HabitaaThis is a draft, not yet in effect
This page describes, as accurately as we can, what Habitaa actually does with your data today. It has not yet been reviewed by a lawyer and is not a final, binding policy. Nothing on this page should be relied on as legal advice or a compliance guarantee, and it may change once that review is complete.
Privacy Policy
Draft prepared 2026-08-25
Habitaa is an energy-retrofit assessment platform for building owners in Canada. This page explains what information we collect when you use it, why we collect it, who else can see it, and how you can access, correct or delete it.
Information we collect
Account details you give us: your name, email address, and a securely hashed password (or, if you sign in without one, a magic link sent to your email). Building information: address, city, province, postal code, floor area, building type, and similar property details you enter. Utility bill data, in one of three ways: you type it in yourself, you upload a bill document (a photo or PDF) that our system reads automatically, or you connect a supported utility account through Green Button, an industry-standard secure data-sharing service, so bills are pulled directly from your utility. If you use the contractor marketplace, we also collect project details, quote requests, messages with providers, and reviews you write or receive.
How we use it
We use your building and bill data to generate your energy assessment: a score, an estimated greenhouse-gas footprint, and a prioritized list of retrofit measures with estimated costs, savings and available incentive programs. If you choose to request quotes, we share the relevant project details with the contractors or providers you're matched with, so they can respond.
Consent and your control over connected data
Connecting a utility account (Green Button), looking up property records, or letting our system read an uploaded bill are each their own separate, explicit consent, tied to the specific building it applies to. You can see every consent you've granted, and revoke any of them, at any time, from Settings > Privacy & Data. Revoking a Green Button connection also deactivates the access token behind it immediately.
Who we share information with
We do not sell your personal information. We share it only: with a contractor or service provider you've specifically requested a quote from (your project details, not your full billing history); with our infrastructure providers (hosting, email delivery) strictly to operate the service; or where required by law.
How long we keep it, and what happens when you ask us to delete it
Bills, buildings and reports are kept for as long as your account is active, so your assessment history stays available to you. If you ask us to delete your data (Settings > Privacy & Data), we clear the personal details tied to your account, including your building's name, address and coordinates, and any uploaded bill images, right away. Some records are kept in a different form rather than deleted outright, and we tell you exactly which ones and why at the moment you ask. Energy consumption and cost figures carry no personal details on their own and stay attached to your now-anonymized building so its history stays internally consistent. A consent record survives, marked revoked rather than removed, because a record we couldn't later show we'd honoured your request wouldn't actually be one. And, if you've used the contractor marketplace, a quote a provider gave you or a review either of you wrote is kept because it's also the other party's own legitimate business record, not only yours.
Security
Passwords are never stored in plain text. Green Button access and refresh tokens are encrypted at rest and only decrypted at the moment we use them to pull your bills. Uploaded bill documents and their extracted data are stored on infrastructure we control, not a third party's.
Your rights
You can, at any time and without contacting us first: download a copy of everything we hold about you; see and revoke every consent you've granted; and ask us to delete your personal data, with an immediate, on-screen explanation of exactly what was deleted, what was anonymized, and what was kept and why. All three are available from Settings > Privacy & Data.
Changes to this policy
Once this page is reviewed and finalized, we'll date any future change to it and, where the change is significant, let you know directly rather than only updating this page silently.
Questions
We haven't set up a dedicated privacy contact yet. This section will be updated with one once this policy is finalized. In the meantime, anything covered above (seeing your data, revoking a consent, deleting your data) is already available directly from your account, with no need to ask us first.
You can act on any of this right now, from your account: Privacy & Data settings