Sign in
Privacy

Privacy Policy

How Campix collects, uses, and safeguards the information you entrust to us.

Last updated: October 12, 2026

1. Introduction

Campix Inc. ("Campix," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our camp management platform and services.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide to us:

  • Account information: Name, email address, and password for authentication
  • Organization details: Name, address, timezone, logo, public slug, and branding preferences
  • Program information: Program names, descriptions, dates, times, capacity, fees, and age requirements
  • Camper information: Names, dates of birth, sex, addresses, guardian contact details, medical information, allergies, emergency contacts, authorized pickup persons, photos, medications and medication logs, incident reports, and pickup PINs
  • Counselor information: Names, email addresses, phone numbers, and role designations
  • Attendance data: Check-in/check-out times, health check notes, and pickup information
  • Payment information: Processed securely through Stripe (we do not store full credit card numbers)
  • Waiver and e-signature data: Signed liability waivers, guardian names, signature timestamps, and IP addresses
  • Portal authentication: One-time passcodes (OTPs) used by guardians and counselors to access external portals
  • Communications: Messages with our support team and email preferences

2.2 Automatically Collected Information

We automatically collect certain information when you use our Service:

  • Log data: IP address, browser type, pages visited, timestamps, and login events
  • Device information: Device type and operating system
  • Usage data: Features used, actions taken, and system metrics
  • Audit trails: Business events, database changes, and security events for compliance
  • Cookies: Essential cookies for authentication and session management

3. How We Use Your Information

We use the collected information for the purposes below. The bracketed tag identifies the lawful basis we rely on under GDPR Article 6 / Quebec Law 25 §12 / PIPEDA Principle 4.3, contract means processing is necessary to perform the agreement with you, legitimate interest means we have a balanced operational interest that does not override your rights, consent means we rely on your express opt-in, and legal obligation means a statute requires us to retain or produce the record.

  • Provide core services [contract]: Program management, enrollment processing, attendance tracking, and daily check-in/check-out
  • Process registrations [contract]: Handle public registration widget submissions and create enrollments
  • Manage waitlists [contract / legitimate interest]: Track and promote campers when program spots become available
  • Process payments [contract / legal obligation]: Handle Stripe transactions for program fees and subscriptions; retain financial records for tax-law purposes
  • Send transactional notifications [contract]: Email confirmations, cancellation notices, payment receipts, attendance alerts
  • Send program reminders & announcements [consent]: Optional non-transactional emails sent only when the recipient has not unsubscribed and (where required by CASL) has expressly opted in
  • Support operations [contract / legitimate interest]: Generate rosters, export attendance data, and provide financial reporting to org staff
  • AI assistance [consent / legitimate interest]: Power CampMate, our in-app AI assistant; the organization's owners and admins control whether it is turned on
  • Support requests [contract / legitimate interest]: Respond to inquiries and provide customer assistance
  • Security, fraud prevention, audit trails [legitimate interest / legal obligation]: Maintain login + business-event logs, detect fraud, ensure RLS isolation between organizations
  • Improve services [legitimate interest]: Analyse aggregate usage patterns and enhance user experience; no profiling of individual data subjects

4. How We Share Your Information

We may share your information with:

  • Service Providers: Stripe (payment processing, US/Canada), Supabase (database hosting, US/Canada), Resend (email delivery, US), Vercel (application hosting + anonymous web analytics, US), Sentry (error monitoring, US), Cloudflare (bot protection on sign-up, password reset and contact forms, US), cron-job.org (uptime monitoring), Meta and Google (advertising/measurement on our public marketing website only, US), and OpenAI (AI features, if configured). A current, itemized list is maintained at /sub-processors.
  • CampMate AI sub-processing: When CampMate is enabled, staff queries may include camper names, dates of birth, allergies, medical notes, and guardian contact info, which are sent to OpenAI (United States) to generate the response. OpenAI is operated under Zero Data Retention terms where contractually available. Organization owners and admins can disable CampMate at any time under Settings → Modules & AI, by switching off Enable CampMate; once it is off, the CampMate chat sends nothing to OpenAI. The AI writing and summary features (drafting text in a form field, camper and daily summaries, daily recaps) are separate from CampMate and keep working when it is off: when staff use them, the text and camper details they need are sent to OpenAI to generate the result. Owners and admins can turn them off under Settings → Modules & AI by switching off AI writing and summaries.
  • Within Your Organization: Team members within your organization based on their role (Owner, Admin, Manager, Staff, or Viewer)
  • Legal Requirements: When required by law, court order, or to protect our legal rights
  • Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal information to third parties. All data is strictly isolated by organization using Row Level Security (RLS), ensuring no organization can access another organization's data.

