Last Updated: March 2026
Beta Notice: LeastAction is currently in Beta. LeastAction Labs, Inc. operates as a small team and processes a minimal amount of personal data — primarily account and contact information collected through the leastactionlabs.com website and marketplace portal. LeastAction is self-hosted software: you deploy and operate it on your own infrastructure. LeastAction Labs does not host, access, or process any data within your LeastAction deployment.
LeastAction Labs, Inc. ("LeastAction Labs," "we," "us," or "our"), a company incorporated under the Canada Business Corporations Act (R.S.C., 1985, c. C-44), with its registered office in British Columbia, Canada, operates the website at leastactionlabs.com and the associated marketplace and account portal (together, the "Website").
This Privacy Policy applies to personal information we collect through:
- The leastactionlabs.com website, including its contact forms and documentation pages
- The LeastAction marketplace and account portal, including account registration, subscription management, and license key issuance
This Privacy Policy does NOT apply to data processed within your self-hosted LeastAction deployment. When you deploy LeastAction on your own infrastructure, you are the data controller for all personal data processed by that deployment. LeastAction Labs has no access to, and assumes no responsibility for, data within your self-hosted instance. You are solely responsible for complying with applicable privacy laws in relation to your deployment.
When you register for an account, subscribe to a plan, or contact us, we may collect:
- Identity information: First name, last name
- Contact information: Email address, organizational name, job title
- Account credentials: Email address and password (stored using bcrypt hashing); or OAuth/SSO token identifiers if you authenticate via a supported identity provider
- Payment information: Billing address, invoice details. Payment card details are processed directly by our third-party payment processor and are not stored on our systems.
- Contact form submissions: Any information you include when you contact us through the Website
When you visit the Website, we may automatically collect limited technical information:
- Usage analytics: Page views, referrer URL, browser type, operating system type (without persistent cross-site tracking or advertising profiling). We use privacy-respecting analytics tooling that does not build advertising profiles.
- Server logs: IP address, timestamp, HTTP method and path, response code. Logs are retained for a limited period for security and debugging purposes.
- Cookies and similar technologies: See our Cookie Policy for details.
We do not collect:
- Data from your self-hosted LeastAction deployment
- Health, financial, or other sensitive personal categories beyond what is described above
- Personal information from children under 16
We use the information described above for the following purposes:
| Purpose | Legal Basis (PIPA / PIPEDA) |
|---|---|
| Creating and managing your account | Consent / performance of contract |
| Processing subscription payments and issuing invoices | Performance of contract |
| Sending transactional communications (account confirmations, license keys, security alerts) | Performance of contract |
| Sending product updates and newsletters (where you have opted in) | Consent |
| Responding to support and contact form inquiries | Consent / legitimate business purpose |
| Detecting and preventing fraud and security incidents | Legitimate business purpose |
| Improving the Website through aggregated analytics | Legitimate business purpose |
| Complying with applicable legal obligations | Legal obligation |
We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects.
We do not sell, rent, or trade your personal information. We share personal information only with:
We use a limited number of third-party service providers ("subprocessors") to operate the Website. Each subprocessor is bound by contractual obligations to protect your data:
| Subprocessor Category | Purpose | Data Shared |
|---|---|---|
| Payment processor | Processing subscription payments, issuing invoices | Billing name, billing address, email, payment token |
| Transactional email provider | Delivering account and license key emails | Name, email address |
| Cloud hosting provider | Hosting the Website and marketplace portal | Account data stored on the platform |
We will update this table as our subprocessor list changes and will notify users of material changes in accordance with Section 12.
We may disclose personal information if required to do so by applicable law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of LeastAction Labs, our users, or the public.
If LeastAction Labs undergoes a merger, acquisition, or sale of all or substantially all of its assets, personal information may be transferred as part of that transaction. We will notify you by email and/or a prominent notice on the Website of any such change in ownership.
LeastAction Labs is a federally incorporated Canadian corporation (Canada Business Corporations Act, R.S.C., 1985, c. C-44) with its registered office in British Columbia. Our privacy practices are governed by:
- BC PIPA (Personal Information Protection Act, SBC 2003, c. 63): Applies to personal information we collect, use, and disclose in the course of commercial activities within British Columbia.
