Privacy Policy

Last updated: March 15, 2026

DriftWest Labs is operated by Nimpact Environmental Ltd, a Canadian company. This policy explains what data we collect through driftwest.xyz and its services, how we use it, and what rights you have under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

We wrote this to be readable, not to bury things in legalese. If anything is unclear, just ask us.

1. What We Collect

Visitor Analytics

• IP address and approximate geographic location (country/region level)
• Pages visited, referral source, and visit timestamps
• Browser and device type

AlignEQ Quiz

• Quiz responses and scores
• Email address (if you purchase a premium report)

MCP API

• API keys and associated account information
• API usage logs (endpoints called, timestamps, request counts)

EMF Sensor System

• Environmental sensor readings (electromagnetic field data, temperature, humidity)
• No personal data is collected through the EMF system

2. How We Use Your Data

• To provide and improve the services you use
• To understand how visitors interact with our site (analytics)
• To deliver quiz results and premium reports
• To manage API access and monitor usage
• To troubleshoot issues and maintain service reliability

We do not sell your data. We do not share it with third parties for marketing purposes.

3. Payment Processing

All payments are processed by Stripe. We never see, store, or have access to your credit card number or full payment details. Stripe handles all card data in compliance with PCI-DSS standards. We only receive confirmation of payment status and basic transaction details (amount, date, product purchased).

4. Cookies

We use session cookies only to keep you logged in and maintain your preferences during a visit. We do not use third-party tracking cookies, advertising pixels, or cross-site tracking of any kind.

5. Data Retention

• Visitor analytics: retained for 90 days, then automatically deleted
• Quiz results: retained indefinitely (so you can revisit your results)
• API keys and usage logs: retained until you delete your account

You can request early deletion of any of your data at any time.

6. Where Your Data Is Stored

All data is stored on servers located in Canada. We do not transfer personal data outside of Canada except through Stripe's payment processing infrastructure, which operates under its own privacy and data protection policies.

7. Your Rights Under PIPEDA

Under Canadian privacy law, you have the right to:

• Access the personal information we hold about you
• Correct any inaccurate information
• Delete your personal data (subject to any legal obligations we may have to retain certain records)
• Withdraw consent for data collection going forward

To exercise any of these rights, email us at info@nimpact.ca. We will respond within 30 days.

8. Children's Privacy

Our services are not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

9. Security Practices

We take the security of your data seriously. Our systems undergo regular security audits covering payment flow integrity, access control, data isolation, and vulnerability assessment. Specifically:

• All payment processing is handled by Stripe with server-side verification — we never store card details
• Sensitive files and source code are blocked from public access via server-level rules
• API endpoints require authentication and are rate-limited to prevent abuse
• User data is isolated — users can only access their own reports and account information
• Promo codes and payment sessions are protected against replay and race-condition attacks
• Nightly encrypted backups ensure data resilience

Last security audit: March 2026.

10. Changes to This Policy

If we make significant changes to this policy, we will post a notice on driftwest.xyz and update the "Last updated" date at the top of this page. For changes that materially affect how we handle your data, we will make reasonable efforts to notify affected users by email where possible.