Privacy Policy
Ensemble Scientific, Inc.
Effective date: 20 August 2026
Last updated: 20 August 2026
1. Who we are
Ensemble Scientific, Inc. ("Ensemble Scientific", "we", "us") designs and operates connected irrigation and water management hardware, and the associated software platform, for agricultural operations in Canada.
Our products include the PulseLogic and RadSum sensor and control systems and a web dashboard for monitoring and controlling irrigation.
We are based in Vancouver, British Columbia, Canada.
2. Scope of this policy
This policy explains how we handle personal information, meaning information about an identifiable individual. It applies to our website at esci.io, our dashboard at app.esci.io, our application programming interface at api.esci.io, our iOS and Android apps, and to our dealings with customers and prospective customers generally.
It covers:
- Visitors to our website
- Users of the Ensemble Scientific dashboard and mobile apps
- Customers, and individuals at prospective customer organizations, who we communicate with
Personal information about our own employees and contractors is handled under a separate internal notice, which is provided to them directly and is available on request.
We are based in British Columbia and are subject to its Personal Information Protection Act (PIPA). Where we operate in other provinces, their privacy legislation may also apply, including Alberta's Personal Information Protection Act. For activity that crosses provincial or national borders, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) applies.
3. Sensor and field data
Most of the data our devices generate describes physical conditions: soil moisture, water flow, valve state, temperature, solar radiation, battery level, and device diagnostics. This is operational and agronomic data about equipment and land, not information about an identifiable individual, and it is generally not personal information.
Where a farm is operated by a sole proprietor or a small family operation, information such as field location, water use patterns, and property boundaries can become identifying when linked to a named individual. Where that is the case, we treat the data as personal information and it is covered by this policy.
How we handle sensor and field data, and who owns it, is set out in our Data Policy.
4. Personal information we collect
From website visitors
- IP address, browser and device type, pages viewed, referring page, and timestamps, through server logs
- Information you submit through our contact form: first and last name, email address, phone number, organization or farm name, location, acres under management, and any message content
From dashboard and mobile app users
- Account information: name, email address, organization, role and permissions
- Authentication data: a hashed password and session tokens
- Usage and audit logs: sign-in times, IP address, and actions taken in the dashboard, recorded against your name
- A phone number, if you use SMS verification
- A push notification subscription, if you turn on notifications
- A cryptographic hash of your email address, sent to Gravatar to look up a profile image
- Support correspondence
From customers and prospective customers
- Business contact information: name, title, organization, email address, phone number, mailing address
- Records of our communications with you, and a record of the source from which we obtained your business contact information
- Billing contact and invoicing information
We do not collect or store credit card or bank account numbers. Invoicing is handled through our accounting provider.
We do not intentionally collect sensitive categories such as health information, government identifiers, or precise personal location data. Please do not send us this information.
5. Why we collect it, and your consent
| Purpose | Examples |
|---|---|
| Providing the service | Creating and securing accounts, delivering sensor data to the right customer, technical support |
| Operating and improving our products | Diagnosing device and software faults, understanding which features are used |
| Detecting problems in the field | Automatically raising irrigation issues for review, as described in section 8 |
| Communicating with you | Service notices, outage and maintenance notifications, responses to enquiries |
| Sales and marketing | Contacting agricultural operations that may benefit from our products, sending updates you have asked for |
| Billing and administration | Invoicing, account records, tax and accounting obligations |
| Legal and safety | Meeting legal obligations, protecting our rights, investigating misuse or security incidents |
Under PIPA and PIPEDA we rely on your consent, which may be express (you complete a form or agree to terms) or implied (you provide your business card at a trade show, or you are an existing customer receiving service messages). In limited cases the legislation permits collection or use without consent, such as investigating a breach of an agreement or complying with a legal requirement.
You may withdraw consent at any time, subject to legal and contractual limits, by contacting us using the details in section 13. Withdrawing consent for the processing necessary to run the dashboard means we can no longer provide the service to you.
