Privacy Policy

Tideway is an all-in-one operations platform for freelancers, independent studios, and creative teams. It is operated by Errant Technologies Inc. (“Errant Technologies”, “we”, “us”, or “our”), a company incorporated in British Columbia, Canada, which is the controller of the personal information described below. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have, whether you are visiting our marketing website at tideway.co or using the Tideway application at app.tideway.co (together, the “Service”).

Errant Technologies is based in British Columbia, Canada. Our customers are spread across many countries, so we hold every account to one strict global baseline and apply the additional rights and defaults your own region requires. In practice that means this policy is written to satisfy:

• the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection (FADP);
• Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Law 25, and Canada’s Anti-Spam Legislation (CASL); and
• the California Consumer Privacy Act as amended by the CPRA, and the comparable privacy laws of other US states.

Section 17, Regional privacy disclosures, sets out the rights and notices specific to each of those regimes. Where a regional law gives you more than this policy describes, that law applies.

Tideway holds two different kinds of personal information, and our role differs for each. The distinction decides who answers a privacy request, so it is worth being precise about.

• Your information. The account, billing, and usage information you give us directly. For this information Tideway is the controller (the “business”, under US law): we decide why and how it is handled, and this policy governs it.
• Your business content. The client details, projects, invoices, proposals, notes, files, and other records you enter into Tideway to run your business. This content is yours. For it, Tideway is a processor (a “service provider”): we process it strictly on your behalf and on your documented instructions, only to operate the Service for you. You are the controller, and you are responsible for having the right to provide any personal information about your own clients that it contains (see our Terms of Service).

Because you are the controller of your business content, we offer a Data Processing Agreement covering it, including the EU Standard Contractual Clauses and the UK Addendum for international transfers. It is incorporated into our Terms of Service, and a counter-signed copy is available on request from privacy@tideway.co. If a request reaches us about one of your clients, we forward it to you rather than acting on it ourselves.

a) Information you provide

• Waitlist: your email address, plus the page or campaign the signup came from, so we can tell you when Tideway is ready and understand which messaging resonated.
• Account registration: your name, email address, and password or social sign-in identity, handled by our authentication provider. You may also add profile details such as a photo, business name, tax and invoicing details, and preferences.
• Country and region: the country (and, in the US, the state) you tell us you operate from. We use it to decide which privacy regime and which consent model apply to your account, and to set currency and tax defaults. You can correct it at any time in Settings → Data & privacy.
• Business content: information you enter into Tideway about your projects, clients, contacts, invoices, proposals, scope agreements, tasks, time entries, expenses, notes, calendar events, and files you upload. This content is yours.
• Payment information: when you subscribe to a paid plan, our payment processor Stripe collects your billing details and card information directly. Tideway does not see or store full card numbers. See Payments for what happens when your own clients pay you through Tideway.
• Communications and feedback: messages, support requests, bug reports, feature votes, and product feedback you send us, including anything you choose to include in them. A support request you file may be turned into a work item in our issue tracker so it can be fixed and tracked to completion.
• Optional imports: if you choose to import contacts (for example from a CSV file or, if you connect it, Google Contacts), we collect the fields you import, such as names, emails, phone numbers, companies, and photos. Imports are always initiated by you, and connecting Google Contacts requires your explicit consent at Google, which you can revoke there at any time.

b) Information collected automatically

• Product analytics: pages viewed, features used, clicks, and similar interaction events, collected through PostHog to help us understand how the Service is used and improve it. On our marketing website, PostHog may also record session replays and heatmaps of anonymized interactions. In the application, PostHog is used for feature analytics only, with no session replay. These load only where the consent rules in Cookies & tracking allow it.
• Web analytics: aggregate traffic and engagement on our marketing website, measured through Google Analytics, which helps us understand where visitors come from and how they move through the site. Consent-gated on the same terms.
• Performance and error data: load times, Web Vitals, stack traces, and the request context around an error, collected through Vercel Speed Insights and Sentry, so we can keep the Service fast and fix what breaks.
• Session and presence records. While you are signed in, the application records a session row containing your account and user id, the page you are on, your browser’s user-agent string, a coarse location derived from our hosting provider’s edge network (country, region, city, and an approximate latitude and longitude), and a salted, truncated hash of your IP address. We do not store the IP address itself, and if the hashing secret is ever unavailable the field is left empty rather than stored unprotected. This powers the live workspace presence view and coarse abuse signals.
• Log data: IP address, browser type, device and operating system, and referring URL, retained by our hosting provider for security, abuse prevention, and operations. We also record IP addresses briefly to rate-limit signups and other sensitive endpoints against abuse.
• Email delivery logs. Every message the Service sends is logged with its status, category, subject line, the sending account, and a partially masked recipient address (for example j•••@domain). We use these logs to diagnose delivery problems and to detect misuse of our sending domain. They are staff-only operational records and are never shown to another customer.

