Privacy Policy

1. Who we are and how to reach our Privacy Officer

Starise Lighting Inc. is a permanent LED lighting installation company based in Calgary, Alberta, Canada. We serve homeowners and businesses in Alberta and in British Columbia's Okanagan region, and we run a dealer program for lighting installers in other regions.

We have designated a Privacy Officer who is responsible for our compliance with privacy law and who is the person to contact with any question, request or complaint about your personal information:

2. The laws that apply

Starise is an Alberta company, and our handling of personal information in Alberta is governed by Alberta's Personal Information Protection Act (PIPA). Where we collect, use or disclose personal information in British Columbia — for example when we quote or install for customers in the Okanagan — British Columbia's Personal Information Protection Act (BC PIPA) applies to that activity. Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) applies where personal information crosses provincial or national borders in the course of our commercial activities, including when it is processed by the service providers described in Sections 10 and 11. Our electronic marketing is governed by Canada's Anti-Spam Legislation (CASL), and our telephone contact by the CRTC's Unsolicited Telecommunications Rules.

These laws overlap but are not identical; where they differ, we apply the one that governs the specific activity. If we begin operating in another province or country, we will update this policy before doing so.

3. What personal information we collect

We collect only what we need for the purposes in Section 5. The categories below describe the information we hold, depending on how you deal with us.

If you request a quote or contact us

• Your name, phone number and email address
• The address of the property to be lit, the property type and city
• Your project preferences (coverage area, timeline), how you heard about us, the name of anyone who referred you, and any notes you add
• Which form or page you used, and your consent choices (the Privacy Policy acknowledgement and, if you tick it, the optional marketing opt-in with its wording version)
• Technical details our form service records with each submission: your IP address, browser type and the page you came from

Saved quote drafts. Our quote forms save your progress to our systems as you type, before you press submit, but only once you have entered a name and a valid email address. Everything you have typed so far (for example your phone number, address and notes) is saved with the draft so that we can send you a link to finish if you get interrupted; your Privacy Policy acknowledgement and any marketing opt-in are recorded only when you actually submit, never from a draft. If a draft is left unfinished for about 25 minutes, we send one email with a secure link that restores your saved answers, and no second one. If you never finish, the draft is treated as an unconverted lead (Section 13) and is not used for anything else.

If you become a customer

• Quote and contract details: products, quoted footage and final installed footage, pricing, discounts, taxes, and your acceptance of the quote and Terms of Service, including the name you type and the signature you draw on screen, and the date and time you accepted
• Invoice and payment records: amounts, deposits, balances, payment status and dates, payment method category (for example "card via Stripe", "e-transfer", "cash"), refund and dispute status, and the reference numbers our payment processor assigns (Section 8)
• Scheduling and installation records: installation dates and time slots, the crew assigned, installer job notes and progress updates, the completion checklist, and photos of the property taken to plan and document the installation
• Warranty and service records: reported issues, service visits, parts and resolutions
• Support and communication history: emails, text messages and notes of phone calls relating to your project, including automated messages such as install reminders and "on our way" texts
• Lighting system details needed to support you, such as the controller installed at your property and the app you use to control it
• Review requests we send after your project is complete, and reviews you choose to post publicly
• Which sales representative and installers handled your project
• The map coordinates of your installation address, which we derive from the address so our team can plan routes and view work areas

If you subscribe to our newsletter

• Your email address, the date and time you subscribed, the page you subscribed from, and the wording you agreed to

If you visit our website

• Standard web server and security logs: IP address, browser and device information, pages requested, and timestamps
• Your cookie choice, stored in your browser
• Only if you choose "Accept All" in our cookie banner: the analytics and advertising data described in Section 7
• If you use the address field on a quote form, the characters you type are sent to Google to suggest addresses (Section 10)

If you apply for a job, apply to become a dealer, or work with us

• Job applicants: name, contact details, the position you are applying for, experience, availability, your resume and anything else you tell us
• Dealer applicants and dealers: name, business name, contact details, location, experience, and dealer account and order records
• Sales representatives, installers and staff: account details, contracts, commissions and payouts, schedules, and documents you upload to your portal. Team members receive a separate internal notice describing how their information is handled.

