Privacy

Who we are

HubGov is a private Canadian company that provides public-procurement intelligence to businesses. We are not a government body and we are not affiliated with SEAO, CanadaBuys or any public authority. This policy explains how we handle personal information.

Person in charge of the protection of personal information

The person in charge of the protection of personal information at HubGov can be reached through the contact form at hubgov.ca/contact. Please mark your message as a privacy request (access, correction, deletion, portability or another right). Logged-in users can also send a deletion request from Settings → Account.

Personal information we collect

Account: first name, last name, work email, password (stored as a one-way hash), organization name, province and optional city or website. We also store email-verification and password-reset tokens, and whether you accepted this policy.

Workspace: company profile, capabilities, locations, certifications, government-market preferences, saved opportunities, pipeline notes and documents you upload, Academy progress and certificates, team invitations, and audit events.

Contact form: name, email, optional company name, message and language. Sessions: a secure cookie, IP address and browser user-agent, used to keep you signed in and to detect abuse.

Public procurement records (tenders, contracts, buyers) come from official Canadian open-data sources. They are not collected from you. With your consent, we use Google Ads conversion measurement to know which ads lead to a sign-up (see Cookies).

Purposes

We use this information to create and secure your account, operate the workspace, match public notices to your company profile, send transactional messages (verification, password reset, invitations when a provider is configured), answer contact requests, improve reliability and prevent fraud, and meet legal obligations.

We do not sell personal information. We do not use it for unrelated marketing without a further, specific consent.

Automated processing and matching

HubGov ranks public opportunities with a deterministic, explainable score computed from your company profile, and its assistant answers questions using fixed rules over public data. There is no profiling of natural persons, no automated decision that affects your rights, and no machine learning trained on your personal information. Every score can be inspected in the product (“Why this matches”), and you can ask us to explain any result through the contact form.

Consent

Creating an account or submitting the contact form requires your express consent, given by a required checkbox. You may withdraw consent or ask us to stop using information that is not necessary to provide the service. Some processing (security, legal retention, public records already published by governments) does not rely on consent.

Who can access the information

Within HubGov, access is limited to members of your organization according to their role, and to HubGov operators who need it to run or secure the service. Workspaces are isolated from one another.

Hosting, suppliers and transfers outside Québec

Application servers and the PostgreSQL database are hosted by DigitalOcean in Toronto, Ontario (Canada). Personal information is therefore stored in Canada.

Cloudflare, a service with infrastructure outside Québec, provides CDN, TLS and bot protection for hubgov.ca. It may process IP addresses and set a short-lived security cookie (__cf_bm) that is necessary to deliver the site safely.

HubGov's AI features — smart search, the Discover chat, HubGov AI answers, bid guides, win strategies, Signals research and Academy course generation — use Claude by Anthropic (Anthropic PBC, United States). We send only what the feature needs: your search or question, the public tender data being analyzed and, for a win strategy or an account you ask us to research, your company profile or the company name you entered. Never your password or payment details. Anthropic may receive those prompts and the generated text. Bid guides, win strategies and Signals research also look up public web pages through Claude's web search. Do not put unnecessary personal information in a search, a question or an Academy theme.

Transactional email, when a provider is configured, is sent to the address you give us. Until a provider is configured, messages are not delivered and exist only as an account action in our systems.

Cookies and similar technologies

Technologies that may identify or remember you are the ones needed to run the service, plus Google Ads measurement only if you accept it:

hubgov_session — essential, HTTP-only, SameSite=Lax, about 30 days — keeps you signed in. hubgov_locale — functional, about 12 months — remembers English or French. sidebar_state — functional, 7 days, app only — remembers whether the workspace sidebar is open. Cloudflare __cf_bm — essential security, set by the CDN. localStorage keys hubgov.locale (language), hubgov.cookie_notice (first-visit acknowledgment) and hubgov.consent (your advertising-measurement choice). Only if you accept: Google Ads _gcl_au and related cookies, about 90 days, conversion measurement.

On your first visit we show a notice so these technologies are disclosed at the time they are used, as required by section 8.1 of Québec’s private-sector privacy act. The notice offers two equal choices. If you accept, Google Ads sets measurement cookies (such as _gcl_au) to attribute sign-ups to ad clicks; no remarketing or ad personalisation is enabled. If you decline, no advertising cookie is set and Google only receives anonymous, cookieless signals (Consent Mode). You can reopen the notice and change your choice from the footer.

These cookies are not used to locate you on a map or to build an advertising profile. Session IP and user-agent are stored to protect accounts. You can block non-essential cookies in your browser; the language preference may then reset.

Retention

Account and workspace data are kept while the account is active and for up to 24 months after closure or a completed deletion request, unless a longer period is required by law (for example security logs). Contact messages are kept up to 24 months. Sessions expire after 30 days of validity. Password-reset tokens expire in 1 hour; email-verification tokens in 24 hours. Privacy requests are kept long enough to show that we answered them.

Security

We use TLS in transit, hashed passwords, HTTP-only session cookies, tenant isolation in the database, rate limiting on sensitive actions, and provider-managed encryption at rest for the Toronto database. No measure is perfect. If a confidentiality incident presents a risk of serious injury, we will notify the Commission d'accès à l'information and affected persons as required by Québec law.

Your rights

Subject to the Act respecting the protection of personal information in the private sector (Québec) and PIPEDA, you may request: access to your personal information; correction of inaccurate information; deletion when the purposes are completed or consent is withdrawn; a computerized copy of information you have provided (portability); and, where applicable, that we stop disseminating information or de-index a hyperlink. Public government records republished from official sources are not deleted from those sources by HubGov.

How to exercise your rights

Write to us via hubgov.ca/contact or, if you have an account, use Settings → Account to download your data or request deletion. We aim to respond within 30 days. We may need to verify your identity. You can complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Minors

HubGov is intended for businesses and professionals. We do not knowingly collect personal information from children under 14. If you believe we have, contact us and we will delete it.

Changes

We may update this policy. The date at the top is the latest version. If a change is material, we will notice it on this page or in the product.