5. Data Security

We implement comprehensive technical and organizational security measures to protect your information:

  • Encryption: Data encrypted in transit (TLS/HTTPS) and at rest
  • Authentication: Sign-in through Supabase Auth with a password, an emailed link, Google or Microsoft sign-in, or a passkey, with password reset capabilities
  • Access controls: Role-based permissions (Owner, Admin, Manager, Staff, Viewer) with strict enforcement
  • Data isolation: Multi-tenant architecture with Row Level Security (RLS) ensuring complete data separation between organizations
  • Payment security: PCI-DSS compliant payment processing through Stripe (we never store full card numbers)
  • Audit trails: Comprehensive logging of login events, business actions, and database changes
  • Regular updates: Continuous security monitoring and vulnerability patching

However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security. We recommend using strong, unique passwords and enabling any additional security features we offer.

5a. Data Breach Notification

In the event of a security breach involving personal information that creates a real risk of significant harm, we will comply with our obligations under PIPEDA's Breach of Security Safeguards Regulations, including:

  • Reporting qualifying breaches to the Office of the Privacy Commissioner of Canada (OPC)
  • Notifying affected individuals as soon as feasible when a breach creates a real risk of significant harm
  • Maintaining a record of all security breaches involving personal information for a minimum of 24 months

If you believe your personal information has been compromised, please contact us immediately at security@campix.io.

6. Data Retention

We retain personal information only as long as necessary for the purposes for which it was collected, or as required by law. The following retention periods apply:

  • Active account data (camper profiles, enrollments, attendance): Retained for the duration of the account and up to 2 years after the last enrollment activity
  • Financial records (payment receipts, invoices): Retained for 7 years in accordance with CRA requirements
  • Waiver and e-signature records: Retained for 7 years after signature or the camper's 18th birthday, whichever is later
  • Audit logs and security records: Retained for 24 months
  • Email preferences and unsubscribe records: Retained indefinitely to honour opt-out requests
  • Deleted accounts: Personal information is deleted or anonymized within 90 days of account deletion, except where legal retention obligations apply

You may request deletion of your personal information at any time by contacting privacy@campix.io. Deletion requests are subject to our legal retention obligations.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

  • Access: Request access to your personal information
  • Correction: Request correction of inaccurate information
  • Deletion: Request deletion of your information
  • Portability: Request a copy of your data in a portable format
  • Objection: Object to processing of your information
  • Opt-out: Unsubscribe from marketing communications

To exercise these rights, please contact us at privacy@campix.io.

8. Children's Privacy

Our Service is designed for use by organizations managing camps and youth programs. Camper information (including names, dates of birth, medical details, and allergies) is provided by parents or guardians during registration. We do not collect personal information directly from children.

Organizations using Campix are responsible for obtaining appropriate parental or guardian consent before entering camper information into the Service. We process this data solely on behalf of the organization to provide camp management services.

Account holders must be 18 years of age or older. Campix accounts are for organizational use by adults managing camp programs, not for use by minors.

COPPA Notice (U.S. Organizations): If you are a U.S.-based organization enrolling children under 13, you are responsible for complying with the Children's Online Privacy Protection Act (COPPA), including obtaining verifiable parental consent before collecting personal information from children under 13. Campix processes this information on your behalf as a service provider. Please ensure your registration workflow and waiver process includes appropriate COPPA disclosures.

9. Cookies and Tracking

We use essential cookies for authentication and session management. These cookies are necessary for the Service to function properly and cannot be disabled. We do not place advertising or analytics cookies inside the authenticated application, and we never use camper, parent, or program data for advertising.

On our public marketing website only (for example campix.io, not the signed-in application), we use advertising and measurement tags from Meta (the Meta/Facebook Pixel) and Google (Google Ads) to understand which campaigns bring visitors to us and to show relevant ads. These tags run only on marketing pages and collect standard web data such as pages viewed and a device identifier.

Our marketing website also embeds a product overview video hosted on YouTube (Google). The video does not load until you choose to play it: until then, nothing is requested from Google and no video cookies are set. If you press play, YouTube receives your IP address and basic device information in order to stream it. We use YouTube's no-cookie player, which does not set advertising cookies for viewers.

You can opt out of this advertising through your Meta ad preferences, your Google Ad Settings, the Digital Advertising Alliance of Canada opt-out tool, or your browser settings. Disabling authentication cookies will prevent you from using the Service.

10. Canadian Privacy Law (PIPEDA & PHIPA)

Campix is based in Canada and operates in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). We collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

Ontario Health Information (PHIPA): Camp operators in Ontario who store and use camper medical information (including allergies, conditions, and medications) may be subject to the Personal Health Information Protection Act (PHIPA). As a technology service provider, Campix acts as an "agent" under PHIPA when processing health information on behalf of Ontario health information custodians. We implement appropriate technical and organizational safeguards for health information, including access controls, audit logging, and encrypted storage. If you have specific PHIPA compliance requirements, please contact us at privacy@campix.io.

