Privacy Policy

Effective date: June 9, 2026 Last updated: June 9, 2026 Version: 1.0

1. Who we are

Muninn (“Muninn,” “we,” “our,” “us”) is a software-as-a-service estimating, invoicing, and project management platform for Canadian renovation contractors.

The Muninn service is operated by Great Raven Renovations Ltd., a British Columbia corporation, as the current operating entity. Operation of the Muninn service is being assigned to Muninn Technologies Inc. upon its incorporation; once that assignment takes effect, this Policy will be updated to name Muninn Technologies Inc. as the operating entity, and the substance of the privacy commitments set out below will continue without interruption.

This Privacy Policy covers two surfaces:

• The marketing site at muninn.ca and www.muninn.ca (and any country-code or campaign subdomains we operate).
• The application at app.muninn.ca (the “App”), including all contractor workspaces, client portals, and APIs.

Together these are the “Service.”

If you have any questions, want to exercise a privacy right, or want to file a complaint, contact our privacy officer at privacy@muninn.ca.

2. What this policy covers and who it applies to

This Policy applies to three groups of people:

1. Visitors to the marketing site (anyone browsing muninn.ca, signing up for the waitlist, downloading materials, or contacting us).
2. Contractor users — the contractors and trades businesses who sign up for a Muninn workspace, their team members, and anyone who logs into app.muninn.ca.
3. Client recipients — the homeowners, property managers, and other clients of contractor users who receive estimates, invoices, or approval links from a contractor and interact with the public client portal at /approve/:token.

Where this Policy says “you,” it means whichever of these groups you fall into. Where the distinction matters, we say so.

This Policy does not cover websites or services operated by third parties, even if you reach them through links in the Service.

3. Roles: controller, processor, and contractor relationship

Privacy law in Canada and elsewhere distinguishes between a controller (who decides why and how personal information is handled) and a processor (who handles it on a controller’s behalf).

• For visitors to the marketing site and for contractor users of the App, Muninn is the controller of the personal information described in Section 4.
• For client recipients whose data is uploaded to the App by a contractor user (names, addresses, project details, signatures, payment information), the contractor user is the controller of that data and Muninn acts as a processor that handles the data on the contractor’s instructions.

What this means in practice: if you are a homeowner who received an estimate from a contractor through Muninn and you want a copy of your data deleted, contact the contractor first. Muninn will support the contractor in honouring your request, but the contractor controls the relationship and the data.

For Quebec residents, the privacy officer designated under Law 25 is reachable at privacy@muninn.ca.

4. What personal information we collect

We collect only what we need to run the Service. The categories below describe what is collected, from whom, and why.

4.1 From marketing-site visitors

4.2 From contractor users (account holders and team members)

4.3 From client recipients (homeowners, property managers, other clients of contractor users)

Most of this data is entered by the contractor user, not by the client directly.

4.4 From everyone, automatically

We collect technical log data on every request to the Service: IP, user-agent, request path, status code, and timing. We retain these logs for a limited period (see Section 9).

5. AI and optical-character-recognition (OCR) processing

Muninn uses third-party artificial-intelligence services to power two specific features:

1. AI estimating assistance — interpretation of scope-of-work text and suggestion of line items.
2. AI receipt OCR — extracting vendor, date, line items, and totals from images or PDFs of supplier receipts and invoices.

The third-party AI providers we currently use are:

• Google (Google Generative AI / Gemini) — for scope interpretation and OCR.
• OpenAI — for scope interpretation and certain text-generation features.

What is sent to these providers:

• For estimating assistance: the scope text you enter and a minimum of contextual metadata (no client contact information, no payment data).
• For receipt OCR: the image or PDF file you upload.

What we instruct the providers to do:

• Process the input solely to return the requested output to Muninn.
• Not use your content to train their general-purpose models.

We use these providers under their enterprise / API terms which prohibit training on customer content. Provider behaviour may change; the current providers and their stated terms are available on request from privacy@muninn.ca.

You can avoid sending data to AI providers by not using the AI estimating assistant and by entering receipt data manually instead of uploading photos.

6. Cookies, analytics, and similar technologies

The marketing site at muninn.ca uses cookies and similar technologies. The App at app.muninn.ca uses only the cookies strictly necessary to keep you signed in and secure.

Categories we use:

The full list of cookies, retention periods, and opt-out instructions is summarized in the table above and in the consent banner shown on first visit.

In jurisdictions that require it (Quebec under Law 25; the EU and the UK under GDPR / UK-GDPR), we ask for your consent before setting any non-strictly-necessary cookie, and you can withdraw consent at any time.

7. How we use personal information

We use personal information for the following purposes:

1. Providing the Service — running the App, rendering documents, delivering emails, processing payments, supporting e-signatures, generating reports.
2. Account and billing administration — creating workspaces, managing team members, processing subscription payments through Stripe, sending invoices for the Service itself.
3. Customer support — responding to your messages, debugging your account, restoring data from backups when you ask us to.
4. Security and fraud prevention — detecting account compromise, rate-limiting abusive activity, preserving audit logs of approvals and signatures.
5. Service improvement — measuring how features are used, fixing bugs, prioritizing the roadmap. We use aggregated and de-identified data wherever possible.
6. Marketing communications — only with your consent, and only on the marketing-site surface. You can unsubscribe from any marketing email with one click; we do not send marketing emails to client recipients of contractor users.
7. Legal and regulatory compliance — responding to lawful requests, defending claims, complying with tax and corporate-records obligations.

We do not sell personal information. We do not rent personal information. We do not use client-recipient data to train AI models.

