Privacy Policy

TrainGrid is a training management and compliance tracking platform operated by Solvesoft Corp, based in Milton, Ontario, Canada. For anything in this policy, contact ahmed@solvesoftcorp.com.

Account data. When you create an account we collect your name, work email and password (stored as a salted hash — we never see it).

Your organization's records. Your organization uploads and manages employee and training records — names, departments, positions, course completions, certificates and related documents. Your organization owns and controls this data; TrainGrid processes it only to provide the service, on your organization's instructions.

Usage data. We keep an append-only audit log of actions taken inside your organization (who changed what, when) — a compliance feature that also protects your records' integrity. We do not use third-party advertising trackers.

All customer data is stored in Canada (Toronto region, ca-central-1) on Supabase-managed PostgreSQL, encrypted in transit (TLS) and at rest. Uploaded files (certificates, sign-in sheets) are stored in the same region with organization-scoped access controls.

Every organization's data is isolated at the database level with row-level security — not just in application code. Access requires authenticated membership in your organization, with role-based permissions on every action. All changes are captured in an append-only audit log.

If we ever become aware of a breach affecting your data, we will notify your organization's administrators without undue delay, consistent with PIPEDA's breach-reporting requirements.

Only to provide, secure and improve the service: authenticating you, displaying your organization's records, sending the notification emails your organization configures (due-soon, overdue and expiring-cert reminders), and responding to support requests.

We never sell personal information, never use your records for advertising, and never train machine-learning models on your data.

We use a small set of subprocessors to run TrainGrid:

Supabase (database, authentication and file storage — Canada region) · Vercel (application hosting) · Resend (transactional email delivery). Each processes data only as needed to provide their service to us.

Your data is retained for as long as your organization has an account. You can export everything as CSV at any time from inside the app. When an organization is deleted, its records are permanently removed from production systems within 30 days, and from backups on the backup rotation schedule (up to 35 additional days).

Under PIPEDA and applicable provincial privacy laws you may request access to, correction of, or deletion of your personal information. Employees whose records are managed by their employer in TrainGrid should direct requests to their employer (the data controller); we will support every such request. For anything else, email ahmed@solvesoftcorp.com.

We use only the cookies required to keep you signed in (authentication session). No advertising or cross-site tracking cookies.

If we make material changes we will notify organization administrators by email and update the effective date above. Questions? See our contact page.