HarbourClose Privacy Policy

Effective date: Not yet effective — development and counsel-review draft
Draft last updated: August 31, 2026
Draft version: HC-PP-DRAFT-1.1-en-CA
Organization: [####### Canada Inc.], operating as HarbourClose
Privacy Officer: [name or role ●] · privacy@harbourclose.[●] · [mailing address ●] · [phone ●]

This Privacy Policy explains how HarbourClose collects, uses, discloses, retains, and protects personal information when you use our website, platform, and services (the "Services"), and the choices and rights you have. It forms part of the Terms of Service. We handle personal information in accordance with applicable Canadian privacy law. Depending on the activity and jurisdiction, this includes the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta's and British Columbia's Personal Information Protection Acts, and Quebec's Act respecting the protection of personal information in the private sector.

Plain-language summary (not a substitute for the policy below): We collect what a boat transaction file needs — who you are, your contact details, the vessel and deal facts, the documents you sign, and (where the service includes it) a copy of your government ID. Your ID is never shown to the other party. We use your information to run your file, keep records, and prevent fraud — not to sell it, and not to advertise to you without separate consent. Some of our service providers may process data outside Canada. You can ask what we have about you, ask us to correct it, and complain to us or the federal or provincial privacy regulator that has jurisdiction.

1. Accountability

HarbourClose is responsible for personal information under its control, including personal information transferred to service providers for processing. Our designated Privacy Officer (contact above) is accountable for compliance with this policy, answers privacy questions, handles access and correction requests, and receives complaints.

2. What We Collect

We collect only what the Service you use requires. Depending on the Services you use, this may include:

• Account information: name, email address, phone number, password or authentication credentials, Terms acceptance records (version, date, time, presented-document reference).
• Party and transaction information: your role (buyer, seller, co-owner), mailing address, business details where you transact as a business (legal name, signing person's name and title), deal terms (price, deposit arrangement, conditions, closing date), and the contact details you provide for people you invite to a file.
• Vessel and property information: vessel year, make, model, hull identification number, engine serials, trailer VIN, licence or registry numbers, and ownership documents you upload.
• Identity documents: where the selected Service permits or requires it, an image of your government-issued photo ID and the details on it, or identity details you enter manually. See Section 6 — ID images receive special handling.
• Documents and signatures: documents generated in your file, e-signature records and completion certificates, and supporting documents you upload (for example, a survey report you choose to upload).
• Payment information for our service fees: processed by our payment provider; we receive transaction confirmations and partial card details (such as brand and last four digits) but do not receive or store your full card number. If a HarbourClose funds service is launched in the future, banking details for payouts will be collected under the separate funds disclosures referenced in the Terms.
• Communications: messages sent within a file, support requests, and our correspondence with you.
• Technical and usage information: IP address, device and browser type, log records, pages viewed, and actions taken in the platform (which also feed the file's audit trail).
• AI and document-processing information: source documents or selected excerpts submitted to an approved extraction, classification, comparison, transcription, or summarization provider; draft outputs; corrections; confirmation status; and process or model metadata needed for audit and quality control. We do not authorize providers to train a general-purpose model on HarbourClose transaction content unless that separate purpose and legal authority have first been disclosed and approved.

We collect personal information directly from you, from the other parties to your file (for example, when a seller enters a buyer's email to invite them), from documents you or the other party upload, and — where a purchased Service includes a search — from public registries.

Invitations: if you provide another person's email address or phone number to invite them to a file, we use it only to deliver the invitation and related file notifications. You must have a reasonable basis to provide it.

3. Why We Use It (Purposes)

We use personal information to:

• create and administer your account and transaction files, generate documents, coordinate signatures, track conditions and deadlines, and deliver the Services you order;
• share file information between the parties to the same transaction as the file is designed to share it (Section 5);
• perform purchased factual searches using the identifiers you confirm;
• maintain the file's audit trail and transaction records for recordkeeping, dispute protection, and legal compliance;
• detect, investigate, and prevent fraud, unauthorized access, and misuse, including retaining ID records for dispute and fraud protection;
• process payments for our service fees, issue invoices and receipts, and collect applicable taxes;
• send service, security, and transaction communications (invitations, reminders, status updates, receipts);
• respond to support requests and complaints;
• meet legal, tax, audit, and regulatory obligations; and
• improve the Services using de-identified or aggregated information that does not identify you.

Where software classifies a document, extracts a field, compares records, or prepares a summary, the result is a draft until the appropriate person reviews it. HarbourClose does not use an AI or OCR result by itself to decide a Party's legal rights, ownership, identity, eligibility, credit, transaction outcome, or access to a significant service. If a future feature makes a decision based exclusively on automated processing, we will give the advance or contemporaneous notice, explanation, correction route, and human-review opportunity required by applicable law before activating it.

