This Privacy Policy explains how Canalytics Group Inc. ("Canalytics", "we", "us") collects, uses, discloses, retains and protects personal information in connection with CGPIA (cgpia.com) (the "Service"), a precision agriculture platform combining satellite imagery, weather data, AI predictions and IoT sensors to produce irrigation schedules, crop health assessments and yield forecasts for farmers and cooperatives. We wrote it to be read, not skimmed past: each section says plainly what we do and what you can do about it.
1. Who we are and our role
Canalytics Group Inc. is a corporation incorporated under the Canada Business Corporations Act (no. 1808088-7), with its registered office in Sherbrooke, Quebec, Canada. It builds and operates software platforms for regulated and data-intensive industries, together with its Moroccan affiliate Canalytics Consulting & Engineering Maroc SARL.
For most of the personal information described in this policy, Canalytics decides why and how it is processed — under Quebec law, we are the enterprise holding the information.
CGPIA is also used by agricultural cooperatives and their member farmers ("Customers"). When a Customer loads information about its member farmers into the Service, the Customer decides why that information is processed, and we act only on its documented instructions as its service provider (processor). If your information was provided to us by a cooperative, please direct your requests to that cooperative first; we will help them respond. We remain responsible as controller for the limited information we process for our own purposes: Customer account administration, billing, security of the Service, and communication with Customer contacts.
2. Person in charge of the protection of personal information
- Person in charge of the protection of personal information — Abderrahmane Ameray, President and Co-founder
- Email: privacy@canalytics-group.com
- Mail: Canalytics Group Inc., Attn: Privacy, 405-2018, rue des Grands-Monts, Sherbrooke (Québec) J1H 3Z7, Canada
3. Information we collect
We collect only the information we need for the purposes listed under Why we use it.
| Category | Examples | Source |
|---|---|---|
| Account | name, phone number (verified by SMS code), language, cooperative | you or your cooperative |
| Farm data | parcel boundaries, crops, irrigation equipment, field observations, geotagged photos | you |
| Sensor data | soil moisture, weather station and pump telemetry | your IoT devices |
| Payment | plan, transaction reference, mobile money number | you, via payment providers |
| Technical | push notification token, device type, security logs | automatic |
We do not knowingly collect information we do not need, and we ask you not to upload personal information about other people into free-text fields or files unless the Service is designed for it and you are entitled to share it.
How we collect it
- From you, when you create an account, fill in a form, upload content or contact us.
- Automatically, through the technology that runs the Service (server logs, security events, and the cookies described in our Cookie Policy).
- From our cooperative Customers, who load member-farmer information into the Service under their own responsibility.
- From services you connect, such as IoT soil and weather sensors and mobile money wallets, only once you authorize the connection, and only the data that connection needs.
- From devices and sensors, including the location data described under Location, identification and profiling features.
4. Why we use it
| Purpose | Examples | Legal basis |
|---|---|---|
| Provide agronomic advice | irrigation schedules, crop health maps, yield forecasts | contract |
| Account security | SMS one-time codes, abuse prevention | contract / legitimate interest |
| Payments | subscriptions via card or mobile money | contract / legal obligation |
| Notifications | irrigation alerts by push or SMS | contract |
We will not use your information for a new purpose that is incompatible with these without first telling you and, where the law requires, obtaining your consent. We do not sell personal information and do not share it for cross-context behavioural advertising.
5. Location, identification and profiling features
To compute irrigation and crop advice, the Service stores the boundaries of the parcels you draw or import, and the location embedded in field photos you choose to upload. It does not track your phone's location in the background.
Parcel boundaries can be edited or deleted in the app; photo location can be removed before upload in your phone's camera settings. We apply the most privacy-protective settings by default, without any action on your part.
6. Artificial intelligence
CGPIA uses artificial intelligence to turn satellite imagery, weather data and sensor readings into irrigation schedules, crop-health assessments and yield forecasts. In short:
- Providers. AI processing is performed by the providers listed under Service providers below, principally Google LLC (Earth Engine) for satellite analysis, plus predictive models we operate ourselves.
- No training on your content. We do not use your content or personal information to train or fine-tune general-purpose AI models, and our AI providers are contractually prohibited from doing so.
- You stay in control. CGPIA provides decision support based on satellite, weather and sensor data and models that can be wrong. It does not replace the judgment of the farmer or a qualified agronomist, and we are not liable for crop outcomes.
- Know when you're talking to AI. Predictions, scores and recommendations generated by a model are labelled as such in the dashboard and in reports.
7. When we share information
- With service providers that host, secure or operate the Service for us (see Service providers below), under written contracts requiring them to protect it, use it only to serve us, and return or destroy it when the contract ends.
- With the cooperative that gave you access to the Service, according to its configuration of the Service.
