Privacy Policy

Effective date: 17 June 2026
Last updated: 17 June 2026

This Privacy Policy explains how Flagtail Consulting Inc. ("DoorReach," "Flagtail," "we," "us," or "our") collects, uses, discloses, stores, and protects personal information through DoorReach, including the website located at doorreach.com, the DoorReach web app, customer workspaces, and related services.

DoorReach is a web-based service that helps organizations manage canvassing, outreach, field activity, and related data.

By using DoorReach, creating an account, accepting an invitation to a DoorReach workspace, or otherwise using our services, you agree to this Privacy Policy. If you use DoorReach on behalf of an organization, campaign, candidate, nonprofit, company, public body, or other customer, you represent that you are authorized to do so.

This Privacy Policy should be read together with our Terms of Use.

1. Who this policy applies to

This Privacy Policy applies to personal information we handle about:

1. DoorReach customers and prospective customers;
2. people who create or use DoorReach accounts;
3. staff, volunteers, contractors, canvassers, administrators, and other authorized users of customer workspaces;
4. people whose information is entered, imported, uploaded, recorded, or processed in DoorReach by or on behalf of a customer;
5. people who contact us by email, web form, phone, social media, or other means; and
6. visitors to our website and web app.

2. Important roles

DoorReach provides tools that customers use to manage their own canvassing and outreach activities.

In many cases, the customer decides what personal information to put into DoorReach, why it is used, who may access it, and how long it should be kept. In those cases, DoorReach acts as a service provider or processor for the customer.

Except for aggregated or de-identified information, and DoorReach account, usage, and technical information, DoorReach does not use identifiable customer-provided canvass and contact data for its own product development or marketing purposes.

Customers are responsible for their own collection, use, disclosure, notices, consents, legal authority, and compliance obligations for the data they put into DoorReach.

DoorReach is responsible for the personal information it collects and uses for its own purposes, such as account administration, billing, support, security, service improvement, and legal compliance.

3. Personal information we collect

The personal information we collect depends on how DoorReach is used.

Account and user information

We may collect information such as:

1. name;
2. email address;
3. phone number;
4. organization, campaign, or customer name;
5. role or permissions within a DoorReach workspace;
6. username, login, or authentication information;
7. account preferences;
8. billing or payment-related information; and
9. communications with us.

Customer-provided canvass and contact data

Customers and their authorized users may submit, upload, import, create, or record information in DoorReach, such as:

1. voter lists;
2. supporter lists;
3. contact lists;
4. names;
5. addresses;
6. phone numbers;
7. email addresses;
8. household or residence information;
9. canvass notes;
10. survey responses;
11. issue tags;
12. support levels or preferences;
13. volunteer, supporter, or stakeholder information;
14. communication history;
15. assigned canvasses, turfs, routes, or field activity; and
16. other information entered by or on behalf of the customer.

This information is controlled by the customer that uses DoorReach.

DoorReach-provided address data

DoorReach may provide address data, address-matching tools, routing tools, mapping tools, and related data to help customers create and manage canvasses.

When DoorReach-provided address data is assigned to a customer's specific canvass, it may become part of that customer's canvass records or exports. DoorReach still maintains its own underlying address database, software, and tools.

Website and technical information

When you use our website or web app, we may automatically collect technical information such as:

1. IP address;
2. browser type and version;
3. device type;
4. operating system;
5. pages or screens viewed;
6. dates and times of access;
7. actions taken in the web app;
8. referring pages or links;
9. session information;
10. authentication, security, and audit logs;
11. error reports; and
12. diagnostic information.

This information helps us operate, secure, troubleshoot, and improve DoorReach.

Support and communications information

If you contact us for support or communicate with us, we may collect:

1. your name and contact information;
2. the content of your message;
3. workspace or account details relevant to the request;
4. screenshots, files, logs, or examples you provide;
5. support history; and
6. other information needed to respond to you.

4. Information we do not intentionally collect

DoorReach is not designed for collecting sensitive personal information unless a customer chooses to enter it.

Customers and authorized users should not enter sensitive information into DoorReach unless they have a lawful basis and a valid reason to do so.

DoorReach is not intended for use by children under 13. We do not knowingly collect personal information directly from children under 13.

5. How we collect information

We may collect personal information:

1. directly from you when you create an account, contact us, pay an invoice, or use DoorReach;
2. from customers or authorized users who upload, import, enter, or record information in DoorReach;
3. from DoorReach's web app and website automatically through logs, cookies, analytics, and similar technologies;
4. from service providers that help us operate DoorReach;
5. from publicly available sources where permitted by law; and
6. from other sources with consent or as permitted by law.

