LEGAL
Thermal Sky Privacy Policy
Version 1.0 · Effective 25 August 2026
Thermal Sky is a sole proprietorship registered in British Columbia, operated by Daniel Sabitoff from Port Moody, BC. This policy explains what personal information Thermal Sky collects, why, how it is used, where it is stored, how long it is kept, and how you can ask questions or make a complaint.
Thermal Sky follows the Personal Information Protection Act (British Columbia). Where personal information crosses a provincial or national border, the Personal Information Protection and Electronic Documents Act (Canada) may also apply. Commercial email follows Canada’s Anti-Spam Legislation.
Personal information means information about an identifiable individual. Business contact information used to reach a person in their business role (name, title, work email, work phone) is treated as business contact information under PIPA, and this policy applies to it only where the law requires.
1Privacy contact
Daniel Sabitoff is responsible for Thermal Sky’s compliance with this policy and with PIPA.
Email: daniel@thermalsky.ca
Location: Port Moody, British Columbia
Mailing address: provided on request, and included in every commercial email Thermal Sky sends, as CASL requires.
Use this contact for questions, access requests, corrections, withdrawal of consent, and complaints.
2What is collected, from whom, and why
2.1Website visitors
Thermal Sky uses Cloudflare Web Analytics on thermalsky.ca. Cloudflare states that its Web Analytics does not use cookies or local storage and does not fingerprint visitors by IP address or browser details. Thermal Sky sees aggregate figures only: page views, referring sites, country, browser and device type, and page performance. Thermal Sky does not use advertising cookies, tracking pixels, or retargeting.
The website is hosted by OVHcloud. Like any web host, OVHcloud keeps standard server logs (IP address, time, pages requested) for security and operations under its own retention rules, and its privacy policy applies to those logs.
2.2Contact form
The form on thermalsky.ca collects the details you type in: the capture type you are asking about, your name or company, your email address, the site address, a preferred capture date, and any notes you add. The form then asks for one further detail depending on the capture type: the approximate roof area for a roof thermal capture, the number of storeys for a building-envelope capture, or whether you want the roof, the facade or both documented for RGB work. The site address is required, not optional. Fields that do not apply to the capture type you choose are removed from the form and are not sent.
Nothing else is collected. There is no account and no login. The only hidden fields are the form’s own delivery settings and a spam honeypot, which stays empty for people and is discarded when a bot fills it.
The form is processed by Web3Forms, which delivers each submission by email to daniel@thermalsky.ca. Web3Forms is operated from India and uses infrastructure in several regions. Thermal Sky has set Web3Forms to keep its copy of each submission for one year, after which Web3Forms deletes it. Web3Forms passes the sender’s IP address and email address to spam filtering services (CleanTalk and Akismet). Web3Forms’ privacy policy and data processing agreement are published at web3forms.com.
Why: to answer your enquiry, prepare a quote, and schedule a capture. By sending the form you consent to this use for that purpose.
If you would rather not use the form, email daniel@thermalsky.ca directly.
2.3Email, phone and quotes
When you email or call, Thermal Sky keeps the correspondence, your contact details, and any documents you send. When you request a quote, Thermal Sky records the site address, the scope, the property owner’s authorization where relevant, and the quote itself.
Why: to prepare and deliver the service you asked for, and to keep a record of what was agreed.
2.4Clients and engagements
For each engagement Thermal Sky keeps: client name and business, contact details, site address and access notes, the quote and any signed documents, the acquisition record, the delivery manifest, invoices, payment records, correspondence about the job, and its own copy of the capture files.
Why: to perform the engagement, invoice it, keep the tax and business records the law requires, re-send files on request, and deal with any question or claim about the work afterwards.
2.5Drone imagery
Thermal Sky captures radiometric thermal and visual (RGB and zoom) images of the roof, facade or site named in the quote, from the air, at the times agreed with the client. The images are the client’s deliverable and are handled under the client’s instructions and the Terms of Service.
Aerial imagery can incidentally include neighbouring properties, vehicles, or people on or near the site. Thermal Sky limits this by:
- flying to the scope in the quote and not beyond it
- capturing in the evening or after dark, when fewer people are present
- keeping the aircraft at least 5 metres horizontally from anyone not involved in the work and never flying over people
- not pointing the zoom camera at people, at windows, or at neighbouring properties on purpose
- reviewing the frames before delivery and withholding any that show identifiable people, licence plates, or room interiors and are not needed for the client’s scope. Withheld frames are deleted from Thermal Sky’s copy during processing, and the acquisition record states how many were withheld. Frames are withheld whole, not cropped, because cropping destroys the temperature data in the file.