We do not ask for, and ask you not to send us, sensitive information such as government ID numbers, health information or financial account details. Card details are entered directly with our payment processor and never reach our systems (Section 8).

4. Where we get personal information

Most of the personal information we hold comes directly from you. We may also receive it from:

• an authorized contact acting for you, such as a spouse, property manager, landlord or business colleague who requests a quote or coordinates an installation
• our sales representatives, who record what you tell them at your door, at an event or by phone
• our installers and project staff, who record installation notes, footage and photos
• our payment processor, which tells us whether a payment succeeded, was refunded or was disputed
• our financing partner, which may confirm whether financing for your project was approved and funded (Section 9)
• people who refer you to us, who may give us your name and contact details so we can follow up
• public reviews you post about us on Google or social media
• Google, when you pick an address suggestion on a quote form or when our team looks up the map position of an installation address

5. Why we use personal information, and consent

We collect, use and disclose personal information for the following purposes. Where the law requires consent, we rely on the consent you give when you provide information for an obvious purpose (for example, submitting a quote request so we can quote), on express consent you give separately (for example, ticking the marketing opt-in), or, in limited cases, on a purpose that the law permits without consent (for example, collecting a debt or complying with a legal requirement).

We do not sell personal information, and we do not give other businesses your contact details so they can market to you. One thing to be clear about: if you choose Accept All in our cookie banner, Google, Microsoft and Meta receive browsing data from our site through the optional tools in Section 7 and use it under their own policies, which for Google and Meta include building advertising audiences.

Withdrawing consent. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting the Privacy Officer. We will explain any consequences — for example, we cannot install or warranty a system without your address and contact details.

6. How we communicate with you: service messages versus marketing

Service and transactional communications

When you request a quote, contact us, or engage our services, we will contact you by phone, email and text message about that request or project. These messages are part of the service you asked for and are not marketing. They include:

• following up on your quote request
• scheduling and confirming your installation, a reminder the day before, and an automated text when our crew is on the way
• contracts, invoices, deposit and payment receipts, and payment reminders
• warranty, service and support matters
• a request for a review after your installation is complete
• information you have specifically asked for

If you start a quote and leave it unfinished, we may send one email with a link to finish it (see "Saved quote drafts" in Section 3).

You can ask us to use a different channel at any time. Replying STOP to a text from us stops all further texts from that number, including service texts; if you do this, we will reach you by email or phone instead.

Marketing communications

Promotional messages — seasonal offers, sales promotions, newsletters, new-product announcements and similar — are sent only:

• if you have given express consent, for example by ticking the optional "Yes, I'd also like to receive occasional Starise promotions" box on a quote form (it is never pre-ticked, and leaving it unticked never affects your quote) or by subscribing to our newsletter; or
• where CASL allows implied consent, such as for a limited time after you have purchased from us. Even then you may unsubscribe at any time.

Every marketing email identifies Starise Lighting Inc., gives our contact details and includes a working unsubscribe link, and we honour unsubscribe requests within 10 business days (usually the same day). We keep a record of when and how you gave or withdrew marketing consent, including the wording you saw. Unsubscribing from marketing does not stop service messages about an active quote, project or warranty. We do not currently send promotional text messages; if we ever do, we will ask for your express consent first and every message will support STOP.

Newsletter

The "Stay in the loop" form in our website footer is a promotional subscription: lighting tips, seasonal ideas and Starise offers by email. Subscribing sends you one confirmation email with an unsubscribe link. Requesting a quote does not subscribe you to the newsletter.

Telephone calls

We call people who have asked for a quote or are customers. We do not make cold calls to people who have not contacted us. If you ask us not to call, we add you to our internal do-not-call list.

7. Cookies, analytics and advertising tools

Our website uses a small number of cookies and similar technologies. They fall into three groups.

How consent works. None of the four optional tools (Google Analytics, Google Ads, Microsoft Clarity, Meta Pixel) loads, and none of their cookies are set, until you choose Accept All in our cookie banner. Necessary Only keeps all four off. Accept All turns all four on together; there is currently no per-tool choice. Your choice, the time you made it and the version of the cookie notice you saw are stored in your browser only (we keep no copy on our servers) and apply to every page and every later visit from that browser until you change it or clear your site data. A choice made under an earlier version of the notice is asked again. There is no pre-set consent, and until you choose, nothing optional runs.