6. Why we use personal information

We may collect, use, and disclose personal information for the following purposes:

1. to provide, operate, and maintain DoorReach;
2. to create, administer, and manage accounts and workspaces;
3. to allow customers and authorized users to create and manage canvasses;
4. to process customer-provided canvass and contact data according to customer instructions;
5. to provide address data, address matching, routing, mapping, and related features;
6. to provide support, troubleshooting, debugging, and customer service;
7. to investigate bugs, errors, outages, misuse, abuse, or security incidents;
8. to secure DoorReach and prevent fraud, unauthorized access, or misuse;
9. to process invoices, payments, refunds, taxes, and accounting records;
10. to communicate with customers and users about the service;
11. to send administrative, transactional, security, billing, or service-related messages;
12. to send marketing communications where permitted by law;
13. to improve, test, and develop DoorReach using DoorReach account, usage, and technical information, and aggregated or de-identified information, rather than identifiable customer-provided canvass and contact data;
14. to generate aggregated or de-identified analytics and reports;
15. to enforce our Terms of Use;
16. to comply with legal, regulatory, accounting, or reporting obligations;
17. to respond to lawful requests from courts, regulators, law enforcement, or other authorities; and
18. for other purposes with consent or as permitted or required by law.

7. DoorReach staff access to customer workspaces

DoorReach personnel and authorized service providers may access customer workspaces, accounts, customer data, canvass records, and assigned address data only as reasonably necessary to:

1. provide, operate, maintain, secure, troubleshoot, or improve DoorReach;
2. respond to support requests;
3. investigate bugs, errors, outages, abuse, or security incidents;
4. perform administrative, billing, or account-management functions;
5. comply with legal obligations;
6. enforce our Terms of Use; or
7. act with the customer's consent or instructions.

We use reasonable administrative, technical, and organizational safeguards designed to limit staff access to appropriate purposes. These safeguards may include access controls, confidentiality obligations, logging, role-based permissions, and internal policies.

8. Customer responsibilities

Customers are responsible for ensuring that they have the legal right to collect, import, upload, use, disclose, contact, and otherwise process personal information through DoorReach.

Customers are responsible for complying with applicable laws, including privacy laws, election laws, campaign-finance laws, communications laws, anti-spam laws, telemarketing rules, voter-contact rules, and rules that apply to political parties, candidates, campaigns, nonprofits, public bodies, or other organizations.

Customers must provide any notices, obtain any consents, maintain any records, and honour any opt-out or suppression requests required for their use of DoorReach.

DoorReach does not determine whether a customer is legally permitted to contact a person, use a voter list, import a dataset, send a message, conduct outreach, or run a campaign activity.

9. Consent and legal basis

We collect, use, and disclose personal information with consent, where consent is required, or as otherwise permitted or required by law.

Consent may be express, such as when you agree to receive marketing messages, or implied, such as when you contact us and provide information so we can respond.

You may withdraw consent where consent is the basis for processing, subject to legal, contractual, and practical limitations. Withdrawing consent may affect our ability to provide DoorReach or respond to your request.

Customers are responsible for obtaining any consent or legal authority required for personal information they provide to DoorReach.

10. Cookies, analytics, and similar technologies

DoorReach may use cookies, local storage, analytics tools, logging tools, and similar technologies to:

1. keep users signed in;
2. remember preferences;
3. operate the web app;
4. secure accounts and sessions;
5. understand how the website and web app are used;
6. diagnose technical issues;
7. improve performance and reliability; and
8. detect fraud, abuse, or unauthorized access.

You may be able to control cookies through your browser settings. Some features of DoorReach may not work properly if cookies or local storage are disabled.

11. Communications and marketing

We may send administrative, transactional, account, billing, security, and service-related communications to customers and authorized users.

We may send marketing communications where permitted by law. You may unsubscribe from marketing emails by using the unsubscribe link in the message or by contacting us.

If we send commercial electronic messages, including commercial emails or texts, we will do so in accordance with applicable anti-spam laws.

Unsubscribing from marketing communications will not stop administrative, transactional, security, billing, or service-related communications that are necessary to provide DoorReach.

12. SMS, MMS, and phone communications

DoorReach may send SMS, MMS, or phone communications for administrative, transactional, support, account, billing, security, or service-related purposes where permitted by law.

If DoorReach sends SMS or MMS messages directly, message and data rates may apply depending on the recipient's carrier.

To opt out of SMS or MMS messages from DoorReach, reply "STOP" or "UNSUBSCRIBE" where that option is provided, or contact us at info@doorreach.com.

Customers are responsible for ensuring that any SMS, MMS, phone, email, or other outreach conducted by the customer or its authorized users through or using information from DoorReach complies with applicable laws and consent requirements.

13. When we disclose personal information

We may disclose personal information to:

1. customers and authorized users within the relevant customer workspace;
2. our employees, contractors, and authorized personnel who need access for the purposes described in this Privacy Policy;
3. service providers who help us provide DoorReach;
4. hosting, database, storage, infrastructure, security, analytics, logging, error-monitoring, email, communications, billing, payment, and customer-support providers;
5. professional advisors, such as lawyers, accountants, auditors, insurers, and security consultants;
6. courts, regulators, law enforcement, government authorities, or other parties where required or permitted by law;
7. parties involved in an actual or proposed merger, acquisition, financing, reorganization, sale of assets, or similar transaction;
8. other parties with consent; and
9. other parties where permitted or required by law.