On facade work at night, visual (RGB) frames can show lit windows. Those frames are reviewed under the rule above. The thermal camera does not see through glass.
Thermal Sky does not use drone imagery to observe, follow, or profile any individual, and does not deliver imagery for that purpose. Clients agree in the Terms of Service not to use the files for that purpose and to delete, on request, any delivered frame later found to show an identifiable person, licence plate or interior that is not needed for the scope.
If you believe a Thermal Sky flight captured images of you or your property, contact daniel@thermalsky.ca with the location and the approximate date. Thermal Sky will check its own records, answer without identifying its client, the site, or the purpose of the flight, delete any such frame from its own copy where the frame is not needed for the client’s scope or required by law, and ask the client to do the same.
2.6Flight and aircraft records
Transport Canada requires Thermal Sky to keep a record of each flight (pilot name, date and time of the flight) for 12 months and maintenance records for 24 months (Canadian Aviation Regulations section 901.48).
The remote controller stores a flight log for every flight: the aircraft’s GPS track, altitude, speed, battery state and flight parameters. Thermal Sky syncs these flight logs to DJI’s flight record service through the DJI Pilot 2 app, so that they are backed up and available for the records Transport Canada requires and for aircraft support. DJI stores synced flight records under its own privacy policy (dji.com/policy) on servers that may be outside Canada. Captured images and thermal files are not part of flight record sync.
Why: legal requirement, flight safety, aircraft support, and records for insurance or regulatory questions.
2.7Prospective clients (outreach)
Thermal Sky sends one-to-one emails to people at roofing, building envelope, restoration, engineering and property firms whose business email address has been published by them or by their organization, for example on the organization’s website or in a professional listing, and only where the service is relevant to the person’s role and no statement accompanies the address asking not to receive unsolicited messages. This is the implied consent that CASL allows for a conspicuously published business address. Where an existing business relationship gives consent, Thermal Sky relies on that instead.
Every such email identifies Thermal Sky, gives Thermal Sky’s mailing address and an email address, and includes a way to opt out. Opt-out requests are honoured without delay and no later than 10 business days. Thermal Sky does not buy contact lists and does not send bulk campaigns.
Why: to offer Thermal Sky’s services to businesses likely to need them.
2.8Testimonials, references and portfolio
Thermal Sky asks for express written permission before publishing a client’s name, logo, quote, or any image that identifies a client or a site. Portfolio use of de-identified excerpts is covered in the Terms of Service (excerpts only, no client name, no address, no full roof plan or elevation, no identifying building features, no people), and clients can opt out.
3Consent
Thermal Sky collects personal information with your consent, except where PIPA allows collection without it (for example, where required by law, or where business contact information is used to contact you in your business role).
Consent is deemed when you volunteer information for an obvious purpose, such as sending the contact form to ask for a quote.
You can withdraw consent at any time by emailing daniel@thermalsky.ca. Thermal Sky will explain the consequences, if any, before acting on the withdrawal. Withdrawal does not apply to information Thermal Sky must keep by law, or to work already delivered.
4Use and disclosure
Thermal Sky uses personal information only for the purposes in section 2 and purposes a reasonable person would consider appropriate in the circumstances. Thermal Sky does not sell, rent or trade personal information, and does not share it with anyone for their own marketing.
Capture files, site information and client documents are not uploaded to third-party artificial intelligence services and are not used to train any model.
Thermal Sky discloses personal information only:
- to service providers listed in section 5, for the purposes stated there
- to the client for whom a capture was performed (imagery of the site and the acquisition record)
- to an insurer, adjuster or lawyer if needed to deal with a claim or a legal matter
- to Transport Canada, NAV CANADA, police or another authority where the law requires or permits it
- to a buyer or successor if Thermal Sky is sold or transferred, subject to this policy
5Service providers and storage outside Canada
Thermal Sky uses these providers. Each one may store or process information outside Canada, where it is subject to the laws of that country, including access by courts and authorities there.
| Provider | What it does | Where data may be stored |
|---|---|---|
| Google Workspace (Gmail, Drive, Calendar) | Email, quotes, invoices, file storage, delivery of files to clients | United States and other countries where Google operates data centres |
| Web3Forms | Processes the website contact form and emails submissions to Thermal Sky | India and other regions (AWS, Hetzner in the EU, Cloudflare); submissions kept for one year by Web3Forms |
| Cloudflare | Cookieless website analytics | Global network, including the United States |
| OVHcloud | Hosts the website and keeps standard server logs | Canada and other countries where OVHcloud operates data centres |
| Stripe | Processes invoice payments. You enter card or bank details directly with Stripe; Thermal Sky sees the payer name, email, amount and the last digits of the card, not the full card number. Stripe’s privacy policy is at stripe.com/privacy. | United States and other countries |
| Notion | Scheduling and job tracking | United States |
| DJI (DJI Pilot 2, DJI Thermal Analysis Tool 3, DJI flight record service) | Flight control, processing of thermal files, and backup of flight logs. Flight logs with the aircraft’s GPS track are synced to DJI. Captured images and thermal files stay on the aircraft, the controller and Thermal Sky’s own storage. | DJI servers, which may be outside Canada, under DJI’s privacy policy |
Thermal Sky holds each provider to its published privacy and security commitments and shares only what each one needs.
