
- Communications: messages sent through the Platform between Parties, and communications with TrustBrig's support team
2.2 Information collected automatically
When you use the Platform, we automatically collect:
- Usage data: pages visited, features used, actions taken, timestamps
- Device and connection information: IP address, browser type, operating system, device identifiers
- Log data: server logs, error logs, and security event logs
2.3 Information from third parties
- Identity verification: TrustBrig uses Didit, a third-party KYC/AML provider, to verify your identity. Identity document images are submitted directly to Didit's infrastructure; TrustBrig receives only the verification outcome (pass/fail/pending), not your identity documents themselves.
- Sanctions and PEP screening: TrustBrig receives screening results from Didit indicating whether you appear on sanctions lists, PEP databases, or adverse media sources.
3. How we use your information
We use your personal information for the following purposes:
- Account management: creating and maintaining your account, authenticating your identity, and communicating with you about your account
- KYC/AML compliance: verifying your identity and screening you against sanctions and watchlists as required by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and related regulations
- Transaction processing: facilitating escrow transactions, holding and releasing funds, and maintaining records of Transactions
- Regulatory compliance: fulfilling our obligations under PCMLTFA, PIPEDA, and other applicable laws, including reporting to FINTRAC where required
- Security: detecting, preventing, and responding to fraud, security incidents, and other harmful activity
- Platform improvement: analysing usage patterns to improve the Platform and our services
- Communications: sending you transactional notifications, account alerts, and, where you have consented, service updates and announcements
- Legal proceedings: enforcing our Terms of Service and defending against legal claims
4. Legal basis for processing
We collect and use your personal information with your consent (provided when you accept our Terms of Service and this Privacy Policy) and as necessary to:
- Perform the escrow services you have requested
- Comply with our legal obligations under PCMLTFA, PIPEDA, and other applicable laws
- Pursue our legitimate interests in operating a secure and compliant escrow platform, where those interests are not overridden by your privacy rights
5. How we share your information
TrustBrig does not sell your personal information. We share your personal information only in the following circumstances:
5.1 With transaction counterparties
In connection with a Transaction, we share necessary information with the other Party (Initiating Counterparty or Responding Counterparty) to facilitate the escrow arrangement. The information shared is limited to what is necessary for the Transaction.
5.2 With service providers
We share personal information with third-party service providers that help us operate the Platform and deliver our services, including:
- Didit: identity verification and ongoing AML screening
- Better Stack: operational log aggregation and monitoring (user identifiers, not PII fields, appear in operational logs)
- Doppler: secrets management (does not process user personal information)
- Linode (Akamai): cloud infrastructure and data storage in Toronto, Ontario
- Cloudflare: edge network, DDoS protection, and DNS (processes request metadata, not transaction content)
- AWS: key management services in Montreal, Quebec (ca-central-1)
These service providers are contractually required to protect your personal information and use it only for the purposes for which it was disclosed.
5.3 With regulators and law enforcement
We may disclose your personal information to FINTRAC, OSFI, law enforcement agencies, or other regulatory authorities where required by law. Where permitted by law, we will notify you of such disclosure. Note that in the case of Suspicious Transaction Reports filed with FINTRAC, we are legally prohibited from disclosing to you that a report has been made.
5.4 In connection with a business transaction
If TrustBrig is involved in a merger, acquisition, sale of assets, or similar transaction, your personal information may be transferred as part of that transaction. We will notify you of any such transfer and any material changes to how your information is handled.
5.5 With your consent
We may share your personal information with other parties where you have provided explicit consent.
6. Data residency and cross-border transfers
TrustBrig stores personal information and financial records primarily on infrastructure located in Toronto, Ontario, Canada. Some personal information is processed by third-party service providers outside Canada, as described in our data residency documentation. Specifically:
- Identity document images are processed by Didit, an international KYC vendor, outside Canada
- Operational logs are forwarded to Better Stack, which stores data in the United States
- Edge traffic metadata is processed by Cloudflare's global network
These transfers are made pursuant to data processing agreements with the relevant service providers and are disclosed here in accordance with PIPEDA.
7. Data retention
We retain your personal information for seven years from the date of your last Transaction or the end of your business relationship with TrustBrig, whichever is later. This retention period reflects our obligations under PCMLTFA and standard financial services practice in Canada.
Some categories of data are retained for shorter periods where no regulatory obligation requires longer retention. Operational logs are retained for 90 days in our searchable log system and seven years in our immutable archive.
Where you request erasure of your personal information, we will delete information that is not subject to regulatory retention obligations. Information that we are legally required to retain will be kept for the required period; we will notify you of this limitation and the legal basis for it.
8. Security
TrustBrig protects your personal information using industry-standard technical and organisational safeguards, including:
- Envelope encryption of PII fields in the database using AWS KMS-managed keys
- Access controls limiting access to personal information to authorised personnel only
- Immutable audit logs recording all access to personal information
- Regular security assessments and penetration testing
- Hardware security keys for all administrative access
No security measure is perfect. In the event of a personal data breach that creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required by PIPEDA.
9. Your rights
Under PIPEDA, you have the right to:
- Access: request access to the personal information TrustBrig holds about you
- Correction: request correction of inaccurate or incomplete personal information
- Erasure: request deletion of personal information that is not subject to regulatory retention obligations
- Withdraw consent: withdraw consent to the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions and reasonable notice
To exercise any of these rights, contact our privacy officer at privacy@trustbrig.com. We will respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.
10. Cookies and tracking
The Platform uses cookies and similar technologies to maintain your session, remember your preferences, and analyse usage. You may disable cookies in your browser settings, but doing so may affect the functionality of the Platform.
We do not use cookies for advertising purposes and do not share cookie data with advertising networks.
11. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email at least 30 days before taking effect. The effective date at the top of this document indicates when the policy was last updated. Continued use of the Platform following notice of changes constitutes acceptance of the updated policy.
12. Contact
Privacy Officer — TrustBrig Inc. Email: privacy@trustbrig.com Address: [Street Address, City, Province, Postal Code]
For complaints that cannot be resolved directly with TrustBrig, you may contact:
Office of the Privacy Commissioner of Canada Website: www.priv.gc.ca Toll-free: 1-800-282-1376
This Privacy Policy was last updated on [DATE]. This document requires review by qualified legal counsel prior to publication.