PIPEDA · Law 25 · Privacy by design

PIPEDA and Law 25, principle by principle.

Compliance is easiest when there is almost nothing to comply about. Tuti Tuti collects an email, a name, a plan, and a count of seconds. Here is how each principle is met, in plain words.

What personal information exists, and why

Email address and name, to sign you in and reach you about your account. Plan and exported seconds, to apply the free minute and the licence. A Stripe customer reference, if you buy the licence, so a receipt can be found. Support email, while a question is being answered. That is the complete inventory. Scripts, recordings, page content, and screenshots are never collected, which removes most of what a privacy law governs before it starts.

PIPEDA's ten principles, applied

Schedule 1 of the Act, in the order it lists them.

01

1. Accountability and 2. Identified purposes

A named person in charge of personal information, reachable at hello@tutituti.ca. Every item collected has one stated purpose above, and no other use.

02

3. Consent and 4. Limiting collection

You create the account yourself and agree to the policy. Nothing is collected beyond the inventory; there is no analytics, telemetry, or tracking.

03

5. Limiting use, disclosure, and retention

Used only to run your account. Disclosed to Stripe for payment and Firebase for sign-in, nothing else. Deleted when you delete the account; invoices kept only as tax law requires.

04

6. Accuracy and 7. Safeguards

You can correct your name and email any time. Data in Canada, encrypted at rest and in transit, access limited to Pandacat staff who operate the service, Firestore rules that let only you read your record.

05

8. Openness and 9. Individual access

The privacy policy and this page say everything. Your account page shows what we hold; a copy is available on request within thirty days.

06

10. Challenging compliance

Write to hello@tutituti.ca. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada, or to the Commission d'accès à l'information in Quebec.

Quebec Law 25

The obligations Law 25 adds, and how each is met.

A person in charge of the protection of personal information, named in the policy. Privacy by default: no optional collection is on unless you turn it on. A privacy impact assessment for the account system, on file. Transfers outside Quebec assessed and documented: the sign-in directory only. Confidentiality incidents logged and reported where required. The right to portability: your record in a structured format, on request.

Exercise your rights

1

See

Your account page shows your plan and usage. Ask for a full copy by email.

2

Correct

Change your name or email on the account page or by email.

3

Delete

One step on the account page, or by email within thirty days.

PIPEDA and Law 25: the questions people ask

Is Tuti Tuti PIPEDA compliant?
Tuti Tuti is built to PIPEDA's ten principles, as this page lays out, and collects the minimum needed to run an account. PIPEDA has no certification; what exists is the design, the policy, and a named person accountable for them.
Is it Law 25 compliant?
It is built to Law 25's obligations: a named person in charge, privacy by default, an impact assessment for the account system, documented transfers, incident handling, and portability. The design keeps application content off our systems, which is what makes those obligations light.
Does my recorded content fall under these laws?
Your recordings stay on your computer and are never sent to Pandacat, so for Tuti Tuti's part there is nothing to govern. What you do with a video you made is yours to assess, and the privacy blur exists to help.
What leaves Canada?
Your account record stays in Canada. If you choose Sign in with Google, Google confirms your identity from the United States; payment details go to Stripe. Narration text goes to the voice service you use, from your browser.
How long is my data kept?
As long as your account exists. Delete the account and it is removed, except invoices Stripe must keep under tax law for the period the law requires.
Who do I contact?
The person in charge of personal information at hello@tutituti.ca. Complaints can go to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.

Almost nothing to comply about, and all of it written down.

Read the privacy policy, then ask us anything.

Tuti Tuti - powered by Pandacat.