Marketing is separate. We send promotional messages only with consent obtained and managed as required by Canada's Anti-Spam Legislation, with working unsubscribe mechanics. Declining marketing does not affect your Services.

No selling; no advertising use. We do not sell or rent personal information, and we do not use the contents of your transaction files for advertising.

Automated processing. Document generation and reminders are automated based on the facts and selections parties confirm. We do not use your personal information for automated decisions that produce legal or similarly significant effects about you without human involvement.

4. Consent

We collect, use, and disclose personal information with your knowledge and consent, except where law permits or requires otherwise (for example, fraud investigation, legal proceedings, or a lawful demand). Consent may be express (creating an account, placing an order, or uploading an ID after receiving the applicable notice) or implied from a voluntary action with an obvious purpose (entering your address so it appears on your bill of sale). Accepting the Terms acknowledges this Policy but is not treated as consent to an optional use, optional marketing, biometric technique, or materially different purpose that requires separate consent.

You may withdraw consent at any time, subject to legal and contractual limits, by contacting the Privacy Officer. Withdrawing consent may mean we cannot continue to provide a Service — for example, a closing file cannot proceed without the parties' names — and does not require us to delete records we are legally entitled or required to keep (Section 7).

Because transaction files are shared workspaces, information you enter into a file that the file is designed to show the other party (deal terms, vessel details, signed documents, your name) cannot be withdrawn from the other party's completed records.

5. Who Sees Your Information (Disclosure)

• The other party to your transaction. A file shares between its parties only what it is designed to share: deal terms, vessel details, document statuses, signed documents, and limited status indicators. Your ID image and its contents are never shown to the other party — they see only a status such as "ID not yet provided" or "ID on file." A survey report a buyer uploads is visible to the buyer and HarbourClose staff only, unless the buyer shares it.
• HarbourClose staff access files only as needed to provide the purchased Service, run queues (searches, document generation, support), and maintain security. Staff actions are logged in the audit trail.
• Service providers who process data on our behalf under contractual protections (Section 8): hosting and database, e-signature, payment processing, email delivery, SMS delivery, and similar operational providers. They may use your information only to provide their service to us.
• AI, OCR, and document-processing providers only when the applicable feature is enabled and only for the specific classification, extraction, comparison, transcription, or summarization task disclosed to you. The production provider, processing locations, retention, model-training setting, and subprocessors must be verified before customer documents are sent to it.
• Public registries, to the limited extent a purchased search requires submitting search criteria (for example, a name or serial number submitted to a provincial personal property registry).
• Professional advisors (lawyers, accountants, auditors, insurers) under confidentiality obligations, where reasonably required.
• Legal and safety disclosures: where required or permitted by law — including to comply with a subpoena, warrant, court order, or other lawful demand; to detect, investigate, or prevent fraud or other unlawful activity; or to protect the safety of any person. ID records are released only to the account holder they belong to, to police, or under court order.
• Business transactions: if HarbourClose is involved in a financing, reorganization, merger, or sale of the business, personal information may be disclosed to the parties involved under confidentiality protections, and any successor remains bound by this policy or one materially equivalent.

6. Identity Documents — Special Handling

• ID images are stored in restricted, access-controlled storage separate from general file documents, with time-limited access links, and are accessible only to authorized HarbourClose staff for the purposes below.
• Purposes: confirming file participants are who they claim to be (to the extent the selected Service includes it), deterring fraud, and preserving an identity trail if a transaction is later disputed or investigated. We will not collect an ID image where a less intrusive method reasonably meets the identified purpose.
• The other party never sees your ID image or its data — only the status badge.
• "ID on file" means an image was captured and stored. It is not a statement that HarbourClose verified the document or your identity unless the selected Service expressly includes verification, in which case the verification provider and method will be identified.
• Facial comparison, liveness detection, or another biometric technique will not be used unless the feature is separately identified, its necessity and privacy impact are assessed, all required regulator notices are completed, and the person gives separate express consent. Declining an optional biometric technique will not be treated as acceptance through these Terms.
• Retention: the intended default is to permanently delete the image, normalized derivatives, OCR output, and extracted full identifier 30 days after the file closes, expires, or is cancelled, leaving only a minimal verification and deletion record. A documented legal or administrative hold may pause deletion only for the records and period the hold requires. The final retention schedule remains subject to counsel approval before launch.

7. Retention

We keep personal information only as long as needed for the purposes above and for legal, tax, audit, and dispute-protection requirements, then delete or de-identify it. Intended default periods, subject to the final pre-launch retention schedule:

• ID images, derivatives, OCR output, and extracted full identifiers: delete 30 days after file close, expiry, or cancellation, unless a documented legal or administrative hold is active (Section 6).
• Transaction documents and file records (signed documents, closing records, audit trail, invoices): 7 years after file close, consistent with legal and tax record-keeping norms.
• Account information: while your account is active and for a reasonable period after closure to meet the requirements above.
• Unpaid draft files: deleted or de-identified after a reasonable inactivity period, to be defined in the final schedule.