c) Information about the people you share with

Some features create records about your clients and other recipients. These sit inside your business content, so you remain the controller and we act on your instructions:

• Open tracking on links you share. When a client first opens an invoice pay page, a proposal, a scope agreement, or a client portal you sent them, we record the time so you can see whether it was seen. We record the first open only.
• Electronic signature evidence. When a client signs a proposal or a scope agreement, or accepts payment terms, we retain the typed name, the email address the one-time code was delivered to and verified against, the signing timestamp, the signer’s IP address, and their browser user-agent string. This is the audit trail that makes the signature meaningful, so it is retained for as long as the signed record is.
• One-time codes. To confirm a signer is who they say they are, we email a short-lived code to the address on file and keep a record of the attempt, including the number of tries, as anti-fraud evidence.

d) Cookies & local storage

Cookies. In the application, our authentication provider sets the functional cookies required to keep you signed in. Analytics providers set their own cookies or identifiers where you have allowed them. We do not use advertising cookies, we do not run ad networks, and we do not sell your information to advertisers. Full detail, including the consent model that applies in your region, is in Cookies & tracking.

Local storage. Both the website and the application store data in your browser using localStorage. Beyond interface preferences such as your theme, view density, and which version of a page you were shown, the application keeps a working copy of your workspace on your own device, so it stays fast and keeps working through a dropped connection. That copy can include your invoices, your business and invoicing profile, your billable and internal cost rates, your invoice logo, and a copy of your contact, project, and task records. Your privacy choices are stored there too, so they survive a sign out.

This local copy lives only in that browser profile. It is never shared with a third party, and it is cleared when you delete your Tideway account. Signing out does not remove it, so if you use Tideway on a shared or public computer, clear your browser data when you are finished.

If you are in the EEA, the UK, or Switzerland, we must have a lawful basis for every use of your personal information. Ours are:

• Performance of a contract — creating and running your account, keeping you signed in, storing and displaying your workspace, sending the transactional messages the Service exists to send, taking payment, and providing support.
• Legitimate interests — keeping the Service secure and available, preventing fraud and abuse of our platform and our sending domain, diagnosing errors, understanding aggregate product usage where consent is not required, and telling existing customers about changes to a product they already use. We balance each of these against your rights, and you can object at any time (see Your privacy rights).
• Consent — non-essential analytics and marketing cookies where your region requires prior opt-in, marketing email, and the optional Improve Tideway AI setting. You can withdraw consent at any time, which does not affect processing already carried out.
• Legal obligation — keeping invoicing, tax, and accounting records, and responding to lawful requests from authorities.

For your business content we do not choose a basis at all: you do, as the controller, and we process it only on your instructions.

• To provide, operate, secure, and improve the Service
• To create and manage your account and keep you signed in
• To notify you when Tideway launches or when your account is ready (waitlist)
• To process subscriptions and payments through Stripe
• To send transactional messages you have asked for, such as invoices you send to your clients, payment reminders, portal invitations, signing codes, and the notification digest you have configured
• To tell you about things that affect your account, such as a trial ending, a failed payment, or files scheduled for deletion. These are service messages, not marketing, and they are sent even if you have opted out of marketing email
• To respond to your inquiries, support requests, and feedback
• To monitor performance, diagnose problems, and prevent fraud or abuse (see Trust, safety & abuse prevention)
• To comply with our legal obligations

We will not use your email address for marketing communications without your consent. When you join our waitlist we confirm your email through a double opt-in, every marketing message carries a one-click unsubscribe, and we honor it immediately, in accordance with CASL and the equivalent rules elsewhere.

We do not use your business content to train AI models, we do not sell it, and we do not use it for advertising. We do not make decisions about you by automated means that produce legal or similarly significant effects.