Changing or withdrawing your choice. Use the Cookie Settings link in the footer of every page (or here) to switch at any time. Choosing Necessary Only stops the optional tools, deletes the analytics and advertising cookies set on our site (such as _ga, _gcl_au, _fbp and _clck) and reloads the page. Cookies that Google, Microsoft or Meta set on their own domains are outside our control; you can delete those in your browser settings. You can also opt out of personalized advertising directly with Google and Meta. Our site does not currently respond to browser "Do Not Track" or Global Privacy Control signals; the cookie banner is the control we honour.

8. Payments

Card payments for deposits and balances are processed by Stripe. When you choose to pay by card, you are taken to a checkout page hosted by Stripe, where you enter your card details directly with Stripe. Starise does not receive or store full payment-card numbers, expiry dates or security codes; card processing is handled by Stripe. Stripe receives your name, email address, the amount and a reference to your quote or invoice, and handles your card information under its own privacy practices (Stripe Privacy Policy).

What Starise keeps: the invoice, the amount paid, the date, the payment status, the payment method category, the reference numbers Stripe assigns to the checkout session and payment, and any refund or dispute status. Payments you make by e-transfer, cheque or cash are recorded by our team with the same level of detail. Payment records are kept as accounting records (Section 13).

9. Financing

We offer financing through humm Canada (Humm Group Limited). Financing is optional and is a separate agreement between you and humm.

• You apply directly with humm, either through the humm application widget on our Financing page or on humm's own website. The application form is provided and processed by humm; the personal and financial information you enter goes to humm, not to Starise.
• humm makes all lending decisions. Starise does not receive your credit report, credit score, income details or the contents of your application.
• To complete a financed project, humm may confirm to us whether your financing was approved and the amount funded, and we may give humm the details of your purchase (such as the invoice amount) so that it can pay us. We record the financing outcome on your project file.
• humm's handling of your information, including its use of service providers outside Canada, is described in humm's Privacy Policy.

10. Service providers we use

We use carefully chosen companies to host our systems and provide services on our behalf. They may only use personal information to provide the service to us and are bound by contracts that require them to protect it. The table lists the providers currently in use, by category.

If we add or replace a provider that handles personal information, we will update this table.

11. Service providers outside Canada

Most of the providers in Section 10 store and process personal information in the United States (including Netlify, Supabase, Stripe, Resend, Twilio and Anthropic; the retired team app's database is the exception and sits in Montréal), and Google, Microsoft and Meta may process it in the United States or other countries where they operate. Our financing partner humm and its own service providers may process your financing application in Australia, the Philippines, New Zealand, the United Kingdom and Ireland, as described in humm's policy. Our CRM database is hosted in the United States.

This means your personal information may be stored or accessed outside Canada, and while it is in another country it may be accessible to the courts, law enforcement and national security authorities of that country under its laws. We use these providers for the purposes described in Section 10 only, under contracts that require appropriate safeguards. You can ask our Privacy Officer (Section 1) about our policies and practices for using service providers outside Canada, including which providers and countries are involved for your information.

12. Other disclosures

Apart from the service providers above, we disclose personal information only:

• to people working on your project — our sales representatives, installers and operations staff see the information they need for their role, and no more;
• where the law requires or permits it — for example in response to a court order, a lawful request from a government or regulatory body, or to report a privacy breach;
• to protect rights and safety — to collect a debt, enforce our Terms of Service, or investigate and prevent fraud, misuse or harm;
• in a business transaction — if Starise or substantially all of its assets are sold, merged or reorganized, personal information may be transferred to the successor, who must use it consistently with this policy, and we will notify you where the law requires.

13. How long we keep personal information

We keep personal information only as long as it is reasonably needed for the purposes it was collected for, to meet legal, accounting, warranty and dispute-resolution obligations, and to keep the evidence of consent the law requires. The periods below are our current retention schedule. They are targets we review at least once a year; deletion is carried out through periodic reviews rather than automatically at the moment a period ends, and information may be kept longer where a specific legal hold, claim or dispute requires it.

