Privacy Policy

River Valley Concrete Ltd. (“River Valley Concrete”, “we”, “us”) is an Alberta-based concrete contractor that operates the website, booking system and customer portal at rivervalleyconcrete.ca. This Privacy Policy explains what personal information we collect, how we use it, and the choices you have. It is written in plain language so you can actually read it.

We collect personal information in three ways:

• Information you give us — when you submit the contact form, request a quote, book a consult, or upload files to your customer portal: your name, email address, phone number, project address, project details, and any photos or documents you choose to share.
• Information we receive when you sign in with Google — if you choose to sign in with Google, we receive your name, email address and profile picture from Google for the purpose of identifying you.
• Information we collect automatically — basic technical data (IP address, browser type, pages viewed, timestamps) via standard server logs, Cloudflare analytics, and PostHog (a product-analytics service we use to understand which pages visitors find useful and to record anonymised session replays of public pages). PostHog masks all form inputs by default and is not loaded on the admin portal. We do not use third-party advertising cookies or sell tracking data.

River Valley Concrete uses Google APIs to deliver booking functionality for the business owner, Dean. The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we request the following Google OAuth scope only on Dean's own Google Workspace account:

• https://www.googleapis.com/auth/calendar.events — read and write events on Dean's primary Google Calendar.

Why we need it: when a customer books a phone consult, on-site quote, reseal assessment or commercial consult through the website, we automatically create the corresponding event on Dean's calendar with the customer's contact details, project notes, and a reminder set to fire 15 minutes before phone calls or 1 hour before in-person visits. We also read free/busy information so the public booking page only offers slots when Dean is actually available.

How we use it: the data accessed through this scope is used exclusively to create, read, update and display calendar events relevant to River Valley Concrete bookings. We do not use Google user data to develop, improve or train any generalised or third-party AI/ML models. We do not sell, rent or transfer this data. We do not use this data for advertising. We do not allow humans to read this data except (a) Dean himself, (b) with your explicit consent for support, (c) for security and abuse investigation, (d) to comply with applicable law, or (e) in aggregated and anonymised form for internal analytics.

How to revoke: Dean can disconnect Google Calendar at any time from the admin Integrations page, which deletes our stored OAuth refresh token. You can also revoke access at any time at myaccount.google.com/permissions.

We use the personal information you give us to:

• respond to contact form messages and quote requests
• schedule, confirm, reschedule or cancel bookings
• prepare and send estimates, invoices and payment receipts
• store the files you upload to your customer portal
• send transactional emails (booking confirmations, invoice notifications, payment receipts) — we do not send marketing emails without explicit opt-in
• maintain business records as required by Canadian tax law (six years minimum, indefinitely for property-related records, in accordance with Canada Revenue Agency requirements)

We use a small set of trusted service providers to operate the platform. They process personal information only on our instructions:

• Cloudflare — DNS, web hosting, database (D1), file storage (R2). Data is stored in Cloudflare's North American infrastructure.
• Google Workspace — email hosting and, when authorized by Dean, Google Calendar (see Section 3).
• Resend — transactional email delivery (booking confirmations, invoices, etc).
• Stripe — credit card and online payment processing for invoices. Card numbers are entered directly with Stripe and never reach our servers.
• Printful — fulfillment for any merchandise purchased through our shop.

We do not sell your personal information to anyone, and we do not transfer it to advertising networks.

Bookings, estimates, invoices, payments and customer communications are retained for a minimum of six (6) years to comply with Canada Revenue Agency requirements. Property-related records may be retained indefinitely. Files you upload to your customer portal are retained while your account is active and for one (1) year after the project is complete. You can request deletion at any time using the contact details below; we will honour requests except where law requires us to retain records.

You have the right to access, correct or delete the personal information we hold about you, and to withdraw consent for processing. To exercise any of these rights, contact us at info@rivervalleyconcrete.ca. We will respond within thirty (30) days. Alberta residents may also contact the Office of the Information and Privacy Commissioner of Alberta.

We use industry-standard practices to protect your information: TLS for all traffic, encrypted storage at rest, role-based access control, scoped OAuth tokens, and Cloudflare's edge security (WAF, bot mitigation). No system is perfectly secure — if a breach affects your data, we will notify you and the Alberta Privacy Commissioner as required by law.

The Service is intended for adults arranging concrete services. We do not knowingly collect personal information from anyone under the age of 18.

We may update this policy from time to time. The “Last updated” date at the top reflects the current version. Material changes will be announced on this page.

River Valley Concrete Ltd.
Sherwood Park, Alberta, Canada
Phone: 780-975-3527
Email: info@rivervalleyconcrete.ca