- PIPEDA (Personal Information Protection and Electronic Documents Act, SC 2000, c. 5): Applies to personal information we collect, use, or disclose in the course of interprovincial or international commercial activities.
Where the requirements of PIPA and PIPEDA overlap, we apply the more protective standard. We collect only the information that is reasonably necessary for the identified purposes, obtain consent before or at the time of collection, and allow individuals to withdraw consent subject to legal or contractual constraints.
If you are a British Columbia public sector organization subject to the Freedom of Information and Protection of Privacy Act (FOIPPA, RSBC 1996, c. 165), please note:
- FOIPPA imposes restrictions on the storage and access of personal information outside Canada without proper authority.
- LeastAction is self-hosted software. You, as the operator of your LeastAction deployment, are the data controller and are solely responsible for ensuring your deployment complies with FOIPPA, including data residency requirements.
- LeastAction can be deployed on Canadian-hosted infrastructure (including Canadian-region cloud services). Selecting appropriate infrastructure is your responsibility.
- LeastAction Labs will cooperate with BC public sector customers who require documentation about the software's architecture and data flows to support their FOIPPA compliance assessments.
- Personal information collected by LeastAction Labs through the Website (account information, etc.) may be stored on servers located outside Canada. If this is a concern for your procurement process, please contact us at privacy@leastactionlabs.com to discuss options.
LeastAction Labs is based in British Columbia, Canada. Our Website and marketplace portal may be hosted using cloud infrastructure with servers located outside Canada (including in the United States or other jurisdictions).
Where personal information is transferred outside Canada, the transfer is subject to the applicable laws of the receiving jurisdiction. Under PIPEDA, we remain accountable for personal information transferred to third parties for processing and use contractual or other means to provide comparable protection.
We do not represent that servers are located exclusively in Canada. If you require Canadian data residency for information processed through the Website, please contact us at privacy@leastactionlabs.com.
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:
- Account information: Retained for the duration of your account and for a reasonable period thereafter to comply with legal obligations and resolve disputes.
- Payment records: Retained as required by applicable tax and accounting law (typically 7 years).
- Server logs: Retained for a limited period (typically 30–90 days) for security and debugging purposes.
- Marketing communications: Retained until you unsubscribe or request deletion.
Upon verified request, we will delete or anonymize your personal information, subject to any legal retention obligations.
Under BC PIPA and PIPEDA, you have the following rights regarding your personal information held by LeastAction Labs:
- Right of access: You may request access to the personal information we hold about you and information about how it has been used and disclosed.
- Right of correction: You may request that we correct inaccurate or incomplete personal information.
- Right of deletion: You may request deletion of your personal information, subject to legal retention obligations.
- Right to withdraw consent: You may withdraw consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual constraints. Withdrawal may affect our ability to provide certain services.
- Right to complain: You have the right to complain to the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) if you believe we have mishandled your personal information.
To exercise any of these rights, contact us at privacy@leastactionlabs.com. We will respond within 30 days. We may need to verify your identity before processing requests.
We implement reasonable technical and organizational measures to protect personal information against unauthorized access, use, disclosure, alteration, or destruction. These measures include HTTPS/TLS encryption for the Website, password hashing, and access controls.
However, no security measure is perfect. We cannot guarantee the absolute security of information transmitted over the internet. In the event of a security breach involving your personal information, we will notify you as required by applicable law.
The Website and the LeastAction software are not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have inadvertently collected personal information from a child under 16, we will take steps to delete it promptly.
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Where changes are material, we will provide at least 30 days' advance notice by email (to the address associated with your account) and/or by posting a prominent notice on the Website before the changes take effect. The "Last Updated" date at the top of this page reflects the date of the most recent revision.
Your continued use of the Website after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms.
For questions, concerns, or requests related to this Privacy Policy or our privacy practices, please contact:
Privacy Officer LeastAction Labs, Inc. Email: privacy@leastactionlabs.com Web: https://leastactionlabs.com/contact
You may also contact the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) if you are not satisfied with our response to a privacy complaint:
Office of the Information and Privacy Commissioner for BC Website: www.oipc.bc.ca