Privacy Policy — Canada
How Cerrax handles personal information under PIPEDA and Quebec law, in plain terms.
1. Who we are
Cerrax Ltd ("Cerrax", "we") provides software for moving companies: a pricing engine, and the inquiries, customer records, quotes and jobs around it. We are a company registered in England and Wales, and we have no office or establishment in Canada. This policy explains what personal information we handle for moving companies in Canada and the people they quote, why, where it is kept, and the rights you have under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector (the "Quebec Act"). Questions: hello@cerrax.io.
2. Two different roles
Our role depends on whose information it is:
- Your information (the moving company using Cerrax). For account holders' own details, we decide how the information is used, so we are the organization responsible for it.
- Your customers' information. When a moving company uses Cerrax, personal information about the people it deals with — its customers, the people who inquire with it, its other contacts, and its own staff and crew in their working role — is handled by us as the company's service provider, only on its instructions and for the purposes it sets. The moving company remains responsible for that information; our processing is governed by the Data Processing Agreement between us. If you are a moving company's customer, its own privacy policy applies to you, and questions about your information are best sent to the company first.
- Website visitors. We are responsible for the limited information you give us directly (e.g. a waitlist or contact form), and for keeping the service secure.
- A customer's video kept to train software. If a customer agrees to Cerrax keeping their video or photographs for that purpose, we are the organization accountable for that information, for that use alone (see section 3).
Our person in charge of the protection of personal information is our director, reachable at hello@cerrax.io. Our director is responsible for how we govern personal information: only the people whose role needs it can reach it, each bound by a written duty of confidentiality; it is kept and destroyed as section 10 sets out; and complaints are handled as section 14 sets out.
3. What we collect
From companies using Cerrax: account and contact details (name, company, email, phone, your province, and your Business Number and GST/HST or QST numbers if you give them), and the job inputs you enter to produce a price. Within job data: addresses and job details, which may be personal information of your customers — processed only to produce and explain a price and record the outcome you tell us. From the job itself: where your crew use Cerrax on the day, photographs they take of the property, its access and any damage found; if you ask your customer to sign the inventory, the name they give and the signature they draw; and, if you invite it and your customer chooses to, a video of their home that they send you to be quoted from. These are held as the record of the job, on your instructions, and are used for nothing else: they never affect a price and are never shared with another company, unless the company chooses to send a link to its crew or its insurer (see below). From website visitors: what you submit in a waitlist, demo or contact form.
We collect this information from you, from your staff, and from your customers through the links you send them. We do not record your browsing sessions, track behaviour for advertising, or use any technology that identifies, locates or profiles you. Nothing in Cerrax recognizes a face or extracts biometric information from a photograph, a video or a signature (where faces are blurred, software finds them only to blur them and keeps no measurement of them); a signature is kept only as the record that your customer agreed the inventory. The information may be stored and processed outside Quebec and outside Canada — see section 9.
Contacts and inquiries (for companies that switch them on). A moving company can keep a contact record for each of its customers and inquirers — their name, email addresses, phone numbers, company, preferred language, the addresses they have moved from or to, where the inquiry came from, the company's notes, and any choice the person made about the company's messages. The company decides what is kept; we hold it as its service provider, only within that company's account, and never share it with another company. To recognize the same person arriving twice, we keep a scrambled key made from their email address or phone number that cannot be read back without a secret held only by us.
Inquiry emails and AI. A moving company can give lead websites a Cerrax address to send inquiries to. We receive those emails (through Amazon Web Services) and read them to fill in the inquiry. If an email isn't laid out in labelled lines, we send its text — without the forwarding headers or earlier quoted messages — to Anthropic, an AI provider in the United States, which suggests the name, contact details, addresses, date and size of the move. A suggestion is only used if the words appear in the email, and a person at the company checks it before anything is priced or sent. Anthropic does not use it to train its models and deletes it within 30 days (longer only if it is flagged for misuse). We do not keep the email's text for any purpose of our own. When a company describes a job's items and rooms to Cerrax, we keep that description — with any email address, phone number or postal code removed — for 30 days to improve how Cerrax recognizes items, and then delete the text.
Messages a company sends through Cerrax. A moving company can switch on emails in its own name: reminders to someone who asked it for a quote (up to three, stopping as soon as they reply, accept or decline; the person can say no to them when they inquire), a thank-you after a move, and — only if the customer ticked a box agreeing to it — one email after the move asking whether they know anyone else who is moving. As Canada's anti-spam legislation requires, every one identifies the company, gives its mailing address and says it is sent for the company by Cerrax, and carries a one-tap way to unsubscribe that takes effect at once and covers all of these emails from that company to that person. We keep a record of each choice and when it was made so the company can show it later, and a scrambled note of an unsubscribe so it is honoured even after other records are deleted. The company is responsible for these messages; we send them on its instructions.