Your information may be transferred to and processed outside Canada by our service providers: Stripe (United States and Canada), Supabase (United States and Canada), Resend (United States), OpenAI (United States, for CampMate and the AI writing and summary features), Sentry (United States, application error monitoring; error payloads are scrubbed of personal information before transmission), Cloudflare (bot protection on sign-up, password reset and contact forms, US), cron-job.org (uptime monitoring of a health endpoint, no camper data), and Vercel (United States). We rely on standard contractual clauses (SCCs), data processing agreements (DPAs), and where available Zero Data Retention terms to ensure these transfers meet PIPEDA, GDPR, and CCPA requirements. Turning CampMate off under Settings → Modules & AI, by switching off Enable CampMate, stops the CampMate chat transfer. The AI writing and summary features send data to OpenAI only when staff use them. A current list of our sub-processors is available at /sub-processors.

11. Privacy Officer

Campix has designated a Privacy Officer responsible for overseeing compliance with this Privacy Policy and applicable privacy legislation. To exercise your privacy rights, make a complaint, or ask questions about our privacy practices, contact our Privacy Officer:

  • Privacy Officer, Campix Inc.
  • Email: privacy@campix.io
  • We will respond to privacy inquiries within 30 days.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca.

11a. How to File a Privacy Complaint

PIPEDA Principle 10 (Challenging Compliance) entitles you to challenge our handling of your personal information. We commit to a documented, time-bound complaints procedure:

  1. Submit your complaint in writing to privacy@campix.io with subject line "Privacy complaint". Include: your name, the organization you transacted with (if applicable), the data subject's name (if different from yours), the nature of the complaint, and any supporting context.
  2. Acknowledgement within 5 business days. Our Privacy Officer will confirm receipt and assign a complaint reference number.
  3. Investigation and substantive response within 30 days. We will investigate the matter, consult internal records and any service providers as needed, and provide a written response describing our findings, any remediation taken, and any further options available to you.
  4. Internal escalation. If you are not satisfied with the response, you may request review by Campix leadership; the request triggers a fresh 14-day review window.
  5. External escalation. If we are unable to resolve the complaint to your satisfaction, you may escalate to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca), the Commission d'accès à l'information du Québec for Quebec data subjects (www.cai.gouv.qc.ca), the Information and Privacy Commissioner of Ontario for PHIPA matters (www.ipc.on.ca), or your local data-protection authority for EU/UK data subjects. We will cooperate with any regulator-led review.

We retain a record of every privacy complaint and its resolution for a minimum of 24 months for audit purposes.

11b. Notice to U.S. residents

The following supplemental disclosures apply to data subjects who reside in U.S. states with comprehensive privacy laws, including California (CCPA / CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Texas (TDPSA). State-specific rights are listed in addition to the rights described elsewhere in this policy, not in place of them.

Categories of personal information we collect (CPRA §1798.110): identifiers (name, email, phone, account ID), commercial information (registration / payment records), internet or network activity (login events, IP), geolocation (city / region from IP), and sensitive personal information where you provide it (medical / allergy notes, limited to camp-operations purposes only).

Do Not Sell or Share My Personal Information. We do not sell personal information for monetary consideration and we do not share it with third parties for cross-context behavioural advertising. We do, however, transfer personal information to the service providers listed in §10 strictly to deliver the Service to you. To exercise your right to opt out of any sale or sharing as defined under CPRA §1798.140, email privacy@campix.io with subject "Do Not Sell or Share".

Global Privacy Control (GPC) signal. As described above, we do not sell personal information and do not share it for cross-context behavioural advertising, so there is no sale or sharing for a GPC signal to opt you out of. We are implementing automated detection of the GPC browser signal (Sec-GPC: 1) and will honour it as a valid opt-out request under CPRA §1798.135(b) and equivalent state laws. In the meantime you can exercise the same opt-out at any time by emailing privacy@campix.io.

Other rights you may have under U.S. state law: the right to know what personal information we have collected, the right to access a portable copy, the right to delete, the right to correct inaccuracies, the right to limit use of sensitive personal information, the right to opt out of profiling that produces legal or significant effects, and the right to non-discrimination for exercising these rights. To exercise any of these rights, contact our Privacy Officer at privacy@campix.io. We may need to verify your identity before responding. We will not require an account, charge a fee, or otherwise discriminate against you for exercising your privacy rights.

Authorized agents. California residents may designate an authorized agent to make a request on their behalf. The agent must provide a signed authorization and we may require you to verify your own identity directly with us before we act on the agent's request.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the Service after such changes constitutes acceptance of the updated policy.

13. Data Processing Addendum

Organizations that need a Data Processing Addendum covering how Campix processes personal information on their behalf can review our self-serve DPA at campix.io/dpa.

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at: