Privacy Policy

Prime is a security operations platform operated by Tamayaz on behalf of Premier Security Inc. and Vanguard Security Services Ltd. This policy explains what personal information we collect, why we collect it, how it is stored, who can access it, and the rights you have over it.

By submitting an application, signing in to an employee or client portal, or otherwise using Prime, you agree to the practices in this policy.

The categories of personal information Prime processes are:

• Identity: full name, date of birth, photo.
• Contact: mailing address, email, phone numbers, emergency contacts.
• Government identifiers: Social Insurance Number (SIN), provincial security licence, driver's licence. Stored encrypted at rest.
• Employment history: previous employers, supervisors, positions, dates.
• Banking: direct deposit information for payroll.
• Operational telemetry: shift timestamps, patrol scan events, vehicle inspection records, NFC tag interactions.
• Authentication: hashed password, session refresh tokens, sign-in IP hash.
• Submitted documents: resume, government ID, security licence card, TD1 / TD1-BC forms, banking voids.

Each category serves a documented purpose. SIN and banking are used for payroll. Security licence numbers and expiry dates feed renewal alerts. Address verification supports site dispatch. Shift, patrol, and inspection data is operational evidence for clients and regulators.

We do not sell personal information. We do not use it for advertising. We do not share it with parties beyond those listed in section 5 without your explicit consent.

Personal information lives in a tenant-scoped PostgreSQL database hosted on Tamayaz infrastructure. Sensitive identifiers (SIN, security licence number, banking details, salary) are encrypted at rest using pgcrypto with a key held outside the database. Submitted documents are stored in Google Cloud Storage with per-object access control.

We retain personal information for as long as you have an active relationship with Premier or Vanguard, plus the retention windows required by Canadian employment, tax, and security-services legislation (typically 7 years after the relationship ends).

• You: through your portal account.
• Designated administrators at Premier and Vanguard, scoped to the tenant you belong to.
• Tamayaz operators with platform-level access for support and incident response, governed by an internal access policy.
• Subprocessors used by Prime: Google Cloud (hosting, document storage, Gmail OAuth for outbound mail), Twilio (SMS), and Vertex AI (document OCR + report drafting). Each is contractually bound to comparable privacy terms.
• Lawful authorities, only with a valid order.

You can:

• Request a copy of the personal information we hold about you.
• Ask us to correct anything that is wrong.
• Ask us to delete information that is no longer needed for the purpose it was collected, subject to legal retention requirements.
• Withdraw a previously given consent.
• Complain to the Office of the Privacy Commissioner of Canada or your provincial regulator.

Requests should be sent to support@tamayaz.io. We will respond within 30 days.

We use HTTPS for every connection, encrypt sensitive identifiers at rest, hash passwords with bcrypt, rotate session refresh tokens, log administrator actions to an audit ledger, and run automated backups to a separate Cloud Storage bucket. No system is perfect; if we discover a breach affecting your information we will notify you and the appropriate regulator without undue delay.

We may update this policy. Material changes will be announced in your portal at least 14 days before they take effect. The "Last updated" date at the top of the page reflects the current version.