8. Legal bases for processing (for GDPR / UK-GDPR / Law 25 contexts)

Where Canadian, EU, UK, or Quebec law requires a specific legal basis for each processing activity, the bases we rely on are:

You may withdraw consent at any time for activities where consent is the basis. Withdrawing consent does not affect processing done before the withdrawal.

9. How long we keep personal information

We keep personal information only as long as we need it for the purposes set out in this Policy, or as required by law.

Client-recipient data is governed by the retention policy chosen by the contractor user who controls the workspace, subject to the legal minimums above for signed documents and billing.

10. How we secure personal information

We use a layered set of safeguards appropriate to the sensitivity of the data:

• Encryption in transit — all traffic to muninn.ca and app.muninn.ca runs over HTTPS / TLS.
• Encryption at rest — the application database is hosted on encrypted volumes; backups are stored encrypted.
• Access control — production access is restricted to named operators; all access is logged.
• Authentication — passwords are stored as salted hashes; session tokens are server-side; subscriptions and payments are handled by Stripe.
• Tenant isolation — every workspace is isolated by a company_id boundary enforced at the storage layer; no contractor user can read another contractor’s data.
• Backups — nightly SQLite backups using a safe-online method, with 14-day rolling retention.
• Audit logs — approvals, signatures, and decline events are recorded with timestamps and IP addresses.
• Incident response — if a breach occurs that involves a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (and the Commission d’accès à l’information du Québec where Quebec residents are affected) as soon as feasible.

No system is perfectly secure. If you believe your account has been compromised, contact security@muninn.ca immediately.

11. Sub-processors and third parties we share data with

We share personal information only with the categories of recipient below, and only as needed:

We have written terms with each of these recipients limiting their use of your data to providing the service to us.

Some recipients are located outside Canada. When personal information is transferred outside Canada or Quebec, it becomes subject to the laws of the recipient country and may be accessible to government and law-enforcement authorities there under those laws. We use contractual safeguards (data-processing agreements, standard contractual clauses where applicable) to require an equivalent level of protection.

If you would like the current list of sub-processors, email privacy@muninn.ca.

12. Cross-border data transfers

Muninn stores the App database on servers operated by Hetzner Online GmbH in Germany. Marketing-site hosting and several sub-processors are based in the United States. Email is hosted in Canada.

By using the Service, you understand and consent to the transfer of your personal information to these jurisdictions. Where required by Law 25, GDPR, or UK-GDPR, we rely on contractual safeguards with our sub-processors to maintain a level of protection comparable to the protections in your home jurisdiction.

13. Your privacy rights

Depending on where you live, you have some or all of the following rights:

• Access — ask for a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate or incomplete personal information.
• Deletion — ask us to delete personal information, subject to legal-retention obligations.
• Withdrawal of consent — withdraw consent for any processing based on consent (such as marketing email or non-essential cookies).
• Portability — receive your data in a portable format, where the law requires it.
• Restriction and objection (EU / UK / Quebec) — ask us to restrict or object to specific processing activities.
• Automated decision-making (Quebec / EU) — ask for information about, and challenge, any decision made exclusively by automated means that produces legal or similarly significant effects. Muninn does not currently make any such fully-automated decisions about you.
• Complaint to a regulator — file a complaint with the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, your provincial commissioner, or your local data-protection authority in the EU or UK.

To exercise any of these rights, email privacy@muninn.ca with enough information for us to identify your account or your relationship to the Service. We will respond within 30 days. If we need more time, we will tell you why and when to expect a full response.

If your data is held in a workspace controlled by a contractor user (you are a client recipient), please contact the contractor first; we will support them in honouring your request.

14. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact privacy@muninn.ca and we will delete it.

15. Quebec Law 25 — specific disclosures

This section applies to residents of Quebec and supplements the rest of this Policy.

• Privacy officer. The person responsible for protecting personal information at Muninn is the founder, currently reachable at privacy@muninn.ca.
• Confidentiality incidents. If a confidentiality incident presents a risk of serious injury, we will notify you and the Commission d’accès à l’information du Québec as soon as possible.
• Automated decision-making. Muninn does not currently make decisions about Quebec residents based exclusively on automated processing. If we begin doing so, we will inform you in advance, give you the right to be heard, and allow you to ask for the personal information used in the decision to be corrected.
• De-indexing. You can ask us to stop disseminating personal information about you, or to de-index, on the conditions set out in Law 25.
• Data portability. You can ask to receive your computerized personal information in a structured, commonly used technological format.

16. Marketing emails (CASL)

Muninn complies with Canada’s Anti-Spam Legislation (CASL). We send commercial electronic messages only to recipients who have given express or implied consent, and every commercial message includes an unsubscribe mechanism and our identification and contact information. Transactional emails (estimates, invoices, account notifications, security alerts) are not marketing emails for CASL purposes.

17. Changes to this Policy

We will update this Policy from time to time. The version number and “last updated” date at the top will change with each revision. For material changes (a change in the data we collect, in the sub-processors we use, or in your rights), we will notify account holders by email or in-App notice at least 14 days before the change takes effect.

Previous versions of this Policy will be available on request from privacy@muninn.ca.

18. Contact

For all privacy-related questions, requests, and complaints:

• Email: privacy@muninn.ca
• Security incidents: security@muninn.ca
• General contact: hello@muninn.ca
• Mailing address: Great Raven Renovations Ltd., Salt Spring Island, British Columbia, Canada (full address provided on request)

We respond in English and French.

This Policy was prepared as an operational document for the Muninn Service. It is not a substitute for advice from a qualified Canadian privacy lawyer; obtain such advice before relying on it in disputes, regulatory filings, or M&A diligence.