Money moves through Tideway in two different directions, and the handling differs.

• You paying us. Subscriptions are billed through Stripe, which collects your billing name, email, address, and card details directly. Tideway receives only the subscription status and a masked reference. We never see or store full card numbers.
• Your clients paying you. If you switch on online invoice payment, you connect your own Stripe account and your clients pay you directly. The card details are entered on Stripe’s own payment form and never touch Tideway’s servers. Tideway is not a payment processor, does not hold your money, and takes no cut of it. We record what we need to keep your invoice ledger correct: the amount, currency, status, payment timestamps, and Stripe’s identifiers for the charge. When you connect that account, we also record your acceptance of Stripe’s connected account terms, including the time, your IP address, and your browser user-agent string, because that acceptance has to be evidenced.

Stripe is an independent controller for the payment data it collects, and its own privacy policy governs that. Your clients’ payment details are between them and Stripe.

Tideway includes AI-assisted features, such as Tideway AI and automated drafting and insights, built directly into the product. No setup or API key is required to use them.

When you use an AI feature, the relevant content needed to answer your request (for example the project, client, or financial data in view) is processed through Tideway’s servers and sent to our AI model provider, Google (Gemini models), to generate the response. We meter this usage for billing and abuse prevention, and we keep a record of the request for security and accounting. Your content is never sold, is never used to serve advertising, and is not used to train the AI provider’s models.

Rating an AI answer. Every AI answer in the app carries a thumbs-up and thumbs-down control. Rating one is voluntary, and nothing is sent unless you press it. When you do, we record your rating, the optional reason you pick, any comment you write, and which feature produced the answer, so we can measure where our AI performs badly and fix it. We do not store the answer itself, or the request behind it, unless you have turned on Improve Tideway AI in Settings → Data & privacy, which is off unless you switch it on. With it on, we also keep a copy of the request and the answer you rated and may use it to evaluate and improve Tideway’s own AI features. Even then, it is never sent to our AI provider to train its models, and never sold or used for advertising. You can turn the setting off at any time, which stops any further content being kept.

AI output can be inaccurate or incomplete and should not be relied on as legal, financial, or tax advice. AI features are optional. You can turn Tideway AI off at any time, and the rest of Tideway works exactly the same.

Every studio on Tideway sends its client mail through infrastructure we share, so one account abusing it damages everyone else’s deliverability. We therefore operate abuse controls, and you should know what they involve.

• What we look at. Aggregate signals about an account’s own activity: how much mail it sends, how much of it goes to recipients never seen before, how much bounces or is rejected, upload volume, AI usage, and signup patterns. We do not read your notes, files, or client records to do this.
• Ranking is automated; decisions are not. Those signals produce a risk score that decides which accounts a person looks at first. No account is restricted, suspended, or terminated automatically. A member of our team reviews the account and makes the call, and every action is recorded with who took it and why.
• Graduated controls. Where action is warranted we can pause a specific capability, such as outbound email, public share links, uploads, or AI, rather than disabling the whole workspace. If your account is restricted you will see it in the app, with a route to contact us and appeal.
• Records that outlive the account. Abuse records are kept in an append-only log that is deliberately not linked to the account row, so it survives the account being deleted. Otherwise anyone could erase the evidence of what they did by deleting their workspace and signing up again. The log holds only the workspace name as it was at the time, the action taken, who took it, and a short reason. It never contains your business content, your files, or your clients’ records. See Data retention.

If you believe a restriction was applied to your account in error, email privacy@tideway.co and a person will review it.

Your account and business content are stored on managed cloud infrastructure run by specialist providers: an identity and authentication provider, a managed PostgreSQL database for your account and business records, and an object-storage provider for the files you upload. We name each of them, and say exactly what they process, on our Sub-processors page.