If your customer lets us keep their video to train software. When a customer sends a video or photographs, they may tick a separate box allowing Cerrax to keep them to train software that recognizes furniture and rooms. It is never ticked for them and it is not a condition of being quoted. For that use, and only that use, Cerrax isaccountable for the information in its own right, and we rely on the customer's express consent (PIPEDA, and in Quebec the private-sector privacy Act). Before any footage is used to train software, faces, documents and anything else that identifies a person or the home are blurred. Where Cerrax blurs faces as soon as a video arrives, the company sees it with faces already blurred. Nothing uses it today: it is kept, not yet used. The customer can withdraw their consent at any time, by asking the moving company or by writing to us at hello@cerrax.io; the video and photographs are then deleted under the 90-day rule in section 10.
Links a company chooses to share. A company can send its crew a link to a job sheet, and can give its insurer, broker or claims handler a link to a job's evidence — the customer's name, the photographs, video and signatures, never their email address or phone number. Evidence links expire after a period the company chooses, at most 90 days; they can be revoked at any time and record each time they are opened. Who receives a link is the company's decision.
Calendar feeds. If a company subscribes its own calendar (for example Google, Apple or Microsoft) to its Cerrax calendar link, that calendar provider fetches the company's booked jobs — including the customer's name, addresses and phone number unless the company chooses the private version — and holds that copy under the company's own agreement with it.
Messages about a job. As part of a job, a company can send its customer booking confirmations, move-day reminders, requests for a video or a payment, a note before a quote expires and, after the move, a request for a review — by WhatsApp where the company has connected it and the customer uses it, otherwise by email. The customer can instead answer the review request privately, with a rating from 1 to 5 and a comment that only the company sees. A company can also keep follow-up tasks about a customer, with notes.
When a customer accepts a quote, we record the time, the version of the company's terms and the cancellation statement shown, and any box the customer ticked. We do not record their IP address or device. We also count how many times the page for a quote is opened, and note when it was last opened, so the company can see whether its quote has been read.
A company's team. The logins of the people a company invites — their name, email address and sign-in details, including two-step sign-in if they turn it on (the secret that links their authenticator app, and one-time recovery codes kept in scrambled form) — are account data that we are responsible for. What a company records about its crew for its jobs — the mobile numbers used to send them job sheets, who is assigned to which job, and the times they mark arrival or completion — is the company's data, which we hold on its behalf. No location is ever captured.
Faces in photographs and video. Nothing in Cerrax recognizes a face or keeps any measurement of one. Where faces are blurred, software finds them only to blur them, and the unblurred original is then deleted.
Feedback and problem reports. If someone at a company reports a problem or sends us feedback from inside Cerrax, we keep it with their name and account so we can look into it and tell them when it is fixed. We may use Anthropic to sort feedback into categories.
Dictation. If you dictate into Cerrax, your browser's own speech-recognition service (Google in Chrome, Apple in Safari) turns your speech into text before it reaches us, under your browser's terms. We receive only the text; you can type instead.
Email delivery records and the audit trail. For each email sent through Cerrax we keep the recipient's address, the subject and whether it was delivered, to investigate delivery problems. We also keep a record of consequential actions in an account and who took them, to keep the service secure and accountable.
4. Cookies
We use only the cookies needed to make the site and service work (for example, keeping you signed in). We don't use advertising or cross-site tracking cookies.
We measure how many people visit these pages using Vercel Web Analytics, which is privacy-preserving by design: it sets no cookie, stores no identifier, and cannot follow you between sites or sessions. It tells us page counts, referring sites and countries — never who you are.
We also keep a few things in your browser so the service works — for example a draft you have not saved yet, or your language. These are strictly necessary and are never used for tracking.
5. Why we use it
- To provide the service — to perform our contract with you: pricing jobs, holding job records, billing and support.
- To improve the pricing engine — using anonymized data only (see section 7); and, to improve how Cerrax recognizes items, keeping a company's descriptions of a job's items and rooms for 30 days with email addresses, phone numbers and postal codes removed (see section 3).
- To keep the service secure and meet legal obligations — e.g. detecting misuse, rate limits, blocking attacks, checking that a visitor to the public price check is a person, accounting, and responding to lawful requests.