We do not sell customer data.

14. Service providers and subprocessors

DoorReach may use service providers to help operate, host, secure, support, and improve the service.

These service providers may process personal information on our behalf. We use reasonable efforts to ensure that service providers are subject to appropriate confidentiality, security, and privacy obligations.

Depending on the features used, service providers may include providers of:

1. cloud hosting and infrastructure;
2. database and storage services;
3. email and transactional messaging;
4. SMS or communications services;
5. analytics and product usage measurement;
6. logging and error monitoring;
7. security and authentication;
8. payment and invoicing;
9. customer support;
10. mapping, geocoding, address, or routing services; and
11. professional services.

15. International storage and processing

DoorReach endeavours to store and process customer data in Canada where reasonably practical.

However, we may use service providers, contractors, or professional advisors located in Canada, the United States, the European Economic Area, the United Kingdom, or other jurisdictions.

Personal information may be transferred to, stored in, or accessed from jurisdictions outside your province, territory, state, or country. Those jurisdictions may have privacy laws that are different from the laws where you are located.

Where we transfer personal information to service providers in other jurisdictions, we use reasonable safeguards appropriate to the circumstances and the sensitivity of the information.

16. Security safeguards

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, modification, and destruction.

These safeguards may include access controls, authentication, role-based permissions, confidentiality obligations, logging, monitoring, backups, and security procedures.

No method of transmission or storage is completely secure. Customers and authorized users are responsible for protecting their login credentials, using appropriate passwords, managing authorized users, and promptly notifying DoorReach of suspected unauthorized access.

17. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods may depend on the type of information, the customer's instructions, the status of the customer account or project, legal obligations, backup practices, security needs, accounting requirements, dispute resolution, and legitimate business purposes.

Customer data may be retained for a limited period after cancellation, termination, expiry, or nonpayment to allow reactivation, export, backup restoration, legal compliance, billing, dispute resolution, security, fraud prevention, or legitimate business purposes.

Backups, logs, security records, accounting records, and support records may be retained for a limited period even after customer data is deleted from active systems.

18. Access and correction

You may request access to personal information we hold about you, subject to legal exceptions.

You may also request correction of personal information if you believe it is inaccurate, incomplete, or out of date.

If your information is controlled by a DoorReach customer, such as a campaign, organization, or other customer using DoorReach, we may direct your request to that customer or work with that customer to respond.

To make an access or correction request, contact us at info@doorreach.com. We may need to verify your identity before responding.

19. Deletion and withdrawal of consent

You may request deletion of personal information where applicable, subject to legal, contractual, technical, and practical limitations.

If your information is controlled by a DoorReach customer, we may direct your request to that customer or work with that customer to respond.

You may withdraw consent where consent is the basis for collection, use, or disclosure. Withdrawal of consent may affect our ability to provide DoorReach or respond to your request.

We may retain certain information where required or permitted by law, including for legal compliance, accounting, billing, security, fraud prevention, dispute resolution, backups, and legitimate business purposes.

20. Privacy breaches

If we become aware of a breach of security safeguards involving personal information under our control, we will assess the breach and comply with applicable legal requirements.

Where required by law, we will notify affected individuals, customers, regulators, or other organizations.

We may also keep records of privacy breaches as required by applicable law.

21. Aggregated and de-identified information

DoorReach may create and use aggregated or de-identified information for analytics, product improvement, security, reporting, research, or business purposes.

We will not use aggregated or de-identified information to identify a customer, authorized user, or individual person unless permitted by law and consistent with this Privacy Policy.

22. Business transfers

If DoorReach or Flagtail Consulting Inc. is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction, personal information may be disclosed or transferred as part of that transaction.

Any acquiring organization may continue to use personal information as described in this Privacy Policy, unless otherwise required by law.

23. Links to third-party websites

DoorReach may contain links to third-party websites or services that we do not operate.

We are not responsible for the privacy practices, content, or policies of third-party websites or services. You should review their privacy policies before providing personal information to them.

24. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, services, practices, or legal requirements.

When we update this Privacy Policy, we will update the "Last updated" date.

Changes will take effect when posted, unless a later effective date is stated.

If we make material changes to how we collect, use, disclose, or protect personal information, we may provide additional notice where required by law or where we believe the changes are significant.

If required by law, we will obtain consent or provide an opportunity to opt in or opt out of new uses of personal information.

25. Questions, requests, and complaints

If you have questions, concerns, access requests, correction requests, deletion requests, or complaints about this Privacy Policy or our privacy practices, contact us at:

Flagtail Consulting Inc.
Attention: Privacy Officer
Email: info@doorreach.com

We will review and respond to privacy complaints within a reasonable time.

If we do not resolve your concern to your satisfaction, you may be able to file a complaint with the Office of the Privacy Commissioner of Canada.