Privacy Policy

PMRFP is operated by Talkerstein Consulting Group, which is responsible for the personal information described in this policy. Our Privacy Officer oversees how we protect it and handles privacy requests and complaints:

This policy covers members (trade companies, suppliers, property managers, realtors, tradespeople and other account holders), visitors to pmrfp.com, people who sign up for our emails, job applicants who apply through PMRFP, people who contact us, and people whose information appears in the public records we republish.

We collect the information you provide directly, including:

• Account details: your name, email address, phone number, role and password (or your Google account name and email if you sign in with Google).
• Company details: company name, contact details, trades, service regions, profile text, photos, projects and case studies.
• Activity on the Service: RFPs you post, interest you express in an RFP, saved RFPs, reviews, forum posts, photos and votes, marketplace and job listings.
• Job applications: the name, contact details and message you send, which go to the employer you apply to.
• Tradesperson profiles: your display name, trade, region, city, experience, tickets (certifications), availability, pay expectations, bio and phone number. You choose whether the profile is published and whether your contact details are visible.
• Messages to us: contact-form messages, bid-support requests and emails.
• Text you enter into our AI-assisted tools (such as the RFP Writer).
• Billing: payments are handled by Stripe. We receive your billing contact, plan, amounts and payment status, not your full card number.

PMRFP republishes public tender notices, contract award records, bid results, building permits and major-project data from government open-data portals and other public sources, under the open-data licences or terms of use that apply to each source. These records can include business names, the buyer's contact details as the buyer published them (sometimes the name, work email and work phone of a procurement contact), contract and bid amounts, and project locations.

We publish business names only. When a winner or bidder name looks like a private individual's name (a person's name with no business word or legal suffix), we don't publish the name: the record is counted and shown as “Individual (not named)” or “Individual bidder (not named)”. A trading name that includes a person's name together with a business word (for example “Jean Tremblay Excavation”) is a business name and is shown as published. This is an automated rule; if it gets something wrong, or you want a record about you corrected or removed, see our Corrections and removal policy.

When you use the Service, we and our providers collect limited technical information:

• Technical and log data our hosting provider records when pages are served, such as IP address, browser and device type, pages requested and time.
• The country and province or state our host estimates from your IP address, used to show the right market (Canada or the U.S.) and prefill your region. Never for access or billing.
• A one-way hash of your IP address, used for rate limiting and spam protection, and to count profile views.
• Our own visit statistics, kept in our database without cookies or third parties: the pages you view, the listings you open, the referring website's domain (never the full address) and steps such as opening the sign-up page, signing up, finishing onboarding, starting or completing a checkout, or posting an RFP. You are counted as a one-way code that changes every day, made from your account if you're signed in, or else from your browser's details and first-visit cookie. Never your IP address, and nothing that links one day to the next.
• If your browser sends Do-Not-Track or Global Privacy Control, we record none of these statistics and set no first-visit cookie.

We use these first-party cookies:

• Sign-in cookies set by our authentication provider (Supabase) to keep you signed in. Essential.
• NEXT_LOCALE (1 year): the language you picked.
• pmrfp_lang_hint (1 year): remembers that you closed the language suggestion.
• pmrfp_geo (30 days): your country and province or state as estimated by our host (for example “CA-ON”). Never your IP address.
• pmrfp_market (1 year): whether you chose to see Canada or the U.S.
• pmrfp_acct (1 year): your company's country and province or state, so pages match your account.
• pmrfp_ft (90 days): how you first found PMRFP (see below).

Your browser's local storage also keeps your analytics choice, unsent drafts (for example an RFP you are writing) and similar conveniences on your own device. You can control cookies and local storage in your browser settings; blocking sign-in cookies will stop you from signing in.

To understand how people find PMRFP, we record the page you first landed on and the referring site or campaign. One first-party cookie (pmrfp_ft, kept for 90 days from your first visit) holds the first page's address without its query string, the referring website's domain only (never the full address), any campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content), the campaign tags of a later tagged visit if they differ, the date, the page language and your country as estimated by our host. It never holds your IP address, and anything that looks like an email address is dropped.

If you create an account, we save these values with it, along with the channel we classify them into (for example search, email or social), how you signed up (password, emailed link or Google) and your account type, so we can see which channels bring members. If your browser sends Do-Not-Track or Global Privacy Control, the record keeps only how you signed up and your account type. This record is visible only to PMRFP administrators and is deleted with your account. We also count first visits per page and channel as daily totals that identify no one. Blocking or clearing the cookie doesn't affect the Service.

We count visits and sign-ups ourselves, without cookies or third parties (see “Information Collected Automatically”). We also use Vercel Web Analytics and Speed Insights, which don't use cookies, to count page views and measure site performance.

Google Analytics 4 and Microsoft Clarity use cookies, so we ask first: they load only if you click “Accept analytics” in the banner, and never if you decline. Google Analytics sends usage data (such as pages viewed, device type and approximate location) to Google, with Google signals and ad personalization turned off. Clarity, when it's turned on, records how visitors use pages (heatmaps and session recordings). If your browser sends Do-Not-Track or Global Privacy Control, we treat it as declining: no banner, and neither one loads. We don't use advertising or retargeting pixels.

