Privacy Policy

mTxsolution Inc. ("we", "us", "our"), headquartered in Montreal, Quebec, Canada, operates the mtxsolution.ca platform, including the AMMA (Asset Management Maturity Assessment) self-assessment tool and the EndofTime EAM/CMMS platform.

This Privacy Policy applies to all users of our website, online assessment platform, consulting services, and related digital services. We are committed to protecting your privacy and handling your personal information with transparency and care.

By using our services, you acknowledge that you have read and understood this policy. If you do not agree with our practices, please discontinue use of our services.

Personal information you provide directly

• Account registration: First name, last name, email address, phone number (optional), company name, job title (optional)
• Assessment data: Responses to evaluation questions, justifications, proof documents you upload during AMMA audits
• Payment information: Billing name and billing address — processed securely via Stripe. Your credit card details never touch or transit through our servers.
• Contact forms: Name, email, phone number, message content when you reach out to us
• Professional context: Industry sector, company size, country, areas of interest

Information collected automatically

• Device information: Browser type, operating system, device type, screen resolution
• Usage data: Pages visited, scroll depth, time spent on pages, interactions (anonymized)
• Network data: IP address (hashed and anonymized), approximate geolocation (country/region level only)
• Cookies: Authentication tokens, language preference, analytics consent status, session identifiers
• Referral data: Referrer URL, UTM parameters for marketing attribution

Information from third parties

If you choose to sign in via social login (Google, GitHub, LinkedIn, or Microsoft), we receive your public profile information (email, display name, avatar) from the OAuth provider. We only access what you explicitly authorize.

We use your information for the following purposes:

• Service delivery: Manage your account, deliver evaluations, generate maturity reports, and provide consulting services
• Payment processing: Process payments and manage subscriptions through our payment provider (Stripe)
• Communications: Send transactional emails including account verification, password reset, evaluation notifications, and report delivery (via Resend)
• Service improvement: Analyze usage patterns and feature adoption to improve our platform (using anonymized, aggregated data only)
• Security: Detect and prevent fraud, unauthorized access, and suspicious activity on our platform
• Marketing: With your explicit consent only — send newsletters, product updates, and industry insights. You can opt out at any time.
• Legal compliance: Respond to legal requests, enforce our terms, and comply with applicable laws

We process your personal data based on the following legal grounds:

• Performance of contract: Processing necessary to deliver the services you signed up for — account management, evaluations, reports, and consulting
• Consent: Marketing communications, analytics cookies, and third-party cookies — you can withdraw consent at any time
• Legitimate interest: Platform security, fraud prevention, service improvement, and internal analytics
• Legal obligation: Tax and financial records, compliance with Canadian federal privacy laws (PIPEDA) and Canada's Anti-Spam Legislation (CASL)

We do NOT sell your personal data to third parties. Your data will never be sold.

Your information is secured on our servers. We implement rigorous security measures to ensure your data cannot leak or be accessed by unauthorized parties.

Service providers (data processors)

We work with a limited number of trusted service providers who process data on our behalf:

• Stripe (payment processing): Receives billing information and payment data exclusively for transaction processing
• Resend (email delivery): Receives email addresses solely for delivering transactional and marketing emails — no data is retained post-delivery
• OAuth providers (Google, GitHub, LinkedIn, Microsoft): Used for authentication only — they do not receive your platform data

When we may disclose information

We will NOT disclose your information except in these limited circumstances:

• With your explicit, informed consent
• To comply with a legal obligation, court order, or regulatory requirement
• To protect our rights, safety, or property in case of emergency or legal dispute

Your data is primarily stored on servers located in Canada, under Canadian federal jurisdiction.

Some of our service providers (Stripe, Resend) operate from the United States. When data is transferred outside of Canada, we ensure that adequate safeguards are in place, including Standard Contractual Clauses and compliance with PIPEDA requirements for cross-border data transfers.

For users in the European Union, we ensure GDPR-compliant transfer mechanisms are in place for any data leaving the EU/EEA.

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:

• Active accounts: Data is retained for the entire duration your account remains active
• Evaluation data: Retained for the duration of your subscription — exportable at any time via your dashboard
• IP addresses: Anonymized after 90 days
• Email delivery logs: Anonymized after 30 days
• Activity and audit logs: Retained for 1 year for security and audit trail purposes
• Cookie consent records: 12 months
• Deleted accounts: Personal data is purged within 30 days of your deletion request. Some data may be retained up to 7 years where required by law for financial and tax compliance.

Under GDPR (for EU users), PIPEDA (Canadian federal law), and applicable provincial privacy laws, you have the following rights:

• Right of access: Request a complete copy of all personal data we hold about you
• Right to rectification: Correct any inaccurate or incomplete personal data
• Right to deletion: Request the deletion of your account and all associated personal data
• Right to data portability: Receive your data in a structured, machine-readable format (JSON)
• Right to withdraw consent: Opt out of marketing communications or analytics tracking at any time
• Right to object: Object to processing based on our legitimate interests
• Right to restrict processing: Limit how we process your data in certain circumstances

How to exercise your rights

You can exercise most of these rights directly through your profile settings on the platform. Alternatively, you can submit a request by emailing privacy@mtxsolution.com.

We will respond to all valid requests within 30 days. We may ask for identity verification before processing your request.

Your data is secured on our servers and protected by industry-standard security measures. We take data security seriously and have implemented comprehensive protections:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest
• Password protection: Passwords are hashed using bcrypt — we never store plaintext passwords
• Authentication: Secure JWT token-based authentication with optional two-factor authentication (2FA/TOTP)
• Access control: Role-based access control (RBAC) with principle of least privilege
• Security monitoring: 24/7 automated logging, failed login detection, and automatic IP blocking after repeated failed attempts
• Session security: Automatic session expiration, secure token rotation, and session revocation capabilities
• Audit trail: All data access and modifications are logged with unique correlation IDs for complete traceability
• Regular audits: We conduct regular security reviews and vulnerability assessments

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make changes:

• The updated policy will be posted on this page with a new effective date
• For material changes, we will notify registered users via email at least 30 days before the changes take effect
• Continued use of our services after the effective date constitutes acceptance of the updated policy

Contact our Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@mtxsolution.com
• General inquiries: mtx@mtxsolution.com
• Mailing address: mTxsolution Inc., Montreal, QC, Canada