- To keep a customer's video or photographs to train software — only with the customer's express consent, which they can withdraw at any time (see section 3).
We use personal information only for these purposes, or for purposes consistent with them, and we rely on your consent — given when you sign up and use the service — for them. You may withdraw consent at any time, subject to legal or contractual restrictions; if you do, we may no longer be able to provide the service.
6. Automated pricing
Cerrax produces a price automatically from the inputs and settings provided. This is a tool for the moving company: the company decides what to charge its customer (see our Terms). Cerrax can price an inquiry as soon as it arrives, but that price is a proposal to the company: the company reviews it and chooses to send it, change it, or not to quote, and a customer is always free to decline a quote. AI in Cerrax only suggests details for a person to confirm; it never sets a price. No decision about a person is made exclusively by automated processing of their information, and Cerrax does not profile anyone. If you would like to know what information and which main factors produced a price, ask the moving company or us.
7. The learning corpus (important)
Cerrax gets more accurate as it sees real outcomes. When a job is completed, we make a separate record of it, on the company's instruction: the volume, a distance band, access features, crew, trucks, hours, the price and cost, the month of the move, and an area no finer than the first letter of a postal code. It never holds a name, contact detail, full postal code, address, map position, free text, photograph, video, signature, the company's identity, or any reference that links it back to the job. While we still hold the original job it is treated as personal information like the job itself; once the original is destroyed, the record is anonymized and we keep it indefinitely. Aggregated, anonymized insight may inform regional benchmarks; we never expose an individual company's prices or any customer's identity. We only treat data as anonymized once it is reasonably foreseeable that it irreversibly no longer allows anyone to be identified, directly or indirectly, and we anonymize according to generally accepted best practices and, for information about people in Quebec, the criteria the Quebec Act and its regulation set. We will not try to re-identify it, and we require anyone we share it with to make the same commitment.
8. Who we share it with
We don't sell personal information, and we don't share it for advertising. We use a small set of service providers (sub-processors) under written contract, currently including: hosting, database and file storage (Google Cloud and Firebase, London region) and account sign-in (Firebase) and geocoding (Google Maps, for distance between addresses). Where a company uses a feature that reads what it is given — the capture bar and narrative capture, photographs of a written list, spreadsheet import, and inquiry emails with no labelled layout (section 3) — those inputs are processed by an AI provider (Anthropic, United States), which does not train on them and deletes them within 30 days. Our website, the Cerrax app and the pages your customers open are run by Vercel, which also provides the cookieless visitor analytics described in section 4. Cloudflare Turnstile checks that a visitor to our public price check is a person, not a bot. Email is delivered — to you, and on your behalf to your customers — by Amazon Web Services (SES and SNS, London region), which also receives the inquiry emails sent to your Cerrax lead address. Payments are taken by Stripe — for your Cerrax subscription and, if you connect your own Stripe account to take deposits or balances, your customer's payment on your account. If you connect your own WhatsApp Business number, the messages you send your customers through it are delivered by Meta (WhatsApp Business). If you connect your own Xero account, the invoice details of the jobs you send to it — your customer's name and address and the amounts — are written into it as draft invoices by Xero. If you connect your own QuickBooks company instead, your customer's name and the amounts are written into it as invoices by Intuit (QuickBooks). We keep this sub-processor list current and reflect only services actually in use, and email account owners at least 30 days before a new provider starts handling their customers' information. We may also disclose information where the law requires it, or to a successor if our business is transferred.
Anthropic is also used to suggest adjustments from the notes on a quote, to write a move-preparation checklist for a customer from the job's postal codes, date and notes, and to sort feedback sent to us. It does not train on this data and deletes it within 30 days.
9. Where your information is stored
Your information is held in the United Kingdom, in London, so for a company in Canada it is stored and processed outside Canada (and, for a company in Quebec, outside Quebec). Some of our service providers process it in the United States — AI processing by Anthropic is the case today. While it is outside Canada, it is subject to the laws of the country where it is held and may be accessed by the courts, law enforcement and national security authorities there.
Before sending information abroad we weigh how sensitive it is, why it is being sent, how it is protected and the law of the place it goes to. In our assessment: the information is of ordinary sensitivity (names, addresses and details of a move — we ask for nothing sensitive); it is sent only to provide the service; it is protected by encryption, access controls and written contracts with each provider that bind them to protection comparable to ours; and in the United Kingdom it is governed by the UK GDPR and the Data Protection Act 2018, overseen by the Information Commissioner's Office — a regime the European Union has recognized as adequate. If you are a company in Quebec and need this assessment for your own records, ask us and we will provide it in writing.