A signed document is part of the other party's records too; closing your account does not delete completed transaction records from a file the law or the other party's rights require us to keep.

8. Service Providers and Data Location

We use third-party providers to operate the Services. Providers act under agreements limiting their use of personal information to providing their service to us. The production provider list, their roles, and their processing locations will be completed and verified before launch:

Processing outside Canada. Our intention is to store transaction data with providers in Canada. However, some providers — for example, payment, e-signature, email, and SMS providers — may process or store personal information outside Canada, including in the United States. While in another jurisdiction, information is subject to that jurisdiction's laws and may be accessible to its courts, law enforcement, and national-security authorities under lawful access regimes. We use contractual and technical safeguards with all providers regardless of location. Questions about our providers and their locations can be directed to the Privacy Officer. We do not state that all data remains in Canada unless that has been verified across the full production chain, including backups, logging, support tooling, and subprocessors.

9. Safeguards

Before this Policy is published, we will verify and accurately describe the production safeguards appropriate to the sensitivity of the information. The required control set includes encryption in transit and at rest; database-level access rules so Parties can access only their own Files and permitted information; private storage with signed, short-lived access links; separated, restricted storage for ID images; role-based staff access on a need-to-know basis; logging of access and administrative actions in a tamper-resistant audit trail; and configured, tested backups. No system is perfectly secure. The full security program—including incident response, access administration, staff procedures, backup restoration, and control testing—must be operational before real customer data is taken.

10. Breach Response

If a confidentiality incident or breach of security safeguards triggers a reporting or notification threshold under applicable law, we will report it to the privacy regulator that has jurisdiction and notify affected individuals as required. We maintain the breach and confidentiality-incident records required by applicable federal and provincial law. Where a service provider holding our data has an incident, our contracts require it to notify us promptly and provide the information needed for our assessment and response.

11. Your Rights

Subject to limited legal exceptions, you may:

• Access: request a copy of the personal information we hold about you, an account of how it has been used, and the names or types of third parties it has been disclosed to. Most of your file information is directly visible in your account.
• Correction: ask us to correct inaccurate or incomplete information. Facts recorded in a signed document or the audit trail cannot be silently rewritten — corrections there are handled by amendment or annotation so the record stays truthful.
• Withdraw consent: as described in Section 4.
• Complain: raise a concern with our Privacy Officer, who will investigate and respond. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada or the provincial privacy regulator that has jurisdiction.

We respond to access requests within the time applicable law allows (generally 30 days under PIPEDA, subject to lawful extensions), free of charge or at only a permitted minimal cost, and we will tell you in writing if an exception prevents disclosure and what recourse you have. We may need to verify your identity before acting on a request — including, for ID records, verifying that you are the person the ID belongs to.

12. Cookies and Website Data

The website uses cookies and similar technologies that are necessary for sign-in, security, and session integrity. Any analytics are configured to respect visitor privacy [● describe final analytics setup: provider, whether IP is truncated/anonymized, opt-out]. We do not use third-party advertising cookies or cross-site tracking. Your browser can block or delete cookies; necessary cookies are required for the platform to function.

13. Children

The Services are for adults entering real transactions. They are not directed to anyone under 18, and we do not knowingly collect personal information from minors. If you believe a minor has provided personal information, contact the Privacy Officer and we will delete it.

14. Quebec and Other Jurisdictions

HarbourClose intends to serve customers across its supported Canadian service area, including Quebec once the required operational controls are complete. Nunavut is permanently outside the service area. For Quebec, the required controls include at least: publishing the Privacy Officer's title and contact information; maintaining governance policies and a confidentiality-incident register; completing a privacy impact assessment for systems involving personal information and before communicating personal information outside Quebec; entering the required written provider agreements; using privacy-protective default settings; supporting access, correction, de-indexing and portability rights where applicable; and providing the required French notices and policy.

Before any facial comparison, liveness detection, or other biometric identity technique is used for a Quebec resident, HarbourClose will complete the required notice to the Commission d'accès à l'information, any required advance declaration of a biometric database, and separate express-consent process.

Nothing in this Policy limits rights you have under the privacy law of your province or territory. Because a Canada-wide File may move personal information between provinces or countries, more than one privacy law may apply to the same processing activity.

15. Changes to This Policy

We may update this policy. Each version is dated and numbered, the current version is always available on the website, and material changes will be announced by email or in-platform notice before they take effect. Where a change involves a new purpose for information we already hold, we will seek any consent the law requires.

16. Contact

Privacy Officer
[name or role ●]
[####### Canada Inc.] o/a HarbourClose
[mailing address ●]
privacy@harbourclose.[●] · [phone ●]

Office of the Privacy Commissioner of Canada: priv.gc.ca · 1-800-282-1376

HarbourClose is a documentation and transaction coordination company. This policy describes information practices; it is not legal advice.