Canadian Privacy Addendum: Plinth Data

Applies to: Canadian data in the Service, meaning information drawn from the Canada Revenue Agency's List of Charities, wherever it is accessed: the /ca pages, the Grants API with jurisdiction=ca, the Ask chat at /analyze, ad-hoc SQL and the Plinth × Claude connector.

Effective: 2 October 2026 · Version: 1.0

This addendum supplements the Privacy Notice, which continues to apply in full. Each section below carries the code of the section of the Privacy Notice it supplements.

B1. What we hold#

In addition to what B1 of the Privacy Notice lists, the Service holds the names, positions and periods of office of the directors and trustees of Canadian registered charities, as the Canada Revenue Agency publishes them from T3010 filings.

Source: the Canada Revenue Agency's List of Charities as published on open.canada.ca. Never the individuals themselves.

The CRA does not publish compensation for a charity's directors and trustees, and neither do we. For a Canadian charity we hold the name, the position, and the start and end dates of office that the charity itself filed.

B3. Why we publish the rest#

The balance described at B3 of the Privacy Notice is struck the same way for a director of a Canadian registered charity as for a US trustee.

Canadian directors and trustees. Two things put these names in the public record, and we rely on both. Section 241(3.2) of the Income Tax Act permits the Canada Revenue Agency to make public a registered charity's information including the names of its directors and trustees and their periods of office, and the CRA does so in the List of Charities. Section 1(c) of the Regulations Specifying Publicly Available Information (SOR/2001-7) made under PIPEDA provides that personal information appearing in a public registry under a statutory authority, collected under that authority, is publicly available information where our collection, use and disclosure relate directly to the purpose for which it appears in the register. That purpose is the transparency of registered charities: who directs a charity, and over what period. It is the purpose we use these names for, and we do not use them for any other.

B5. If you are named#

If you are a director or trustee of a Canadian registered charity, B5 of the Privacy Notice applies to you in the same way and on the same terms. PIPEDA does not give a right to erasure in the way UK and EU law does, and we are not asking you to rely on one: whatever the law obliges, we will suppress your name on request, free, without asking you to justify it, and on the timescale B5 sets. Canadian objections are handled under B5 exactly as UK and EU ones are, and where you would rather put it formally, section 1(c) of SOR/2001-7 makes the register's own purpose the limit of what we may do with your name, and an accuracy or withdrawal request under PIPEDA's principles reaches us at the same address.

Suppression persists. Our corpus rebuilds monthly from new IRS and CRA releases. Where we suppress information about you, we hold your suppression on a list that is applied on every rebuild, so it does not reappear.

B6. Safety#

If publication puts you at risk of harm, say so and mark the email urgent. We suppress first and assess afterwards. This holds wherever you are and whatever record names you, Canadian filings included.

C2. United States#

The public-records exclusion described at C2 of the Privacy Notice is a feature of US state law and has no Canadian equivalent. PIPEDA has no public-records carve-out: SOR/2001-7 makes registry information publicly available, which removes the need for consent and nothing else, and it does so only for uses that relate directly to the purpose the register serves. So nothing in that paragraph is a precedent for how we treat a Canadian director's name, and it is not read across. See C3.

C3. Canada#

Under the Personal Information Protection and Electronic Documents Act you have the right to be told whether we hold personal information about you and to be given access to it, to challenge its accuracy and have it corrected, to know what we use it for and who we disclose it to, to withdraw consent where we rely on consent, and to challenge our compliance with the Act.

Write to support@useplinth.com, the privacy contact for the Service. No charge, no obstacles; we may need to verify identity. We aim to respond within 30 days, which is the period the Act sets.

If you are named in the Service rather than a user of it, Part B of the Privacy Notice is the part that concerns you, and B5 is the route: suppression is free, we will not ask you to justify the request, and it applies on every rebuild so a suppressed name does not reappear.

Where your information is held. The Service runs in the United States, in Google Cloud's us-central region, and website analytics is processed in the United States by Vercel. Canadian personal data is therefore stored and processed outside Canada, by service providers acting for us under contract, and while it is there it is subject to the laws of the United States, including lawful access by US authorities. A4 of the Privacy Notice describes the arrangement in full.

If we have not resolved it. Come to us first if you can. You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376), and where your province has its own commissioner with jurisdiction, to them instead.