Privacy Policy

1. Who We Are

Natural Alternatives is a business based in Ontario, Canada. We develop and sell compliance software and workspace tools for Ontario contractors and employers. For all privacy inquiries, contact us at [email protected].

Natural Alternatives is the organization responsible for personal information collected through this website and through the delivery of our products.

2. What Personal Information We Collect

We collect only the personal information necessary to deliver our products and services. This may include:

Information you provide directly

• Name and email address — collected when you download a free resource (e.g., the Ontario Contractor Compliance Playbook) or contact us
• Business name — optionally collected on lead capture forms
• Payment information — collected by Stripe, our payment processor, when you make a purchase. We do not store your credit card number. Stripe is PCI-DSS Level 1 compliant.
• Notion account email — collected when we provision your OCOS™ workspace, to add you as a guest in Notion

Information collected automatically

• Cloudflare analytics — aggregated, anonymized traffic data (page views, referral sources). No individual-level tracking. No cookies placed by us for advertising purposes.
• Fleet Logbook app data — all data entered into the NAC OS Fleet Logbook is stored exclusively in your own browser's local storage on your device. This data is never transmitted to Natural Alternatives' servers. We have no access to it.

Information we do not collect

• We do not collect sensitive personal information such as SIN, health information, financial account numbers, or government ID numbers.
• We do not use advertising pixels, tracking cookies, or third-party behavioral analytics on this website.

3. Why We Collect Personal Information

We collect and use personal information for the following purposes:

• Fulfillment — to deliver purchased products (license keys, Notion workspace access)
• Support — to respond to questions and troubleshoot product issues
• Commercial electronic messages — to send product updates and marketing emails to individuals who have provided express consent under CASL
• Renewal reminders — to notify subscribers of upcoming license renewals (this is a transactional communication and does not require separate CASL consent)
• Legal and accounting obligations — to maintain business records as required under the Income Tax Act, Excise Tax Act (HST), and applicable Ontario legislation

We do not use personal information for any purpose other than those listed above without your consent.

4. Legal Basis and Consent

Under PIPEDA, we rely on your knowledge and consent to collect, use, and disclose personal information. Consent may be express (e.g., checking a consent box on a form) or implied (e.g., providing your email address when making a purchase, in the context of receiving order confirmation and transactional emails).

For commercial electronic messages (marketing emails), we rely on express consent obtained at the point of sign-up, as required by CASL. Each marketing email includes an unsubscribe mechanism. You may withdraw consent at any time by clicking "Unsubscribe" in any email or by emailing [email protected].

Withdrawing consent to receive marketing emails does not affect your ability to receive transactional emails related to products you have purchased.

5. Disclosure to Third Parties

We do not sell, rent, or trade your personal information. We share information only with service providers who assist us in delivering our products, and only to the extent necessary:

• Stripe, Inc. — payment processing. Stripe's privacy policy is available at stripe.com/privacy.
• Notion Labs, Inc. — workspace delivery for OCOS™ products. Your email address is used to add you as a guest to your Notion workspace. Notion's privacy policy is available at notion.so/privacy.
• Formspree, Inc. — lead capture form processing. Email addresses submitted through forms on this website are received by Formspree before being forwarded to us. Formspree's privacy policy is available at formspree.io/legal/privacy-policy.
• Make (Celonis SE) — workflow automation for license key delivery and renewal reminders. Make processes your name and email in transit to deliver automated emails.
• Cloudflare, Inc. — website hosting, CDN, and DDoS protection. Cloudflare processes network-level data (IP addresses) as part of its service.

All service providers are required to handle personal information in accordance with applicable privacy law and are contractually prohibited from using your information for any purpose other than providing services to Natural Alternatives.

6. Retention

We retain personal information only as long as necessary for the purposes for which it was collected:

• Purchase records — retained for a minimum of seven (7) years as required by the Income Tax Act for CRA purposes
• Email subscribers — retained until you unsubscribe or request deletion
• Support correspondence — retained for two (2) years after the last interaction
• Fleet Logbook data — stored locally on your device; we have no copy and no retention period applies on our end

7. Your Rights Under PIPEDA

You have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that inaccurate personal information be corrected
• Withdrawal of consent — withdraw consent to the collection, use, or disclosure of your personal information, subject to legal and contractual restrictions
• Complaint — lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca if you believe we have mishandled your personal information

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Security

We implement security measures appropriate to the sensitivity of the personal information we hold. These include TLS encryption for all data transmitted through this website (enforced by Cloudflare), limited access to personal data within our organization, and the use of reputable, security-audited third-party service providers.

No method of transmission over the internet is 100% secure. If you have security concerns, contact us immediately at [email protected].

9. Cookies

This website is hosted on Cloudflare, which may set functional cookies necessary for security and performance (e.g., the __cf_bm bot management cookie). These are strictly necessary cookies. We do not use advertising cookies, tracking pixels, or analytics cookies that identify individual users.

10. Children's Privacy

Our products and services are directed exclusively at business users. We do not knowingly collect personal information from individuals under the age of 18.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicat