What we collect, why, and how long we keep it.

CanSTEAM Foundation is a registered Canadian charity (BN 791575509RR0001) incorporated in Ontario, operating at 205 Riviera Drive, Unit 2, Markham, ON L3R 5J8. For any privacy concerns, write to info@cansteam.org. Our privacy officer is the Secretary of the Board.

We collect only what we need. When you contact us, donate, register a team, or subscribe to updates, we may receive your name, email address, phone number, mailing address, school or organization, role, and the contents of your message. When you donate, our payment processor handles your card details directly — we never see or store them. We record the donation amount, date, receipting details, and acknowledgement preferences. When you visit the site, our hosting provider receives standard web logs (IP address, user agent, referring page, request time) used for security and diagnostics.

Personal information is used to reply to inquiries, process and acknowledge donations, issue official tax receipts in accordance with the Canada Revenue Agency's requirements, coordinate events and volunteer roles, send occasional program updates to people who have asked for them, and meet our legal and accounting obligations. We do not sell or rent personal information. We do not use it to build advertising profiles.

The site uses a minimal cookie to remember your preferred language (en or fr). We use PostHog (hosted at us.i.posthog.com) for product analytics — to understand which pages are viewed, session length, and general device and browser information. PostHog sets a cookie to attribute repeat visits to a single anonymous session, and uses your IP address for approximate geolocation (country and city level). We do not use this data for advertising, and we do not sell or share it with third parties. We do not embed Google Analytics, Meta pixels, or other advertising or ad-attribution pixels. To opt out of PostHog tracking, enable Do Not Track in your browser — we honour it — or use a content blocker that blocks us.i.posthog.com. The rest of the site will continue to work normally.

We use third-party services to operate: a payment and receipting platform at go.cansteam.org/donate (CanadaHelps or a comparable CRA-recognized intermediary) for donations; an email provider for transactional and opt-in communications; a static site host (Cloudflare) that processes standard web logs. Each of these providers handles information under their own privacy terms. VEX Robotics and its event-management platforms are separate organizations with their own privacy policies; competition registration data is held by them, not by CanSTEAM.

We share personal information only (a) with the service providers named above to the extent needed to deliver the service you have requested, (b) with our auditor and accountants for legally required reviews, (c) where we are legally compelled by a court or government authority, or (d) where you have given us express consent.

Our public programs are primarily delivered through schools, registered VEX teams, and community organizations acting as the custodians of student information. CanSTEAM does not knowingly collect personal information directly from children under 13 through this website. Where we photograph or film students at events, we do so under the consent obtained by the hosting school or team; contact us to withdraw consent or request removal.

Donation records and receipting information are retained as long as required by the Canada Revenue Agency (currently six years following the end of the taxation year to which they relate). General correspondence is kept for up to three years. Web logs are kept for up to 90 days. You can ask us to delete information we are not legally required to retain.

Under PIPEDA you have the right to know what personal information we hold about you, to see it, to correct it if it is wrong, and to withdraw consent to further use (subject to legal retention rules). Write to info@cansteam.org and we will respond within thirty days. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

We apply reasonable technical and organizational safeguards to the personal information we hold — encrypted transport (HTTPS) for the website, access controls on administrative systems, and vendor selection that favours providers with documented security practices. No system is perfectly secure; we commit to notify affected individuals and the appropriate regulators of any breach that presents a real risk of significant harm, as required by law.

We update this policy when our practices change or when law requires it. Material changes will be dated on this page; routine clarifications will not. Continued use of the website after a posted change constitutes acceptance of the revised policy.