Privacy Policy

MapleSpike ("we", "us", "our") provides a government data intelligence platform that aggregates, processes, and serves Canadian public-sector data via REST API, MCP tools, and a web portal. This policy explains what data we collect, how we use it, and your rights.

We are committed to transparency. Our service searches and presents public-sector information. License terms vary by publisher and dataset; public availability does not itself grant reuse rights. We do not sell user data to third parties.

Account data: Email address, OAuth provider ID (GitHub, Google, Apple), wallet address (if Web3 auth), and tenant tier. We store the minimum required to authenticate you.

API usage data: Request count, endpoint accessed, timestamp, and response status. Used for rate limiting, billing, and abuse prevention. Audit logs are retained for 30 days, then aggregated into daily summaries.

AI query data: Questions submitted to the /v1/ai/ask endpoint are processed in real-time and not stored permanently. PII (emails, phone numbers, SINs) is redacted before any audit logging.

Payment data: We do not store credit card numbers. Crypto payments are processed on-chain. Interac e-Transfer details are handled by our payment processor.

We do NOT collect: Browser fingerprints, tracking cookies for advertising, personal browsing history, or location data beyond IP-based rate limiting.

• Authenticate you and manage your account
• Enforce rate limits and API quotas per your plan tier
• Process payments and manage billing
• Detect and prevent abuse, fraud, and unauthorized access
• Improve our data quality, coverage, and service reliability
• Comply with legal obligations under Canadian law

API keys are stored as SHA-256 hashes — we cannot recover your plaintext key after issuance. Authentication uses JWT tokens with short-lived refresh cycles.

Public-sector source records may be cached with provenance metadata (source URL, retrieval timestamp, SHA-256 content hash, and publisher-declared license metadata when supplied). License terms vary by source and dataset. Public availability does not itself grant reuse rights; consult the original publisher terms.

AI inference requests to the edge worker are processed via Cloudflare Workers AI or our self-hosted homelab cluster. No query content is stored beyond the 30-day audit window.

Source records can include an individual's name as published by the source (for example, a lobbying registration or a charity's directors). We present individuals only in their public or professional capacity as published by the source. We minimize personal contact details in records we serve, and we do not build derived profiles that aggregate a private individual across sources.

Retention: Source records are kept only as long as needed to provide and improve the Service; derived indexes and caches are rebuilt from source data and are not kept longer than the records they serve. Account and audit data follow the retention periods described in Sections 2 and 4.

Corrections and removal requests: If a record we serve contains personal information that should be corrected or removed, email [email protected] with the record link or citation. We assess the request, work with the originating publisher where the record comes from, and respond within 30 days.

• Access: Request a copy of your account data
• Deletion: Request permanent deletion of your account and associated data
• Portability: Export your API usage history in JSON format
• Rectification: Correct inaccurate account information
• Withdrawal: Revoke OAuth grants at any time from your provider

MapleSpike is operated by the account holder identified at checkout (currently a sole proprietorship; entity details published here upon formal incorporation). As a Canadian service, we handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). To exercise any of these rights, contact [email protected]. We respond within 30 days.

We use a single session cookie for authentication (JWT) and localStorage for UI preferences (dark/light theme). We do not use third-party tracking cookies, advertising pixels, or analytics scripts that profile individual users.

Questions about this policy? Email [email protected] or write to us at Ottawa, Ontario, Canada.