What we collect, where it lives, and who can see it.
WarHorse is a product of Housewives & Co. This policy covers this website, warhorseapp.com, and the WarHorse platform we run for our clients. It is written to be read, and it describes what the software actually does.
Privacy officer. Housewives & Co. is responsible for personal information held by WarHorse and for this policy. Questions, access requests, corrections and complaints go to hello@warhorseapp.com, or by post to Housewives & Co., 2204 2nd Street SW, Suite M112, PMB 1020, Calgary, AB T2S 3C3, Canada. We answer within 30 days.
Spam or abuse involving a WarHorse site or email goes to abuse@warhorseapp.com.
Who we are
Housewives & Co. is a Canadian company. WarHorse is our platform for small businesses, nonprofits, associations, community groups and campaigns: a website with the sign-up forms, contact list, payments and email built into it, run by us for each client organization.
Two different things are covered here, and the difference matters.
- This website, warhorseapp.com, where we describe the product and you can contact us. For anything you give us here, Housewives & Co. is responsible.
- Client sites we run on the platform. When you donate to, sign up with, buy from or write to one of our clients, the data is theirs. We hold it for them, on their instruction, and their own privacy policy governs it.
This website
warhorseapp.com collects personal information in one place: the contact form. If you fill it in we receive what you typed: your first and last name, your email address, your organization, the kind of organization it is, your current website if you gave one, and your message, together with the time you sent it and the page you sent it from.
The form has an unchecked box offering occasional product updates. If you leave it unchecked, we use your details only to reply to you. If you check it, we record that you did, with the exact wording you were shown, the time and the form, so that we can later show that you asked to hear from us. That record is the basis for any email we send you beyond a reply.
This site sets no cookies and runs no analytics or advertising scripts. Pages are served from a content delivery network, which sees the same connection information any web server does (your IP address, browser and the page requested) and which we do not use to identify you.
Signing in to the administration area of a WarHorse site uses Google's sign-in service. Only addresses on an explicit allowlist can sign in, and the sign-in itself records the email address and the time.
Email from us
We send email only to people who have asked for it: by checking the box on this site, by signing up on a client's site, or by having an existing relationship with the organization writing to them. We do not buy, rent or scrape lists, and our clients may not import a list into the platform without a record of how each person on it consented.
Every message we send carries the name and mailing address of the organization sending it and a way to reach them, an unsubscribe link in the footer, a one-click unsubscribe header that mail programs such as Gmail show as a button, and a per-message record of the consent it relied on.
Unsubscribing takes effect immediately and costs nothing. If a message cannot be delivered because the address is invalid, or if you mark one as spam, we stop sending to that address and do not resume. Messages may include a small image that tells our email provider when a message was opened. Mail apps such as Apple Mail and Gmail often load that image automatically, so an "open" is a rough signal, and we never use it to decide who hears from an organization. Links in messages pass through our provider's redirect and ours, which records the click. We follow Canada's Anti-Spam Legislation, which puts the burden of proving your consent on the sender, and that is why the records above exist.
Client sites we run
When you donate to, sign a petition on, register with, buy from or subscribe to an organization whose site runs on WarHorse, that organization is the one collecting your information and deciding what it is for. We are their service provider. We process it on their instruction, keep it separate from every other client's records, never use it for our own purposes and never sell it.
Card details never reach us. Payment fields on a client's donation or checkout page are rendered by Stripe inside a frame Stripe controls. Your card number goes from your browser to Stripe. Our software receives a confirmation and a reference, not the card. There is no code path in the platform that reads a card field.
Our staff can see client data. We operate the platform, and support and troubleshooting require access. That is true of every hosted service. It is why we bind ourselves contractually to each client, and why a client's records are exported to them in full, as dated files, whenever they ask.
What a client site keeps about you depends on what you did there. A donation to a political entity is recorded with the name, address and amount that Canadian election law requires that organization to report. A petition signature keeps what you typed into the form. For questions about a specific organization's records, contact that organization.
Where data is kept
| Application and database | Google Cloud, Montréal, Canada (northamerica-northeast1) |
|---|---|
| Backups | Same region as the database. No copy is held outside Canada. |
| Public web pages | Google's global edge network. Pages and images only, no personal data. |
| Email delivery | Elastic Email, servers in France (European Union), sending from North American addresses. Per message: the recipient address, the content and the delivery log. |
| Card processing | Stripe, on the client organization's own Stripe account |
| Administrator sign-in | Google's sign-in infrastructure. Email address and sign-in time for staff accounts only. |
Service providers
We use a small number of providers, each for one job, and each sees only what that job needs.
- Google Cloud for hosting, database and sign-in.
- Elastic Email for delivering email and telling us when a message was delivered, opened, bounced or reported as spam. Elastic Email is a Canadian company whose servers are in France.
- Stripe for payment processing on client sites. Stripe is certified to PCI DSS Level 1, and the client organization is the merchant of record.
We do not share personal information with anyone else, and we do not sell it. We would disclose it if the law required us to, and we would tell the affected client unless the law forbade that.
Who can see it
Access to the administration side of every site is an explicit allowlist. An address not on the list cannot sign in. Client organizations add and remove their own team members. The standing administrators are Housewives & Co. staff who operate the platform. Every export of a client's records is logged. We do not currently hold a SOC 2 report, and we do not claim one.
Your choices
- Stop email. Use the unsubscribe link or button in any message. It works immediately.
- See, correct or delete what we hold about you on this website. Write to hello@warhorseapp.com. We answer within 30 days.
- For a client organization's records about you, contact that organization. We act on their instruction, and we will help them respond.
Some records cannot be deleted on request because a law requires the organization to keep them. Political contribution records under the Canada Elections Act and provincial equivalents, and charitable receipts under the Income Tax Act, are the usual cases. We will tell you when that applies.
How long we keep it
Contact-form submissions on this website are kept while we are in conversation with you and for a reasonable period afterwards, then deleted. Consent records are kept for as long as we might need to show that you consented, which is at least as long as we are sending to you. Client organizations' records are kept for as long as the client instructs and as long as the law requires them to keep them.
Changes and complaints
If this policy changes in a way that affects you, the date at the top changes and, for anyone on our updates list, we say so in the next message. Questions, requests and complaints go to our privacy officer at hello@warhorseapp.com. If you are not satisfied with our answer, you may contact the Office of the Privacy Commissioner of Canada.