Privacy Policy

This policy explains what personal information Mechanical Feed handles, why, where it is kept, and your choices. It is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta's Personal Information Protection Act (PIPA) and, for Quebec, the Act respecting the protection of personal information in the private sector (Law 25).

Who is responsible

• Each site (our Customer, usually an employer) decides who is set up in Mechanical Feed and what is recorded. For the information about its people, the site is responsible, and Arvex Systems Inc. handles it on the site's behalf.
• For information we collect for ourselves (owners who sign up, billing, support and Ask Zosia questions), Arvex Systems Inc. is responsible.
• Privacy Officer, Arvex Systems Inc.: privacy@mechanicalfeed.com, 107 MacEwan Glen Close NW, Calgary, Alberta T3K 2C2, Canada.

What we handle

• Account: name, job title, crew, access level, user code, email, phone number (optional) and photo (optional). Your PIN or password is stored only in a form that cannot be read back, by anyone, including us.
• What you record: posts, faults, fixes, comments, hour readings, pre-ops, PMs, parts and photos, each with your name and the time, because a maintenance record needs to show who did what.
• Sign-in and security: when and on which devices you signed in, devices you chose to trust, face or fingerprint passkeys (we keep only the public half; your face or fingerprint never leaves your phone) and failed sign-in attempts.
• Owners who sign up: name, email, company, site and phone; billing through Stripe (we never see card numbers).
• Support: messages you choose to send to Vin, with the email you give for the reply.
• Ask Zosia: the questions Owners and Admins ask, kept without the asker's name (an Owner can switch this off).
• Visitors: the name and the pass they were given; someone who scans a machine's sticker to report a problem gives only the name they type.

What we never do

• We do not sell personal information, show ads, or use tracking or advertising cookies. The only cookies are the ones that keep you signed in, remember a trusted device and remember your display settings.
• Mechanical Feed does not rank or score people. It counts equipment, never people.
• Nobody at Arvex looks inside a site, except during a visit an Owner books ("Let Vin in"), which is written in the site's record.

Why we use it

To run the service for the site; to sign people in safely; to send the emails the service needs (setup links, PIN resets, reports a site asked for); to answer support; to bill; to keep the service secure; and to meet the law.

Who can see it

• Within a site: depending on access level. Owners and Admins can see people's emails; the rest of the crew cannot. Records show their author's name to the people on that site.
• Never another site.
• The companies that help us run the service, only for that purpose and under contract:
• Supabase (database, sign-in and files): Canada (Montréal).
• Vercel (runs the app): Canada (Montréal); pages may pass through its worldwide network on the way to you.
• Resend (sends email): United States.
• Anthropic (Ask Zosia's AI help for Owners and Admins): United States. Only the question and our help notes are sent; a site's records are not.
• Stripe (payments): Canada and the United States.
• Google Workspace (our own email, where support messages arrive): United States and Canada.

Information handled outside Canada may be accessed by the courts and authorities of that country under its law.

How long we keep it

• While the site uses the service.
• When someone leaves a site, the site switches them off: they can no longer sign in, and what they recorded stays in the site's record with their name, as a maintenance record must.
• When a site closes: an export is given to the site; the site is kept locked for up to 3 years, then deleted. Anonymous benchmark figures (only if the site opted in) contain no personal information.

Your choices and rights

• You can ask to see the personal information we hold about you, and ask for it to be corrected. For information a site holds about you, ask the site's owner or administrator first; we help them answer.
• You can withdraw consent to optional uses (such as an Ask Zosia question log, or benchmarks) through your site's Owner.
• Write to privacy@mechanicalfeed.com. We answer within 30 days. If you are not satisfied, you can contact the Office of the Privacy Commissioner of Canada, Alberta's Information and Privacy Commissioner, or, in Quebec, the Commission d'accès à l'information.

Security

Each site's information is separated by the database itself; sign-ins use PINs or passwords that are never stored readably, new-device checks and optional authenticator apps or passkeys; information is encrypted in transit and at rest by our providers. If a breach creates a real risk of significant harm, we will tell the affected sites and people and the Privacy Commissioner, as the law requires.

Changes

If this policy changes in a way that matters, we will say so in the app and ask people to agree again when they next sign in.