Trojan Analytics
Privacy Policy
How Trojan Analytics handles account, order, sample and analytical information.
Version TA-PRIV-2026-10-16-01 · Not yet effective
1. Scope and accountability
Trojan Analytics handles personal information to operate its analytical-testing portal and coordinate independent laboratory services. This policy covers visitors, account holders, inquirers and people whose details are lawfully included in a request. We handle information under applicable Canadian privacy requirements, including PIPEDA where it applies, and any additional laws applicable to the particular service.
The designated privacy contact acts for Trojan Analytics and handles questions, requests and complaints through the published contact channel. Use the contact form and identify your message as a privacy matter. Operator and privacy-contact particulars accompany this policy when it takes effect. Do not send passwords or identity documents in a general inquiry.
2. Information we collect
Account information includes your email, authentication identifiers and credentials handled through Supabase Auth. Profiles can include name, company, telephone and a saved address. Order details can include customer category, contact/billing and shipping information, country, company or group references and purchase-order details.
Sample and analytical information includes identifiers, labels, expected contents and quantity, container counts, lots, supplier and handling descriptions, selected analyses, progress, results, customer reports, supporting partner documents and review records. Technical information can be personal when linked to a person; it is not automatically anonymous.
The portal records quotations, their amounts/currency and acceptance, relevant shipment references and operational audit history. Inquiries include name, reply email, optional organization/order reference, subject and message. Do not include payment-card numbers or unnecessary financial information in a request or inquiry.
Connection and authentication services may process technical request and security information necessary to deliver and protect the portal. We use operational records to investigate unauthorized access and errors, rather than to create advertising profiles.
3. How we use information and consent
We use relevant information for sign-in and account administration, inquiry replies, scope/quotation review, sample coordination, authorized reports, customer support and investigation of misuse or errors. We limit collection and access to those purposes, legal obligations and other uses permitted by applicable law.
Supply accurate information you are authorized to share and avoid unnecessary health information or details about other people. We explain materially different purposes and seek appropriate consent where required. Contract acceptance and reading this policy are not blanket permission for unrelated uses or public disclosure.
4. Service providers and laboratory partners
Supabase provides authentication, database records and private file storage. Cloudflare supplies domain registration for trojananalytics.com. Domain registration does not itself establish visitor proxying or tracking through Cloudflare.
An assigned independent laboratory receives the sample identifiers, analyses, handling/shipping facts and contact information necessary for the particular work. Relevant shipping providers may process the details needed to transport or clear a shipment arranged for that order. The website does not currently book carriers or issue paid postage.
Providers must be limited to authorized purposes and appropriate confidentiality and safeguards. We remain accountable for personal information transferred for processing as required by applicable law. Disclosure may also be required by law or necessary to address misuse, safety or a legal claim. We do not sell personal information or provide it to advertising brokers.
5. Private reports and public verification
Customer reports use authenticated ownership checks and private storage. Original laboratory evidence and internal review notes are separate supporting records for authorized staff; they are not public attachments. A report link is not permission to inspect another customer's records.
Only a genuinely released report specifically approved for public verification can expose a summary: report/sample identifiers, publication status, analysis type, method, issue date and approved analytical findings. Private PDFs, customer contact details, source evidence and reviewer notes are excluded. A QR scan sends the report ID to the verification page.
Public identifiers and findings can identify someone in combination with other information. We must provide appropriate notice and obtain authority or consent where required before such publication. A later withdrawal changes future access but cannot erase copies retained by others.
6. International processing
Customers, laboratories and service providers may operate outside Canada. Personal information processed abroad can be subject to another country's laws and lawful access. Ontario operations do not promise Canadian-only storage or processing.
Before a transfer we must assess the actual arrangement and use contractual and other safeguards appropriate to the information and applicable law. Where laws such as EU or UK data-protection rules apply because of the services offered or other relevant targeting, their additional notice, transfer, representative and rights requirements must be met. Worldwide website access alone does not establish either applicability or compliance.
8. Retention and deletion
We retain information for the documented service, dispute, security and legal-recordkeeping purposes for which it is needed, and then securely delete it or de-identify it where appropriate. Retention depends on the record: account and inquiry details, agreements, reports/evidence, audit history and backups serve different purposes. We review continuing need and do not retain information indefinitely merely because storage is available.
When considering a deletion or consent-withdrawal request, we assess applicable requirements, outstanding services and justified holds, restrict unnecessary use and explain any information that must remain. Physical sample retention and disposal follow the separately confirmed laboratory arrangements, not the account-record schedule.
9. Access, correction and complaints
You may request information about our handling of your personal information, access and correction, or withdrawal of consent subject to lawful restrictions and reasonable notice. Under PIPEDA, access requests normally receive a response within 30 days; permitted extensions and refusals must be explained as required. Reasonable verification protects your information, and an order number alone does not establish authority.
Deletion, portability, objection or other rights may also apply under your local law. Some information must remain to meet legal obligations or resolve a claim, and withdrawal may prevent a requested service. We do not treat an access request or complaint as waiver of any other right.
Contact the privacy contact through the contact form to raise a concern. We will investigate and explain the response. You may also complain to the Office of the Privacy Commissioner of Canada or another competent authority; using our internal process does not take away that option.
10. Security, incidents and policy changes
Customer ownership checks, staff authorization, private-file controls and limited public responses help protect information. No security measure eliminates every risk. Protect your account and report suspected misuse through the contact channel.
We assess security incidents, preserve necessary records, take appropriate remedial steps and make regulator/individual notifications when required by law. Service-provider involvement does not remove our own applicable obligations.
We update this policy when practices change and explain material changes and any new consent requirement. The version and effective date identify the operative notice. Prior agreement/acceptance evidence is preserved; changes are not a means to authorize unrelated historical uses retroactively.
Contact Trojan Analytics through the contact form.