We protect that data with a layered approach:

• Per-account isolation. Every record is scoped to your account and enforced at the database level with row-level security, so one customer’s records can never be read by another. The application refuses to serve tenant data at all if that enforcement is not active. Files you upload are held in separate, private object storage that is not publicly addressable — they are reached only through that same account-scoped lookup, and served over links that expire.
• Encrypted in transit and at rest. Your data is encrypted on the wire and encrypted where it is stored, across our database, file storage, and backups.
• Backed up, and proven restorable. We back up the database every six hours, and your files and sign-in identity every day, into encrypted storage held separately from the live system and locked so that neither the application nor a stolen production credential can alter or erase what is already there. We restore from those backups on a recurring schedule and check the result, because a backup nobody has restored is a guess. Backups are kept for a bounded period and then expire, as described under Data retention.
• Least privilege. The credential that serves your requests cannot bypass isolation or reach the administrative controls, and our internal support tooling runs on a separate, restricted credential. Staff access to production data is limited to what is needed to operate the Service and is logged.
• Never sold, never used to train an outside AI. We do not sell your data or use it to serve advertising, and your content is never used to train our AI provider’s models. AI features send only the data needed to answer the request you make. If you rate an AI answer and have Improve Tideway AI switched on, we keep that request and answer to improve our own features, as described under AI features above.
• Yours to export or erase. You can export a full copy of your data at any time, and you can permanently delete your account and all of its data yourself from Settings.

We implement reasonable technical and organizational safeguards to protect personal information against unauthorized access, disclosure, or loss, including access controls, encryption, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Tideway is operated from Canada. Our database, file storage, hosting, and most of our providers process data in the United States; our marketing email provider processes data in the European Union; and our file storage and hosting may serve content from a global edge network. The Sub-processors page states the region for each provider.

That means using the Service involves transferring personal information across borders, including out of the EEA, the UK, and Switzerland. We rely on the following safeguards rather than on your consent alone:

• Canada. Transfers from the EEA to Errant Technologies in Canada are covered by the European Commission’s adequacy decision for Canadian commercial organizations subject to PIPEDA.
• United States. Onward transfers to our US providers are covered by the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914), together with the UK International Data Transfer Addendum for UK data and the equivalent recognition for Swiss data. Where a provider is certified under the EU-U.S. Data Privacy Framework, that certification applies in addition.
• Supplementary measures. Data is encrypted in transit and at rest, per-account isolation is enforced in the database, and we assess each provider’s commitments before we start using it.

Data residency. We do not currently offer EU-only or UK-only storage. GDPR does not require it where a valid transfer safeguard is in place, and ours is described above. If your organization has a residency requirement, contact privacy@tideway.co before you sign up so we can tell you honestly whether we can meet it. A copy of our transfer documentation is available on request.

We share personal information only with the trusted service providers who process data on our behalf to run the Service. We do not sell, rent, or trade your personal information, we do not share it for cross-context behavioral advertising, and we do not share it with third parties for their own marketing.

They fall into these categories:

• Identity and authentication
• Database hosting for your account, business, and waitlist records
• File storage and content delivery
• Application hosting, security, and performance monitoring
• Product and web analytics, including session replay on the marketing website
• Error monitoring
• Email delivery, both transactional (invoices, reminders, portal invitations, signing codes) and marketing (waitlist and product announcements)
• AI model processing, for the AI features described above
• Payment processing and subscription billing
• Issue tracking, for support requests escalated to our engineering queue

Our Sub-processors page lists every one of these providers by name, what it processes, where it stores that data, and the safeguard covering the transfer. It is the authoritative list, and we update it before we add a new provider. Customers under our Data Processing Agreement can ask to be notified of changes.

Each provider is contractually bound to protect your information and use it only to provide services to us. We may also disclose information if required by law, to enforce our Terms of Service, or to protect the rights, safety, or property of Tideway, our users, or the public. If Tideway is ever involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, and we will notify you before it becomes subject to a different privacy policy.

We use four categories of cookie and similar technology, and only the first is unavoidable.

• Strictly necessary. The session cookies our authentication provider sets to keep you signed in, security and rate-limiting protections, and the record of the privacy choices you made. These cannot be switched off while you use the Service.
• Analytics. PostHog, and Google Analytics on our marketing site only, used to understand which features and pages get used.
• Performance. Vercel Speed Insights and Sentry error monitoring, used to measure load times and capture crashes.
• Marketing. Enrolment in our product-update email, and the attribution of a signup to the campaign that produced it.

Which consent model applies to you. We resolve your region from the country you declare and the coarse location our hosting provider’s edge network reports, and we take the stricter of the two, so a mis-declaration can never weaken your protection.