As things stand today: the data behind every Cerrax account is held in London. That is a statement of fact on the date at the top of this page rather than a promise about the future — if you need it in writing for a particular account, or want to know where a specific service processes data, ask us at hello@cerrax.io and we will tell you.
10. How long we keep it
Your account information (where we are responsible for it ourselves): for as long as your account is active and for up to six years after it closes, to meet our legal, accounting, and tax obligations — unless the law requires us to keep it longer.
Your customers' information (where we are your service provider): for as long as you keep it with us, and deleted or returned when you ask, as the Data Processing Agreement sets out. Unless you tell us otherwise, job records — a quote, its booking and outcome, the crew's sheets, and any survey or damage photographs attached to them — are kept for six years after the move (or after the quote, if the job did not go ahead), unless a claim or dispute about that job is still open, and then deleted. Photographs have no separate clock: they are kept for as long as the job record they belong to and are deleted with it. A customer's video is deleted 90 days after the job's last date unless the customer has agreed to Cerrax keeping it to train software (section 3) and has not withdrawn that consent.
Unless a company sets different periods: an inquiry that was never priced or sent is deleted 12 months after its last activity; a quote that was sent but never accepted, 24 months after it was sent; a contact record is kept while any job record linked to it is kept, and deleted 12 months after the last one goes (or 12 months after it was made, if it was never linked to a job). A record of a person's consent is kept for as long as their contact record and six years after, so the company can show it; a scrambled record of an unsubscribe is kept indefinitely, so it keeps being honoured.
Our own records: waitlist, demo and contact inquiries, 24 months after our last contact with you (or sooner if you ask); sign-in and security logs, 90 days. When a purpose is achieved, we destroy the information or anonymize it (section 7). You can ask us to delete personal information (section 12); committed pricing records are never silently altered, but personal identifiers within them are removed.
Also: email delivery records, 90 days; security logs, 90 days (a block on an address is kept while it lasts, then 90 days); the audit trail, up to six years after the account closes, with a customer's details removed when that customer is erased; feedback and problem reports, while the account is open and up to six years after it closes; two-step sign-in details, until they are switched off or the login is removed.
11. Marketing and communications
We'll send you service messages needed to run your account. We send marketing emails only where Canada's anti-spam legislation (CASL) allows — with your consent, express or implied (for example, because you asked us about Cerrax or have an account with us). Every marketing email says who it is from, carries our postal address and email contact, and has an unsubscribe link; we act on an unsubscribe within 10 business days, and usually at once. We do not send marketing text messages or make marketing calls.
12. Your rights
You have the right to: know whether we hold personal information about you, how we use it and to whom it has been communicated, and get access to it; have it corrected if it is inaccurate, incomplete or out of date; withdraw your consent (section 5); and, in Quebec, have computerized information you provided given to you or to someone you name in a structured, commonly used technological format, and ask that information about you stop being disseminated or be de-indexed where the Quebec Act allows. You can also ask us to delete it.
To make a request, email hello@cerrax.io. We answer in writing within 30 days, free of charge (we may extend that where the law allows, and will tell you why). We verify a request by matching it to the account or information we hold. If we refuse a request, we will tell you why and how to complain (section 14). For your customers' information, where we are a service provider, requests should go to the moving company; we help them answer.
13. Children
Cerrax is a tool for businesses and is not directed at children. We don't knowingly collect personal information from children, and in Quebec we will not collect information about a child under 14 from the child without a parent's or guardian's consent.
14. Complaints
If you're unhappy with how we handle your information, tell us at hello@cerrax.io — we will acknowledge your complaint within 30 days and work to resolve it. You can also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, if you are in Quebec, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca). In Alberta and British Columbia, the provincial Information and Privacy Commissioner may also be able to help.
15. Security
We protect information with access controls, encryption in transit and at rest via our cloud provider, and audited administrative actions. No system is perfectly secure, but we take safeguards appropriate to the sensitivity of the information.
If a breach of security safeguards or a confidentiality incident occurs, we act promptly: where we hold the information for ourselves and it creates a real risk of significant harm (or, in Quebec, a risk of serious injury), we report it to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information and notify the people affected; we keep a record of every breach or incident, whatever its risk; where we are a service provider we notify the affected moving company without delay, and within 48 hours, so it can meet its own obligations.
16. Changes
We may update this policy, and review it at least once a year; we'll post the new version here with a revised effective date and tell account holders about a material change by email.
17. Contact
Cerrax Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Person in charge of the protection of personal information: our director, hello@cerrax.io.