Privacy
HouseGRC is made and sold by Justin White, a sole proprietor in New Brunswick, Canada ("we", "us"). This notice explains what personal information we handle through this website, purchases and the HouseGRC software, why, who else handles it, and your choices. Justin White is the controller of this personal information and is responsible for how we handle it; you can reach him at [email protected].
The software
HouseGRC runs on your own servers. Everything you put into it (your users, risks, controls, evidence, vendors, incidents and any personal information in them) stays in your installation; we never receive it. The software does not collect usage statistics or telemetry and does not contact us.
- Licences are verified inside your installation. There is no activation server.
- AI services: AI features are off until an administrator configures an AI provider with your organisation's own account. The data needed to answer a request then goes to that provider, under your agreement with it.
- Systems you connect: HouseGRC connects only to the systems, services and domains you configure, and may fetch public reference data (such as vulnerability feeds) from their publishers when you enable those features.
For the personal information you keep in HouseGRC, your organisation is the controller and we have no access to it.
This website
The website is hosted by Cloudflare, which processes request data such as your IP address and browser details to deliver the site and protect it from abuse. We do not use analytics, advertising or tracking cookies. Cloudflare may set a strictly necessary security cookie.
Purchases
Licences are sold through Paddle.com, our reseller and merchant of record. Paddle collects your payment details, billing address and any tax number under its own privacy notice, as an independent controller; we never see or store card or bank details.
When you buy, we keep a record of the purchase: your name, email address and country, and any business name you give (from Paddle), the organisation name you choose to give on the pricing page, what you bought, the Paddle transaction number, the amount, the licence key and its dates, whether the licence email was delivered, and which version of the terms of sale and licence agreement you accepted and when. For a purchase by quotation or invoice, we keep the same details from the quotation, purchase order and invoice.
We use this information to:
- issue your licence key (your name, email and organisation are written into it), email it to you and send it again if you lose it;
- answer support, invoice and refund requests;
- help Paddle with refunds and payment disputes, including by giving Paddle the records of the purchase, of the key's delivery and of your acceptance of the terms;
- keep the accounting and tax records the law requires; and
- protect against fraud and enforce the licence agreement, for example by listing a refunded or charged-back licence so that later versions of the software do not accept it.
We do not sell or rent personal information, and we do not use it for marketing without your consent.
If you are in the European Economic Area or the United Kingdom, our legal bases are performing our contract with you (issuing and delivering the licence, support), complying with legal obligations (accounting and tax records), and our legitimate interests in handling disputes, preventing fraud and enforcing the licence agreement.
Licence emails are sent through Resend, an email delivery service. If you use Email me my licence key on the support page, we use the address you enter only to look up and send your licence keys, and keep a short record of requests to prevent abuse. Email you send us, and our replies, are handled in Google Workspace. We keep support and sales emails while they are useful for helping you, and then delete them.
Service providers and where information is processed
We rely on these providers:
- Cloudflare hosts the website and the database of purchase records.
- Paddle sells the licences and processes payments and taxes, as an independent controller under its own terms.
- Resend sends licence emails.
- Google handles our email.
They process personal information on our behalf, or as independent controllers under their own terms, and may store and process it in the United States and other countries. While it is there, it is subject to the laws of those countries and may be accessed by their courts, law enforcement and national security authorities.
How we protect it
Purchase records are kept in a database that only we can reach, behind a sign-in that requires a one-time code sent by email, and everything travels over encrypted connections. We give access to no one else.
Retention
We keep purchase records for at least six years after the end of the tax year of the purchase, as Canadian tax law requires. After that we keep them only while they are needed to send again or confirm a licence you still use, or to deal with a dispute; you can ask us to delete them then. Support and sales emails are kept while they are useful for helping you and then deleted.
Your rights
You can ask what personal information we hold about you, ask us to correct it, or ask us to delete what we are not required to keep, by emailing [email protected]. We answer within 30 days. Depending on where you live, you may have further rights under laws such as Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) or the EU or UK GDPR. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or to your local data protection authority.
HouseGRC is sold to businesses and professionals, and neither the website nor the software is meant for children.
Changes and contact
We will post any change to this notice here with a new date. Questions and requests: [email protected].