6. Commercial electronic messages
Every marketing email we send identifies Ensemble Scientific, Inc., includes our mailing address, and contains a working unsubscribe link that remains functional for at least 60 days. We action unsubscribe requests within 10 business days, as required by Canada's Anti-Spam Legislation (CASL). Unsubscribing from marketing does not stop essential service and account notices.
We obtain business contact information from publicly available business listings and websites, industry directories, trade shows, referrals, and direct enquiries. We keep an internal record of the source for each address.
7. Cookies and similar technologies
Strictly necessary cookies. We use first-party cookies required for our website and dashboard to function. On the dashboard these keep you signed in, maintain your session, and protect against cross-site request forgery. Our content delivery and security provider, Cloudflare, Inc., also sets a short-lived cookie used to distinguish human visitors from automated traffic and to protect the service from abuse. These cookies are necessary to deliver a service you have requested. You can block them in your browser settings, but the dashboard will not function without them.
Analytics. We do not use analytics cookies. We do not run a website or product analytics tool.
Local storage. The dashboard stores a small amount of information in your browser to remember your preferences between visits: the last page and organization you viewed, and whether you prefer light or dark mode. This information stays on your device.
Profile images. Our dashboard displays user profile images using Gravatar, a service operated by Automattic Inc. in the United States. When a profile image is requested, your browser sends Gravatar a cryptographic hash derived from your account email address, together with your IP address and the address of the page you are viewing. Gravatar may set cookies on your device. This happens whether or not you have a Gravatar account. If Gravatar has no image for your address, we display a locally generated image based on your initials instead, and nothing further is sent.
Spam protection. Our contact form is protected against automated submissions by our own systems: a hidden field that automated tools tend to fill in, a check on how quickly the form was completed, checks for randomly generated text, and a limit on submissions from a single network address. No third party is involved, and no additional information about you is collected for this purpose.
What we do not use. We do not use advertising cookies, third-party advertising or social media tracking pixels, or cross-site profiling of any kind.
8. Automated processing and artificial intelligence
For organizations that turn this feature on, we run automated checks that look for problems in the field and raise them for review. This is switched off unless it has been enabled for your organization.
Where it is enabled, we send information about your irrigation system — details of systems, zones and devices, their status, open issues, and recent activity from our audit log — to Anthropic, PBC, in the United States, for analysis. Because our audit log records who performed each action, this includes the names of the users concerned. We send internal discussion from our own Slack workspace about system performance for the same purpose.
Anthropic processes this information under commercial terms that do not permit it to be used to train their models.
The result is that irrigation issues are raised or resolved in your dashboard, marked as agent-generated. The automated system cannot control irrigation, and it cannot change or resolve an issue that a person has raised.
We do not use automated processing to make decisions about individuals.
9. Who we share personal information with
We do not sell personal information. We share it only as follows:
Service providers. We use third parties to run our infrastructure and business. Each is bound by contract to protect the information and use it only for the purposes we specify.
| Provider | Function | Where processed |
|---|---|---|
| DigitalOcean, LLC | Application, database, and backup hosting | United States (San Francisco region) |
| DigitalOcean Spaces | File and document storage | United States (San Francisco region) |
| Cloudflare, Inc. | Content delivery, bot management | Global edge network, US-headquartered |
| Google LLC (Google Workspace) | Business email, productivity, and outbound service email | United States |
| Resend, Inc. | Delivery of website contact form submissions | United States |
| Anthropic, PBC | Automated analysis of field data, as described in section 8 | United States |
| Slack Technologies, LLC | Internal team communication, and the source for the analysis in section 8 | United States |
| Twilio Inc. | SMS and phone number verification | United States |
| Functional Software, Inc. (Sentry) | Error and fault monitoring | United States |
| Folk | Customer relationship management, sales and marketing email | United States |
| Automattic Inc. (Gravatar) | User profile images | United States |
| Intuit Inc. (QuickBooks) | Invoicing and accounting | United States |
| Zipit Wireless, Inc. | Cellular connectivity for field devices | United States |
| UptimeRobot (Ubidots Cloud LLC) | Service availability monitoring | United States |
Our error monitoring records the technical details of software faults. These records can incidentally include an IP address or part of the request that failed.
