Report Purchases and Field-Data Privacy Policy

When you purchase a report or dataset, request information, or contact us, we may collect:

• Your name, email address, organization, phone number, billing address, and other details you provide to complete your order.
• Order and licence details, invoices, transaction identifiers, payment status, amounts, and currency.
• Limited payment-method information made available by our payment provider, such as card brand and the last four digits.
• Correspondence, support requests, and records needed to administer file delivery and eligible updates.

Stripe processes payments. Please enter payment credentials through the designated payment interface rather than sending full card numbers, security codes, or banking passwords to After Five by email or messaging. Stripe handles personal information under its own privacy policy as well as the terms governing its services to us.

We limit collection to information reasonably necessary for the stated purposes.

We use customer information to:

• Process orders and deliver purchased reports, datasets, and supporting files.
• Provide access to eligible ongoing files or snapshot updates for up to six months after purchase, as specified in the applicable order and licence terms.
• Maintain licence and delivery records, issue invoices, and respond to support requests.
• Send essential notices about delivery, material corrections, privacy, and security.
• Prevent fraud, protect our systems, resolve disputes, and meet legal, accounting, and tax obligations.

Purchasing a report does not automatically subscribe you to promotional communications. Where we send marketing messages, we obtain any consent required by applicable law and provide an unsubscribe option.

The update window concerns access to additional information. It does not determine how long we retain personal information or change your rights to use already-delivered materials under the applicable licence.

Our work documents infrastructure conditions, environmental risks, and community resilience. Source records may include asset locations, field observations, photographs, recordings, testimonies, and verification records. Where needed for coordination, consent, or verification, they may also contain contributor names, contact details, or other identifying information.

We explain the purposes of collecting personal information and obtain meaningful consent where required. We distinguish between collecting information for assessment and verification, sharing it in customer deliverables, and using it publicly for promotion.

Identifiable source records are restricted to authorized personnel and service providers with a legitimate need to access them. Working records and consent records are not automatically included in purchased deliverables.

We sell infrastructure and resilience intelligence, not personal profiles or lists of community members. We do not sell, rent, or trade personal information as a standalone product or provide it to data brokers.

Before releasing reports, datasets, or updates, we assess whether their contents could identify or expose individuals. Depending on the information and context, protective measures include removing names and contact details, redacting identifying passages, obscuring faces, removing identifying metadata, reducing location precision, aggregating observations, or withholding sensitive material.

Removing a name alone may not protect privacy. Photographs, quotations, precise coordinates, household details, and observations involving a small number of people can create identification risks. We consider these combinations when deciding what to release. Infrastructure coordinates may be included where appropriate following a privacy and exposure-risk assessment.

Standard customer deliverables exclude private contact lists, reporter identities, and identifiable household vulnerability records. Any exception involving identifiable content requires a separate assessment and appropriate consent or another lawful basis.

These measures reduce risk; they do not guarantee that re-identification is impossible. Customer use and redistribution are governed by the applicable report and dataset licence. This policy does not grant permission to identify or contact community contributors.

Where identifiable media or testimonies are collected or used, we explain the intended use, intended audience, and whether the material will appear in a paid report, a sponsor presentation, or public promotional content. Consent for one purpose does not automatically authorize another.

Permission from a partner organization or community leader does not replace an individual’s consent where individual consent is required. We provide explanations in a language and form the person can reasonably understand. Where a person cannot provide meaningful consent, we obtain consent from an appropriate parent, guardian, or authorized representative as required by applicable law.

You may contact us to withdraw consent, subject to legal or contractual restrictions and reasonable notice. We explain the consequences and practical limits, including that we may be unable to retrieve copies already lawfully distributed. We assess appropriate steps for future use, disclosure, and retention.

We may share the minimum necessary personal information with providers supporting payment processing, hosting, file delivery, email, customer support, accounting, and authorized field coordination or verification. We require appropriate contractual or other protections for personal information processed on our behalf and remain accountable for that processing.

Service providers may process or store information outside Canada. Information processed abroad may be subject to the laws and lawful access requirements of those jurisdictions. Contact our Privacy Officer for information about our relevant processing arrangements.

We may also disclose information with your consent, or without consent where applicable law permits or requires it, including qualifying emergencies involving threats to life, health, or security. Disclosures are limited to what is appropriate for the circumstances.

We retain personal information only for as long as reasonably necessary for its identified purposes and applicable legal obligations:

• Transaction, invoice, and supporting tax records are generally retained for at least six years from the end of the relevant tax year, or longer where legally required.
• Customer correspondence and delivery records are retained as needed for support, licence administration, and dispute resolution.
• Identifiable field records and consent records are retained as needed for verification, authorized uses, accountability, and legal obligations, with periodic review of whether identifying details remain necessary.

When personal information is no longer required, we securely delete, destroy, or anonymize it as appropriate. Backup copies may remain until scheduled backup expiry, subject to safeguards and any required preservation obligations.

We use safeguards appropriate to the sensitivity of the information, including access restrictions and administrative, technical, and organizational measures. No system or transmission method can guarantee absolute security.

We assess suspected privacy breaches, take appropriate containment and remediation steps, and maintain records as required by law. Where PIPEDA applies, we report breaches presenting a real risk of significant harm to the Office of the Privacy Commissioner of Canada and notify affected individuals as required. Records of breaches of security safeguards are retained for at least 24 months after we determine that the breach occurred.

You may contact our Privacy Officer to request access to your personal information, request correction, withdraw consent where applicable, or raise a concern about our handling of information.

We may request reasonable identity verification before releasing information. We generally respond to access requests within 30 days, subject to legally permitted extensions and exceptions. If access is refused or extended, we provide the explanation and notices required by applicable law. Withdrawal or a deletion request does not override lawful retention requirements.

You may also complain to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/ or another privacy regulator with jurisdiction over the matter.

We may update this policy and revise its effective date. Where a change introduces a new purpose or disclosure requiring consent, we obtain the required consent before implementing it. Posting a revised policy alone does not replace that obligation.

Please identify your request as a privacy inquiry and avoid sending sensitive personal or payment information unless we arrange a suitable method.