When information is no longer needed we delete it or de-identify it so it can no longer reasonably be linked to you. Backups are overwritten on a rolling schedule.

14. Your rights and choices

Under Alberta PIPA, BC PIPA and PIPEDA you have the right to:

• Access the personal information we hold about you, learn how we have used it and who we have disclosed it to
• Correct information that is inaccurate or incomplete
• Withdraw consent to uses that depend on consent, including marketing and optional cookies, subject to legal and contractual restrictions and reasonable notice
• Request deletion of personal information where applicable, subject to legal, contractual, accounting, warranty, fraud-prevention and other permitted retention requirements. We cannot delete records we are required by law to keep (for example invoices and accounting records) until their retention period has passed, but we will limit their use to that purpose.
• Complain about how we handle your information (Section 22)

How to make a request. Write to the Privacy Officer (Section 1). Tell us what you are asking for and how to reach you. We may charge a reasonable fee for access requests where the law allows; if so, we will give you an estimate before proceeding.

Identity verification. Before we release records such as your quote, invoices, address, contract, signature or message history, or change or delete them, we will take reasonable steps to confirm that you are the person the information is about (or are authorized to act for them). Usually this means contacting you back through the email address or phone number already on your file, or asking you to confirm details only you would know. We will not ask for more than is needed to verify you.

Response time. We respond within the time required by the law that applies to your request — 45 days under Alberta PIPA, and 30 days under BC PIPA and PIPEDA — and sooner where we can. If we need more time as the law permits, we will tell you why and when to expect our answer. If we refuse all or part of a request, we will explain why and tell you how to challenge the decision.

15. How we protect personal information

We use safeguards appropriate to the sensitivity of the information we hold, including:

• encryption in transit (HTTPS) for our website, customer portals and the connections between our systems and our service providers;
• authenticated access to our CRM and portals, with role-based permissions so that team members see only what their job requires, and logging of key actions;
• card details entered only on our payment processor's secure pages, never on our systems;
• secure, access-controlled storage for photos, contracts and documents, with customer quote and invoice pages reachable only through unique links;
• reputable service providers that encrypt stored data and maintain their own security programs;
• administrative safeguards: confidentiality obligations for staff and contractors, device lock and update requirements for team phones and tablets, removal of access when someone leaves, and periodic review of who has access to what.

No method of storage or transmission is completely secure, so we cannot guarantee absolute security. If you prefer not to send information over the internet, you can call us instead.

16. Privacy breaches

If personal information in our custody is lost, accessed or disclosed without authorization, we will contain the incident, assess the risk to the people affected, and notify the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada and any other regulator, and the affected individuals, as and when required by applicable law. We keep a record of every breach. We also work with the service provider involved where the incident occurred in their systems.

17. Reviews and testimonials

Public reviews. If you post a review of Starise on Google, Facebook or another public platform, we may quote it on our website and in our marketing, with your first name and city as shown in the review, subject to that platform's rules. We will not change its meaning. If you would prefer we did not quote your review, tell the Privacy Officer and we will remove it.

Private feedback. Emails, text messages, survey answers and other feedback you send us privately are used to improve our service. We will not publish private feedback as a testimonial unless we ask you first and you agree; we will show you the wording and tell you where it will appear. You may withdraw that permission at any time for future use.

18. Photos and video of installations

Our installers photograph and film installations to document the work, and Starise uses some of these images in its portfolio, on its website and social media, and in advertising. Marketing use of images of your property is covered by the photography terms in the contract you sign with us, which you can decline by telling us in writing before your installation; you can also withdraw permission for future use at any time by contacting the Privacy Officer, and we will stop using the image in new material and remove it from our website and channels within a reasonable time.

We do not publish your name, street address or exact location with installation images, and before publishing we remove or blur house numbers, people, licence plates, neighbouring properties and other details that could identify you or others, wherever practical. Photos taken for planning, quality control and warranty purposes stay in your project file and are not published.

19. Children

Our website, services and communications are directed at adults — homeowners, tenants with landlord consent, and business customers. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact the Privacy Officer and we will delete it.