If you turn on push notifications, delivery is handled by the push service operated by your browser or device vendor, which is typically Google, Apple, or Mozilla.
Within your organization. Dashboard data is visible to other authorized users at your organization, according to the permissions your administrator sets.
Business transactions. If we are involved in a financing, merger, or sale of assets, personal information may be disclosed to the parties involved, subject to confidentiality obligations and applicable law.
Legal requirements. We may disclose personal information where required by law, court order, or lawful request by a government authority, or where necessary to protect our legal rights or the safety of any person.
10. Storage outside Canada
Our servers and most of our service providers are located in the United States. Personal information we hold is therefore stored and processed in the United States, and while it is there it is subject to United States law and may be accessible to United States courts, law enforcement, and national security authorities under that law. We use contractual and technical measures to require comparable protection, but we cannot exclude the operation of foreign law.
For more information about our practices regarding service providers outside Canada, contact our Privacy Officer at the address in section 13.
11. How we protect personal information
We maintain safeguards appropriate to the sensitivity of the information, including:
- Encryption of data in transit using TLS, and encryption at rest for our databases and backups
- Regular automated backups, with restoration tested by standing up a complete replica database
- Role-based access control within the dashboard, so that each customer sees only their own data
- Individual named accounts for all personnel with access to production infrastructure, so that administrative actions are attributable to a specific person
- Multi-factor authentication available on user accounts, and required on administrative and infrastructure accounts
- Logging of dashboard activity and administrative access
No system is perfectly secure. If a breach of security safeguards occurs that creates a real risk of significant harm, we will notify affected individuals and the appropriate regulator as required by law. We maintain records of security incidents.
12. How long we keep it
We keep personal information only as long as necessary for the purposes described in this policy, or as required by law.
| Category | Retention |
|---|---|
| Dashboard account records | Retained while the account is active. Deleted on request, and reviewed periodically after an account is closed |
| Sensor and field data | As set out in our Data Policy and your customer agreement |
| Access and audit logs | 12 months |
| Marketing contact records | Until you unsubscribe. A suppression record is then kept indefinitely so that we do not contact you again |
| Consent records under CASL | 3 years after the end of the business relationship |
| Billing and accounting records | 7 years, as required by Canadian tax law |
| Support correspondence | 2 years |
Where we have used personal information to make a decision that directly affects an individual, we retain that information for at least one year so that the individual has a reasonable opportunity to request access to it, as PIPA requires.
13. Your rights, and how to reach us
You have the right to:
- Access the personal information we hold about you, and to be told how it has been used and to whom it has been disclosed
- Correct inaccurate or incomplete personal information
- Withdraw consent, subject to legal and contractual restrictions
- Ask questions or complain about our handling of your personal information
To exercise any of these rights, contact:
Privacy Officer
Ensemble Scientific, Inc.
[email protected]
3241 W 11th Avenue, Vancouver, BC V6K 2M9, Canada
We respond to access and correction requests within 30 business days, as PIPA requires. We may need to verify your identity first. In limited circumstances the legislation allows us to withhold information, for example where it would reveal personal information about another individual or is subject to solicitor-client privilege. If we refuse a request, we will tell you why and how you can challenge the decision.
14. If you are not satisfied
If we have not resolved your concern, you may complain to:
Office of the Information and Privacy Commissioner for British Columbia
[email protected] | 1-250-387-5629 | oipc.bc.ca
If you are in Alberta:
Office of the Information and Privacy Commissioner of Alberta
1-780-422-6860 | oipc.ab.ca
For matters falling under federal jurisdiction:
Office of the Privacy Commissioner of Canada
1-800-282-1376 | priv.gc.ca
If you are elsewhere in Canada, you may also contact the privacy regulator for your province.
15. Children
Our products and dashboard are intended for use by agricultural businesses and their staff. We do not knowingly collect personal information from anyone under 16. If you believe we have, contact our Privacy Officer and we will delete it.
16. Changes to this policy
We may update this policy as our products and legal obligations change. We will post the revised version at esci.io/privacy and update the "last updated" date. For material changes affecting how we use personal information, we will notify dashboard account holders by email and in the dashboard.