ThemisIQ Compliance Inc. ("ThemisIQ", "we", "us") is a compliance intelligence and SaaS platform company incorporated in Canada, operating www.themisiq.co.
Our designated Privacy Officer is the Chief Executive Officer: privacy@themisiq.co. All privacy requests should be directed to this address.
| Category | Examples | Our role |
|---|---|---|
| Account data | Name, work email, job title, company, billing address | Controller |
| Platform data | GHG data, workforce metrics, supply chain data, AI inventories entered into ThemisIQ modules | Processor: you are the controller |
| Assessment data | Compliance Assessment answers, email, company, role | Controller |
| Free account data | Name, work email, company, one Scope 1 and Scope 2 calculation, the country of its first site, sign-in records, and the IP address and browser details recorded with a marketing consent choice | Controller |
| Usage data | Log data, IP addresses, browser type, pages visited, feature usage | Controller |
You can calculate Scope 1 and Scope 2 emissions on ThemisIQ without an account. If you choose "Keep my results", we create a free account for you and keep that one calculation. This is what that collects, why, and for how long.
| What we collect | Why | How long we keep it |
|---|---|---|
| Your name | To address your results email and identify your account. | While the account exists. |
| Your work email | To send your sign-in code, sign you in, and email you your results. | While the account exists. |
| Your company | To name the company your calculation is saved under. | While the account exists. |
| Your calculation: the sites and figures you entered, and the results worked out from them | To save it to your account and email it to you. Until you confirm your email, we hold a copy so that you can confirm on another device. | The held copy: deleted when you confirm, or deleted within a day after its 24 hours end. The saved calculation: while the account exists. |
| The country of your first site | To understand which countries our free accounts report from. | While the account exists. |
| Your IP address | To limit repeated requests and sign-ups from one connection, which protects the service from abuse. | With the held copy, until that copy is deleted. In our rate-limit records, for 30 days. |
| Your marketing choice, with your IP address and browser details (user agent) and the time | To prove what you agreed to, as Canada's anti-spam law (CASL) requires. We record your choice whether or not you tick the box. | As a marketing consent record: 3 years from your last interaction with us. |
The free account uses these service providers: Supabase stores the account, the calculation and the consent records, and sends your sign-in code; Resend delivers the sign-in code and results emails; Cloudflare Turnstile checks that the forms are used by a person, and receives your IP address and browser details for that check; Vercel hosts the site and receives your IP address with each request. Stripe is not involved unless you buy a plan.
The box asking whether you want occasional updates is unticked and optional, and your account does not depend on it. You can withdraw your consent at any time with the unsubscribe link in an email that carries one, or under "Email updates" on your dashboard. Withdrawal takes effect immediately. We keep the record of your choice and of your withdrawal, with the time of each, as proof of consent; withdrawing does not delete that record.
| Purpose | Data used | Legal basis |
|---|---|---|
| Delivering the ThemisIQ platform | Account data, platform data | Contract performance |
| Sending assessment results | Assessment data, email | Express consent (CASL) |
| Sending the results you asked for, sign-in codes, and keeping your free calculation | Free account data | Contract performance (your request) |
| Marketing emails | Account data, email | Express consent (CASL): unsubscribe anytime |
| Billing and invoicing | Account data | Contract / legal obligation (CRA) |
| Platform security | Usage data, log data | Legitimate interests |
For Canadian residents, our basis is the PIPEDA fair information principles: primarily consent and legitimate business purposes.
For EU/EEA/UK residents, our bases under GDPR / UK GDPR are: contract performance (Art. 6(1)(b)), consent (Art. 6(1)(a)), legal obligation (Art. 6(1)(c)), and legitimate interests (Art. 6(1)(f)).
For Québec residents, Law 25 applies additional requirements: Privacy Impact Assessments, 72-hour breach reporting to the CAI, named Privacy Officer, and data portability rights.
| Recipient | Data shared | Purpose | Location |
|---|---|---|---|
| Supabase (AWS) | All platform data | Database, auth, storage | USA |
| Vercel | Application traffic | Hosting and CDN | Global |
| Stripe | Billing data | Payment processing | USA |
| Resend | Name, email | Transactional email, including sign-in codes (sent for Supabase) and results emails | USA |
| Cloudflare (Turnstile) | IP address, browser details | Checking that sign-up, sign-in and "Keep my results" forms are used by a person | Global |
| Anthropic | Source documents uploaded for Bill Review, and the name of the location each one is for | Reading figures off Bill Review documents for inventories read by AI. Documents uploaded while an inventory is read by a ThemisIQ specialist are never sent to it. | USA |
ThemisIQ is Canadian. Data is processed in Canada and transferred to sub-processors in the United States.
| Data type | Retention period | Basis |
|---|---|---|
| Customer platform data | Subscription duration + 12 months | Contract |
| Account and contact data (customers who have bought a plan) | 7 years from last activity | Canada Revenue Agency |
| Free accounts that never buy a plan, and their calculation | While the account is used. A free account with no sign-in for 24 months may be deleted, after 30 days' notice by email | PIPEDA: limiting retention |
| Calculation held while you confirm your email | Deleted when you confirm, or deleted within a day after its 24 hours end | Providing the service you asked for |
| Rate-limit records (IP address and email key) | 30 days, then deleted automatically | Protecting the service from abuse |
| Marketing consent records | 3 years from last interaction | CASL |
| Assessment / lead data | 3 years from collection | PIPEDA / CASL |
| Security and audit logs | 5 years | Legitimate interest: security |
| Billing records | 7 years | Canada Revenue Agency |
To exercise any right, email privacy@themisiq.co. We respond within 30 days (Canada/EU) or 45 days (US). No charge for the first request in any 12-month period.
ThemisIQ does not sell personal information as defined under CCPA §1798.140(ad). You do not need to submit a "Do Not Sell or Share" request because we do not engage in these activities.
Residents of California, Virginia, Colorado, Connecticut, Texas, Montana, Oregon, Delaware, New Hampshire, New Jersey, Nebraska, and Maryland have rights to access, delete, correct, and port their personal data. To exercise any right, email privacy@themisiq.co.
CAN-SPAM: All ThemisIQ commercial emails to US recipients comply with CAN-SPAM. Every commercial email contains a functioning one-click unsubscribe link honoured within 48 hours.
COPPA: The ThemisIQ platform is directed exclusively at business professionals. We do not knowingly collect personal information from persons under 13.
We use essential cookies (session management, authentication) and optional analytics cookies (anonymised usage). We do not use advertising cookies, tracking pixels, or third-party behavioural targeting. ThemisIQ products are entirely ad-free.
Each free tool (the Climate Risk Screening, the free GHG calculator, the Compliance Obligation Map and the Canada forced labour check) sets one cookie of its own, named tq_free_ followed by the tool, so each browser gets one free use of each tool. The cookie is first-party and HTTP-only, it is signed so it cannot be altered, and it holds only the time of your first use and a random number: no IP address, no email and nothing about your answers. It expires after 30 days. To stop one network using a free tool many times, we also count new free uses per IP address for 7 days; that count is kept as a rate-limit record (Section 9).