We use personal information to:

• operate the Service: accounts, profiles, the directory, RFPs, the forum, jobs and the marketplace;
• match trades with relevant opportunities and send the alerts and emails described below;
• process subscriptions, trials and payments;
• provide support and answer messages;
• keep the Service secure and prevent spam, fraud and abuse;
• understand and improve how the Service is used, mostly with aggregate data;
• comply with the law.

We don't sell personal information.

We send these kinds of email:

• Service and transactional messages: sign-in, account and billing emails, trial status, replies to your RFP or interest, and other messages needed to run your account.
• Alerts and digests you turn on: RFP and lead alerts, saved-RFP and tender alerts, forum reply notifications, the weekly brief for Trade Pro and trial members, and the free weekly email (sent only after you confirm your address).
• Onboarding emails: after a trade company joins, a short series (at most one a day) about getting started, the free trial, Trade Pro and the Founding 500 offer. It stops when you upgrade, unsubscribe or reach the end of the series. We send these only where Canada's Anti-Spam Legislation (CASL) allows.
• Business outreach: we may email businesses at business addresses they publish conspicuously (for example on their website or in public tender records), about PMRFP as it relates to the recipient's business or role, where they haven't said they don't want unsolicited email.

Every commercial email identifies PMRFP and Talkerstein Consulting Group, includes our mailing address, and has an unsubscribe link. Unsubscribe links take effect right away; if you ask by email, we act within 10 business days. You can also change most email settings in your account. Unsubscribing doesn't stop essential service messages about your account.

Information you choose to publish, such as your company profile, an RFP, a review, a forum post or a published tradesperson profile, is visible to others as part of the Service. When you express interest in an RFP or apply for a job, we share what you submit with the person who posted it.

We share personal information with service providers that help us run PMRFP (listed below), only as needed for the services they provide. We may also disclose information where required by law, to protect rights and safety, or as part of a sale or reorganization of the business, subject to this policy. We do not sell your personal information.

We use these providers to operate the Service:

• Supabase: database, sign-in and file storage.
• Vercel: website hosting, analytics and performance measurement.
• Stripe: payments and billing.
• Resend: sending email.
• HighLevel: our customer-relationship (CRM) system, for member and enquiry contact details.
• Google: Google Analytics (only if you accept it in the banner), Google sign-in if you use it, and the Gemini AI service for AI-assisted features.
• Upstash: rate limiting (hashed IP addresses only).
• Cloudflare Turnstile: spam checks on forum posts, when turned on.
• Microsoft Clarity: only if you accept it in the banner.

Some of these providers store or process personal information outside Québec and Canada, including in the United States. There, it is subject to the laws of that country and may be accessible to its authorities. We rely on our providers' contractual commitments to protect personal information they handle for us.

• Account and profile information: while your account is open. When you ask us to close your account, we delete or anonymize it, except what we must keep by law (for example billing and tax records).
• Sign-up attribution: the pmrfp_ft cookie lasts up to 90 days; the copy saved with an account is deleted with that account.
• Visit statistics (daily visitor codes, page and listing views, referring sites, sign-up and checkout steps): deleted after 13 months.
• Rate-limiting data: hashed IP addresses, kept for a short time (usually less than a day).
• Trial records: kept while the organization exists, as the record that it used its one trial.
• Unsubscribe records: kept so we keep honouring your choice.
• Public-record data: kept while it remains relevant and the source publishes it, or until we correct or remove it under our Corrections and removal policy.

Everything else is kept only as long as needed for the purposes above, then deleted or anonymized.

We use administrative, technical, and physical safeguards designed to protect your information, including access controls that limit who can see it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and respond promptly to any incident, including notifying you and the authorities where the law requires.

Under PIPEDA and Québec's private-sector privacy law, you may, subject to the limits the law allows:

• ask whether we hold personal information about you and get access to it;
• ask us to correct (rectify) information that is inaccurate, incomplete or out of date;
• ask us to delete information we no longer need, or, where the law provides, to stop disseminating it or de-index a link to it;
• withdraw your consent to a use of your information (this may mean we can't provide part of the Service);
• where the law provides, receive information you gave us in a structured, commonly used technological format.

To make a request, email our Privacy Officer at privacy@pmrfp.com. We may need to confirm your identity. We will respond within 30 days. If we can't do what you ask, we will explain why and tell you how to challenge our decision.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Québec, to the Commission d'accès à l'information du Québec.

To report an error in a listing, a public record or a profile, or to ask us to remove personal information, use the “Report an error or request removal” link where it appears or email privacy@pmrfp.com. Our Corrections and removal policy explains what we check and how long it takes.

PMRFP is meant for businesses and working professionals. It is not directed at children, and we don't knowingly collect personal information from children.

We may update this policy from time to time. We will change the “last updated” date above and, for significant changes, give additional notice where appropriate.

Questions or privacy requests? Email our Privacy Officer at privacy@pmrfp.com. For anything else, reach us at info@pmrfp.com.