Privacy Policy

This Privacy Policy describes how Pinecrest Labs Inc. (“Pinecrest Labs,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you visit our website, sign up for a trial, enrol in a course, or otherwise interact with our services. We are committed to handling your data responsibly and in compliance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the United Kingdom and European Union General Data Protection Regulation (UK GDPR and EU GDPR).

By accessing our website or using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our services and contact us to request deletion of any data we may hold.

1. Data Controller

The data controller responsible for your personal information is:

For any questions about this policy or the way we handle your personal information, contact our privacy team at privacy@pinecrestlabs.ca. We aim to respond to all privacy-related inquiries within ten business days.

2. Data We Collect

We collect only the personal information that is necessary to deliver our services and maintain our relationship with you. The categories of data we collect include:

• Identity information — your full name, as provided during trial registration or course enrolment.
• Contact information — your email address, phone number (if voluntarily provided), and company or organization name.
• Trial activity data — records of which lab scenarios you start, complete, or abandon during your 14-day trial period, along with timestamps and session duration.
• Lab logs — technical logs generated during lab sessions, including commands executed within sandbox environments, error outputs, and completion states. These logs are used to assess progress, diagnose platform issues, and improve scenario design.
• Communication records — the content of emails, form submissions, or chat messages you send to us.
• Device and usage data — browser type, operating system, IP address (anonymized where analytics are involved), referring URL, pages visited, and interaction patterns on our website.
• Payment information — billing details are collected and processed by our payment processor at the point of enrolment. We do not store full credit card numbers on our own servers.

We do not collect sensitive personal information such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric identifiers.

3. Purpose and Legal Basis

Under PIPEDA, we collect and use your personal information with your knowledge and consent, limited to purposes that a reasonable person would consider appropriate in the circumstances. Under the GDPR, we rely on the following legal bases depending on the processing activity:

• Performance of a contract — processing necessary to deliver the trial, courses, and lab access you have signed up for (GDPR Article 6(1)(b)).
• Legitimate interests — improving our platform, understanding usage patterns, preventing fraud, and ensuring network security, provided these interests do not override your rights (GDPR Article 6(1)(f)).
• Consent — for marketing communications, newsletter subscriptions, and the placement of non-essential cookies. You may withdraw consent at any time (GDPR Article 6(1)(a)).
• Legal obligation — where we are required to retain certain records for tax, regulatory, or legal compliance purposes (GDPR Article 6(1)(c)).

4. How We Use Your Data

We use the personal information we collect for the following purposes:

• Provisioning and managing your trial account, lab environments, and course enrolments.
• Communicating with you about your account, including trial reminders, enrolment confirmations, schedule changes, and support responses.
• Sending our monthly newsletter (Ops Wire) and occasional service announcements, but only when you have opted in.
• Analyzing aggregated and anonymized usage data to improve lab scenarios, course content, and platform reliability.
• Measuring website traffic and the performance of our outreach efforts through analytics and conversion tracking.
• Detecting, preventing, and addressing technical issues, abuse, or unauthorized access to our systems.
• Complying with applicable legal, regulatory, and tax obligations.
• Generating invoices and processing payments for enrolled students or their employers.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We never have, and we have no plans to change that position.

5. Third-Party Services

We use a limited number of third-party services to operate our website and measure its performance. These include:

• Google Analytics — used to collect anonymized website traffic data. IP anonymization is enabled, which means your full IP address is never stored by this service. Google Analytics is loaded only after you have provided consent through our cookie banner. No data is transmitted to this service if you decline analytics cookies.
• Google Ads conversion tracking — used to measure whether visitors who arrive through our advertising campaigns go on to start a trial. This tracking pixel is loaded only after you have provided consent through our cookie banner. If you decline marketing cookies, the tracking code is never executed and no data is shared.

Both services operate under their own privacy policies and data processing agreements. We have configured them to minimize data collection and to respect your consent preferences. No analytics or marketing scripts run on this website until you actively accept the relevant cookie category.

We may also use service providers for email delivery, payment processing, and infrastructure hosting. Each provider is bound by contractual obligations to process your data only on our behalf and in accordance with this policy.

6. Cookies

Cookies are small text files stored on your device when you visit our website. We use three categories of cookies:

You can change your cookie preferences at any time by clearing your browser cookies and revisiting our site, which will re-display the consent banner. You may also configure your browser to reject all cookies or to alert you when a cookie is being set. Be aware that disabling necessary cookies may impair your ability to use parts of our website.

7. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, or as required by law. Our specific retention periods are:

After the applicable retention period expires, personal data is securely deleted or irreversibly anonymized. If you request early deletion and we have no legal obligation to retain your data, we will process the deletion within 30 calendar days.

8. Your Rights

Your rights over your personal information depend on where you are located and which legislation applies to you.

Under PIPEDA (Canada)

You have the right to:

• Be informed of the existence, use, and disclosure of your personal information and be given access to that information upon request.
• Challenge the accuracy and completeness of your personal information and have it amended where appropriate.
• Withdraw your consent to the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions.
• File a complaint with us or with the Office of the Privacy Commissioner of Canada if you believe your rights have been violated.

Under the UK GDPR and EU GDPR

If you are located in the United Kingdom or the European Economic Area, you additionally have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data where there is no compelling reason for us to continue processing it (the “right to be forgotten”).
• Restriction of processing — request that we limit how we use your data in certain circumstances.
• Data portability — receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Objection — object to the processing of your personal data where we rely on legitimate interests as the legal basis.
• Automated decision-making — not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not currently engage in automated decision-making of this nature.

To exercise any of these rights, send your request to privacy@pinecrestlabs.ca. We will verify your identity before processing your request and respond within 30 calendar days (or sooner where required by applicable law). There is no fee for exercising your rights, although we reserve the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS 1.2 or higher across all connections.
• Encryption of personal data at rest using AES-256 or equivalent standards.
• Role-based access controls that limit employee access to personal information on a need-to-know basis.
• Regular security assessments and vulnerability scanning of our infrastructure.
• Employee training on data protection obligations and incident response procedures.
• Contractual data protection requirements imposed on all third-party service providers.

While we take these precautions seriously, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to addressing any breach promptly. In the event of a data breach that poses a real risk of significant harm, we will notify affected individuals and the relevant supervisory authorities in accordance with PIPEDA and GDPR timelines.

10. International Transfers

Pinecrest Labs is based in Canada. Your personal information may be processed and stored in Canada or in other jurisdictions where our service providers operate. Canada has been recognized by the European Commission as providing an adequate level of data protection (Commission Decision 2002/2/EC), which means transfers of personal data from the EEA to Canada are permitted without additional safeguards under GDPR Article 45.

Where personal data is transferred to a country that has not received an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or we obtain your explicit consent before the transfer takes place. We conduct transfer impact assessments where necessary to verify that your data receives equivalent protection regardless of where it is processed.

If you are located in the United Kingdom, transfers are governed by the UK GDPR and the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs, as applicable.

11. Complaints

If you are dissatisfied with how we have handled your personal information, we encourage you to contact us first at privacy@pinecrestlabs.ca so that we can attempt to resolve the matter directly.

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority:

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or through a prominent notice on our website.

We encourage you to review this page periodically. Your continued use of our services after changes have been posted constitutes your acceptance of the revised policy. If a change materially affects how we process data you have already provided, we will seek your renewed consent where required by law.

13. Contact

If you have any questions, concerns, or requests related to this Privacy Policy or your personal information, please reach out to us using the contact details below:

For general inquiries not related to privacy, contact hello@pinecrestlabs.ca.