Privacy Policy

This Privacy Policy explains how HPP Canada uses information in the HPP Canada Tracking Portal. The portal is used to track product receiving, HPP processing, packing slips, pickup status, client reports, access approval requests, and optional email updates.

The portal may store the following information when it is entered by staff, verifiers, administrators, or clients:

• Company and client names.
• Job numbers, product descriptions, batch or lot details, quantities, temperatures, handling records, packing slip details, invoice references, and process timeline status.
• Names, signatures, dates, notes, verification records, and corrective action records related to material handling and shipping documentation.
• Client report titles, report messages, replies from HPP Canada, timestamps, and report status.
• Email addresses voluntarily entered by clients who choose to receive product status updates.
• Clerk account information needed for portal sign-in, such as email address, user identifier, and authentication status.
• Portal access request records, including requested portal, company name where applicable, approval status, and request timestamps.
• Basic portal activity records such as when a client last accessed the portal, where enabled for operational follow-up.

HPP Canada uses portal information only for operational purposes, including:

• Tracking products through receiving, processing, verification, shipping, pickup, and packing slip workflows.
• Preparing, viewing, editing, printing, and verifying operational documents.
• Responding to client reports or issues submitted through the portal.
• Reviewing and approving access to the Admin, Employee, Verifier, and Client portals.
• Sending product status emails to clients who request updates.
• Maintaining internal records needed for food safety, traceability, customer service, and administrative follow-up.

Clients may choose to enter an email address to receive product status updates. These emails are sent from the configured HPP Canada updates email address.

Clients can stop or resume updates for individual jobs from the Client Portal. HPP Canada may also remove or update an email address at the client's request.

HPP Canada uses trusted service providers to operate the portal. These providers may process or store portal information only as needed to provide their services.

Current providers include hosting, database, authentication, security verification, and email delivery services such as Netlify or another hosting provider, Supabase, Clerk, Google services used with Clerk or reCAPTCHA where configured, Resend, and GoDaddy for domain management.

Portal sign-in is handled through Clerk. Signing in does not automatically grant access to all portal areas. New users must request access, and HPP Canada must approve the requested portal before the user can continue.

Client users select their company and request access for that company. Staff portal access is approved separately for Admin, Employee, and Verifier portal use.

HPP Canada uses Clerk sign-in, approval-based portal access, database permissions, Edge Functions for sensitive access checks, input validation, human verification where configured, and operational controls to help protect portal information.

Portal pages should not be treated as public links. Users must sign in and must be approved for the correct portal before they can view company records. Users should sign out when finished, especially on shared devices.

No system can be guaranteed completely secure. HPP Canada continues to improve the portal security model, including stronger row-level database policies, server-side authorization for sensitive actions, request rate limiting, and audit logging.

HPP Canada operates this portal for business traceability and customer service. The portal should avoid practices that have commonly led to privacy complaints, enforcement actions, or lawsuits against websites and online services, including:

• Collecting information from children under 13 without proper legal safeguards.
• Saying one thing in a privacy policy but doing something different with user or client data.
• Using deceptive design, confusing buttons, hidden terms, or pressure tactics that make users share information or take an action they did not intend.
• Collecting more personal information than needed for the business purpose.
• Failing to protect account access, product records, reports, signatures, email addresses, or other stored information with reasonable security controls.
• Sending unwanted emails or making it unclear how optional updates can be stopped.
• Sharing, selling, or using client information for advertising without a clear legal basis and clear notice.

HPP Canada should review this policy and the portal workflow whenever new data fields, email features, authentication changes, AI features, or third-party services are added.

The HPP Canada Tracking Portal is a business-to-business operations portal. It is not directed to children under 13, and HPP Canada does not knowingly request, collect, or store personal information from children under 13 through this portal.

Users under 13 must not create an account, request access, submit reports, enter email updates, or use the portal. If HPP Canada learns that information from a child under 13 was submitted through the portal, HPP Canada will take reasonable steps to remove or disable that information unless it must be retained for legal or safety reasons.

The U.S. Federal Trade Commission states that COPPA violations may result in civil penalties of up to $53,088 per violation, depending on the facts of the case. HPP Canada treats child privacy restrictions seriously and does not operate this portal for child users.

The portal is not designed to use client or staff entries as artificial intelligence prompts. If AI features are added in the future, user-provided content must be treated as untrusted data, separated clearly from system instructions, and not allowed to control application instructions, security rules, or hidden prompts.

HPP Canada keeps portal records for as long as needed for traceability, food safety, customer service, legal, accounting, operational, or internal recordkeeping purposes.

Records may be retained after a job is completed where HPP Canada needs them for business or compliance reasons.

Clients may contact HPP Canada to request correction of inaccurate contact information or to ask questions about portal records connected to their company.

Some operational records may not be deleted or changed if HPP Canada needs to preserve them for traceability, legal, food safety, accounting, or business purposes.

HPP Canada may update this Privacy Policy when portal features, providers, legal requirements, or operational practices change. The updated date above should be revised when changes are made.