- With your direction or consent, for example when you connect a third-party service or share a report.
- For legal reasons, when the law requires it or to respond to a valid legal order; we review each request and disclose only what is strictly required.
- In a business transaction (merger, financing, sale of assets), with parties bound by confidentiality who may use the information only for the transaction, as permitted by law.
- Within the Canalytics group (Canalytics Group Inc. in Canada and Canalytics Consulting & Engineering Maroc SARL in Morocco), only where needed to operate and support the Service and under the same protections.
8. Service providers (subprocessors) and where your information is stored
The hosting provider and region for the application itself are being finalized and will be published here once confirmed; the marketing site (cgpia.com) is hosted by Netlify, Inc. See the full list below.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| (platform hosting) | Application, TimescaleDB/PostGIS, MinIO storage, MQTT broker | all platform data | to be confirmed |
| Google LLC (Earth Engine) | Satellite analysis | parcel geometry only | USA |
| Africa's Talking | SMS codes and alerts | phone number, message text | Kenya (to be confirmed) |
| Expo (650 Industries) | Push notifications | push token, notification text | USA |
| Stripe | Card payments | billing details | USA |
| Wave, Orange Money, Free Money | Mobile money payments | phone number, amount | Senegal |
| Netlify, Inc. | Marketing site hosting | web traffic | USA / global CDN |
| Google LLC (Analytics 4) | Marketing site analytics, with consent | pseudonymous usage data | USA |
We update this list before we add a provider that processes personal information.
Communication outside Quebec. Some of these providers store or access information outside Quebec. Before communicating information outside Quebec, we carry out a privacy impact assessment that considers the sensitivity of the information, the purposes, the protection measures (including contractual ones), and the legal framework of the destination. Each such communication is governed by a written agreement.
Transfers outside Senegal. Personal information collected in Senegal is transferred abroad only to a country providing a sufficient level of protection or with the authorization of the CDP, as required by Law 2008-12. We are completing the prior declaration required by that law with the Commission de Protection des Données Personnelles (CDP); this section will be updated with the filing reference once confirmed.
9. How long we keep it
We keep personal information only as long as needed for the purposes described above, then securely destroy or anonymize it.
| Data | Period |
|---|---|
| Account and farm data | life of the account; deleted 30 days after a deletion request |
| Sensor telemetry | to be confirmed |
| Payment records | as required by tax law (Senegal and Canada periods to be confirmed) |
| Backups | 30 days (nightly, encrypted) |
Information subject to a legal hold, an ongoing dispute or a statutory retention period is kept until that obligation ends.
10. How we protect it
We use administrative, technical and physical safeguards proportionate to the sensitivity of the information, including: phone verification by one-time SMS code, nightly encrypted backups kept 30 days, and tenant isolation by cooperative. We are documenting further controls before listing them here. No system is perfectly secure; if a confidentiality incident affects your information and presents a risk of serious harm, we will notify you and the competent authorities as required by law.
11. Your rights
You can exercise the rights below, free of charge, by writing to privacy@canalytics-group.com. We will verify your identity before acting, and answer within 30 days (or the shorter period required by your local law). If we refuse a request, we will explain why and how to contest the refusal.
If you are in Quebec
Under the Act respecting the protection of personal information in the private sector, you may access your personal information and obtain a copy; have inaccurate, incomplete or equivocal information corrected; withdraw consent to a use or communication; receive computerized personal information you provided in a structured, commonly used technological format, and have it transferred to a person or body you designate (data portability); and ask us to stop disseminating your information or to de-index any hyperlink attached to your name, where the conditions of the Act are met. You may file a complaint with the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca).
Elsewhere in Canada
Under PIPEDA (and, where applicable, the private-sector laws of Alberta and British Columbia) you may access and correct your information, withdraw consent subject to legal or contractual restrictions, and challenge our compliance. You may contact the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).
In Senegal
Under Law 2008-12 of January 25, 2008, you have a right of information, access, objection, rectification and deletion. You may contact the Commission de Protection des Données Personnelles (CDP) (www.cdp.sn).
12. Children
The Service is intended for adults and professionals. It is not directed at children under the age of 16, and we do not knowingly collect their information. If you believe a child has provided us information, contact us and we will delete it.
13. Cookies and similar technologies
See our Cookie Policy. Non-essential cookies are off until you accept them, and you can change your choice at any time from the "Cookie preferences" link in the footer.
14. Changes to this policy
We will post any change here with a new effective date. If a change is material, we will notify you in the Service or by email at least 30 days before it takes effect and, where required, ask for your consent again.
15. Contact us
Questions, requests or complaints: privacy@canalytics-group.com · Canalytics Group Inc., 405-2018, rue des Grands-Monts, Sherbrooke (Québec) J1H 3Z7, Canada · +1 (514) 434-6530.