• EEA, UK, and Canada — opt-in. Nothing outside the strictly necessary category runs until you make a choice. Refusing is exactly as easy as accepting, and the banner does not resurface every visit once you have decided.
• United States and the rest of the world — opt-out. Analytics runs by default, and you can turn it off from the banner or from Settings → Data & privacy at any time.
• Global Privacy Control. If your browser sends a GPC signal we treat it as a binding opt-out everywhere, in every region, and we record it rather than prompting you.

You can revisit your choices at any time: on the marketing site from the Privacy choices link in the footer, and in the app from Settings → Data & privacy. You can also block or clear cookies in your browser, or install the Google Analytics opt-out browser add-on.

You can control most of the optional data we collect:

• Analytics and performance: in the app, the Settings → Data & privacy screen lets you turn usage analytics and performance data collection on or off. Turning off usage analytics disables the product-analytics tools; turning off performance data disables performance and error monitoring. On the marketing site, the privacy banner and the Privacy choices link in the footer control the analytics that run there.
• AI: rating an AI answer is always your choice, and the same Settings → Data & privacy screen holds the Improve Tideway AI switch, which decides whether a rated request and answer are kept for us to learn from. It is off unless you turn it on.
• Marketing email: every waitlist and announcement email includes a one-click unsubscribe link, and we honor it immediately. You can also turn marketing off in Settings, which we push through to our email provider rather than only recording it locally.
• Notification email: the digest and its send time are configurable in Settings, and every digest carries an unsubscribe link.
• Your country: correcting it in Settings changes which consent model applies to you.

Some information, such as security logs, the functional cookies needed to sign in, and the service messages that warn you about your account, is required to operate the Service and cannot be turned off while you use it.

We keep personal information only as long as we need it for the purpose it was collected for, or as long as the law requires. In practice:

• Your account and business content — for as long as your account is active. When you delete something inside Tideway it moves to a recoverable state and is then permanently removed on a rolling basis (files in Trash are typically purged within 30 days).
• Files on a lapsed or cancelled plan — we email you a warning first. Only after that warning has gone out, and a further period has passed, are the files moved to Trash, and only then are they permanently deleted. If the warning cannot be sent, nothing is deleted.
• Signature and payment-terms evidence — for as long as the signed record exists, because a signature without its audit trail is not evidence of anything. It is erased when you delete your account or the underlying record.
• Backups — we keep encrypted backups so the Service can be restored after a failure, and they are the reason deletion is not instantaneous everywhere. A copy of something you deleted can remain in a backup until that backup itself expires, which happens within 35 days of it being taken. Backups are held apart from the running Service and are never used to bring deleted data back into your account.
• Waitlist records — until you unsubscribe or ask us to remove them.
• Operational logs (email delivery logs with masked recipients, session and presence records, security and rate-limit records) — kept for as long as they are useful for security, deliverability, and diagnosis, and reviewed periodically so they are not kept longer than that.
• Abuse and enforcement records — kept for as long as necessary to prevent repeat abuse of the Service, which means they survive the deletion of the account they concern. They contain only the workspace name at the time, the action, the reason, and who took it, never your business content. This is the one exception to the deletion promise below, and it exists because evidence a wrongdoer can delete is not evidence.
• A record that a deletion happened — we keep a minimal, no-content ledger entry so we can demonstrate that an erasure request was carried out.

You can permanently delete your account at any time from Settings → Account in the app. When you confirm deletion, we immediately and irreversibly erase your account and all associated records from our database, delete your uploaded files from storage, and delete your sign-in identity, so your data cannot be recovered and the same credentials cannot sign back in. Subject to the backup, abuse-record, and legal exceptions above, nothing is retained. Because deletion is permanent, we prompt you to export your data first.

Wherever you live, you can ask us to do the following with the personal information we hold about you as a controller:

• Access a copy of it, and information about how we use it
• Correct anything inaccurate or incomplete
• Delete it (Tideway offers this as a self-service, immediate hard delete)
• Export it in a portable format (full and per-entity CSV export, any time, from Settings)
• Restrict or object to a particular use, including any use based on our legitimate interests, and opt out of marketing outright
• Withdraw consent you previously gave, without affecting what was done before you withdrew it
• Not be discriminated against for exercising any of these rights

How to exercise them. Most are self-service: export, correction, consent toggles, and account deletion all live in Settings. For anything else, email privacy@tideway.co. We respond within 30 days, and we will tell you if we need an extension the law allows. We may need to verify your identity against the email address on the account before we act, and we will not charge you unless a request is manifestly unfounded or excessive.