20. Aggregated and de-identified information

We may use information that has been aggregated or de-identified — for example, the number of quotes per neighbourhood, average project size, or website traffic totals — for planning, reporting and marketing. We treat information as de-identified only when it has been stripped of identifiers so that it cannot reasonably be used, alone or combined with other information we hold, to identify you. We do not treat data as anonymous simply because a name has been removed, and we do not attempt to re-identify de-identified data.

21. Lighting control apps

Your Starise lighting system is controlled with a mobile app made by the controller's manufacturer, not by Starise. For systems installed today this is the My Home Lighting app; some earlier systems use the Gouly app. To use them you create an account with the app's developer, and any information you provide or that the app collects from your phone or controller is handled under that developer's privacy policy, not this one. Gouly's policy is at gouly-led.com; the My Home Lighting policy is available in the app and on its store listing.

What Starise can and cannot see: we do not have access to your app account, your lighting schedules or your usage. We do know which controller was installed at your property, and when you ask for help we may see whatever settings you show us during the support conversation. We choose controller and app vendors with care, but we do not control their data practices. If you have a concern about an app's handling of your information, tell us — we will help you raise it with the developer and will take it into account in our choice of suppliers.

22. Changes to this policy

We review this policy at least once a year and whenever our practices change. When we update it, we post the new version here with a new version number and date, and we keep earlier versions available on request. If a change would let us use your personal information for a new purpose that requires your consent under applicable law, we will ask for that consent before doing so rather than relying on the updated policy alone. Where a change is significant, we will also tell active customers directly.

23. Questions and complaints

If you have a question, concern or complaint about how we handle your personal information, please contact our Privacy Officer first (Section 1). We will acknowledge your complaint, look into it, and reply in writing within the time the applicable law requires. If we got something wrong, we will fix it.

If you are not satisfied with our response, you have the right to complain to the privacy regulator for the law that applies:

• Office of the Information and Privacy Commissioner of Alberta — oipc.ab.ca
• Office of the Information and Privacy Commissioner for British Columbia — oipc.bc.ca
• Office of the Privacy Commissioner of Canada — priv.gc.ca
• For unwanted marketing email or texts, the Canadian Radio-television and Telecommunications Commission (CRTC) — Canada's Anti-Spam Legislation; for unwanted calls, the National Do Not Call List

You may contact a regulator at any time; you do not need our permission and we will never discourage you from doing so.

1. What the app was

Team members used the app to prepare quotes and contracts, capture on-screen signatures, record deposits, and keep a shared calendar and follow-up list. It stored the records it created in a Google Firebase (Cloud Firestore) database located in Montréal, Canada, and kept a working copy on each team member's device. It contained no advertising and no analytics, crash-reporting or tracking software.

2. What records still exist

A small number of quote and contract records created in the app in March 2026 (customer name, property address, phone number, email address, quote line items and pricing, deposit records, property photos, and drawn signatures) remain in that database. Client access to the database has been disabled since March 31, 2026; only Starise's administrator can reach it. Copies may also remain on the devices that ran the app until those devices are wiped as part of the retirement.

3. What we are doing with them

• We are reviewing each record against our current customer system to decide whether it must be kept as part of a project record (contracts, invoices and installation records are kept for the periods in Section 13 of the Website & Services policy) or deleted as no longer needed.
• Records that must be kept will be moved into our current, access-controlled customer system and then removed from the retired database.
• Once that review is complete, the app's cloud database, hosting and remaining project resources will be permanently deleted, and this notice will be updated to say so. Evidence needed for our privacy records is retained separately, in a restricted form, for the period the law requires.

4. Your rights

You may ask what information about you the app recorded, ask us to correct it, or ask us to delete it where the law allows, by contacting our Privacy Officer: contact@co-starise.com or 587-885-6658. Identity verification, response times and complaint options are the same as in Section 14 and Section 23 of the Website & Services policy.

5. Privacy incident review

During our September 2026 privacy review we found that the database behind this app had been configured with Google's temporary "test mode" access rule between March 2 and March 31, 2026. We are assessing that finding under Alberta's Personal Information Protection Act and will contact affected customers and the Information and Privacy Commissioner of Alberta if the assessment concludes that notification is required.