Requests about your clients. If your request concerns personal information about one of your own clients that you entered into Tideway, the business that collected it is the controller, and that may be you. Send it to them; if it reaches us first, we forward it and assist them in answering it, as our Data Processing Agreement requires.

a) EEA, United Kingdom & Switzerland

Tideway is the controller for the information described in this policy, contactable at privacy@tideway.co. Our legal bases are set out in Our legal bases, and our transfer safeguards in Where your data is processed. Providing your account information is necessary to enter into and perform our contract with you; without it we cannot provide the Service.

In addition to the rights above you have the right to data portability and the right to lodge a complaint with a supervisory authority in the country where you live or work, or where you believe an infringement occurred. In the UK that is the Information Commissioner’s Office. We would ask you to come to us first so we can try to put it right.

b) Canada, including Quebec

We handle personal information in accordance with PIPEDA and, for Quebec residents, Quebec’s Law 25. Our privacy officer is responsible for our compliance and can be reached at privacy@tideway.co or at the postal address in Contact us. Privacy-protective settings are on by default, and we treat Canadian accounts under the same prior-consent model as the EEA.

Personal information is stored and processed outside Quebec and outside Canada, principally in the United States, as described in Where your data is processed. We assess each transfer before it begins. You may request the results of that assessment, ask for your information in a structured, commonly used technological format, and ask us to stop disseminating information or to de-index a link where the law allows it. We do not use your information to render a decision based exclusively on automated processing; where automation ranks something for review, a person makes the decision, and you may ask us for the reasons behind it. You also have the right to complain to the Office of the Privacy Commissioner of Canada or to the Commission d’accès à l’information du Québec.

c) United States, including California

Over the past 12 months we have collected the categories of personal information described in Information we collect: identifiers (name, email, account and device identifiers, IP address), commercial information (subscription and payment records), internet or network activity (usage, analytics, and error data), coarse geolocation, professional information (your business details), and the content you choose to store. We collect it from you, from your use of the Service, and from our service providers. We use it for the business purposes listed in How we use your information, and we disclose it to the service providers listed on our Sub-processors page. We retain it as described in Data retention.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months, and we do not knowingly do either for anyone under 16. We do not use or disclose sensitive personal information for any purpose that would require an option to limit it.

If you are a resident of California, Colorado, Connecticut, Virginia, Texas, Oregon, or another state with a comprehensive privacy law, you may exercise the rights in Your privacy rights, including the right to know, delete, correct, and obtain a portable copy, and the right to opt out of targeted advertising, sale, and profiling with legal effects (none of which we do). We honor Global Privacy Control as an opt-out signal. You may use an authorized agent by sending us written proof of their authority. If we deny a request you may appeal it by replying to our decision, and if we deny the appeal we will tell you how to complain to your state attorney general.

If a security breach affects your personal information, we will investigate promptly, take steps to contain it, and notify you and the relevant regulators where the law requires it and without undue delay. Where Errant Technologies acts as your processor, we will notify you without undue delay after becoming aware of a breach affecting your business content, and give you the information you need to make your own notifications. If you believe you have found a vulnerability in Tideway, please report it to privacy@tideway.co rather than disclosing it publicly, and we will not pursue good-faith research.

Tideway is a business tool and is not directed at individuals under the age of 16. We do not knowingly collect personal information from children, and we do not knowingly sell or share it. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will revise the “last updated” date at the top of this page. For material changes, we will notify registered users by email before the change takes effect, and where the law requires your consent to the change we will ask for it rather than assume it. Continued use of Tideway after changes take effect constitutes acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy or our privacy practices, or you want to exercise a right, contact our privacy officer at:

Errant Technologies Inc.
422 Richards St, Suite 170
Vancouver, BC V6B 2Z4
Canada
privacy@tideway.co

You also have the right to complain to a data protection authority: the Office of the Privacy Commissioner of Canada or your provincial commissioner (including the Commission d’accès à l’information du Québec), a supervisory authority in the EEA, the UK Information Commissioner’s Office, or your state attorney general in the United States.