6Retention
| Information | Kept for |
|---|---|
| Website analytics | Aggregate only. No individual records held by Thermal Sky. |
| Contact form submissions and enquiries that do not become a job | 12 months after the last contact, then deleted at Thermal Sky’s next annual records review. Web3Forms keeps its own copy for one year. |
| Quotes not accepted | 12 months after the quote date, then deleted at the next annual records review |
| Engagement records (contact details, site address, quotes, signed documents, acquisition record, delivery manifest, invoices, payment records, correspondence) | Six years from the end of the year they relate to. This is the period the Canada Revenue Agency requires for business records, and it covers the time in which a claim about the work could be made. |
| Thermal Sky’s copy of the capture files (thermal and RGB images, image index, site map) | Six years from the end of the year of delivery, for re-delivery, records, insurance, regulatory purposes and the defence of any claim. A client may ask in writing for earlier deletion of the image files; Thermal Sky then deletes them within 10 business days, confirms in writing, and keeps only the acquisition record, image index and delivery manifest. |
| Frames withheld for privacy (identifiable people, licence plates or interiors not needed for the client’s scope) | Deleted during processing, before delivery. The acquisition record states how many were withheld. |
| Flight records required by Transport Canada | 12 months (flight) and 24 months (maintenance) after creation, per CARs 901.48. Flight logs synced to DJI are kept by DJI under its own policy. |
| Outreach contact details | Deleted when Thermal Sky stops contacting that organization, or immediately on an opt-out request (the email address is then kept on a suppression list only, so it is not contacted again) |
| Information used to make a decision that directly affects you | At least one year after the decision, so you can ask for access to it |
When information is no longer needed, Thermal Sky deletes it or makes it anonymous.
7Security
Thermal Sky is a one-person operation and the only person with access to its records is Daniel Sabitoff. Safeguards include:
- two-factor authentication on the Google Workspace account and on other provider accounts that support it
- device encryption and passcodes on the computer and phone used for the business, and a passcode on the remote controller
- capture files moved from memory cards to encrypted storage after each job, and memory cards wiped before reuse
- files delivered to clients by a private link shared to the client’s named email address, not by public posting or open links
- no personal information stored on paper other than what a client hands over on site, which is scanned and shredded
If personal information is lost, stolen or accessed without authorization, Thermal Sky will contain the incident, assess the risk, notify the affected people without unreasonable delay where there is a real risk of significant harm, and notify the Office of the Information and Privacy Commissioner for British Columbia where appropriate.
8Your rights
You may ask Thermal Sky:
- what personal information it holds about you, how it has been used, and who it has been disclosed to
- to correct information that is inaccurate or incomplete
- to stop contacting you
- to delete information Thermal Sky is not required to keep
Send requests to daniel@thermalsky.ca. Thermal Sky will respond within 30 business days, as PIPA requires, and will tell you if it needs more time and why. There is no fee for an access request unless the law allows one, and Thermal Sky will tell you in advance. Thermal Sky may need to confirm your identity before releasing information.
If Thermal Sky refuses a request in whole or in part, it will explain why and tell you that you may ask the Commissioner to review the decision.
9Complaints
Raise any concern with daniel@thermalsky.ca first. Thermal Sky will acknowledge it and answer within 30 business days.
If you are not satisfied, you may complain to:
Office of the Information and Privacy Commissioner for British Columbia
Website: www.oipc.bc.ca
Email: info@oipc.bc.ca
Phone: 250-387-5629
There is no fee to complain to the Commissioner.
10Children
Thermal Sky’s services and website are for businesses and property professionals. Thermal Sky does not knowingly collect personal information from anyone under 19 and will delete it on request.
11Changes to this policy
Thermal Sky may update this policy. The current version is always at thermalsky.ca. The version number and effective date at the top show when it last changed. A change that materially affects how your information is used will be sent to active clients by email before it takes effect.
12Definitions
- PIPA: Personal Information Protection Act, SBC 2003, c. 63 (British Columbia).
- PIPEDA: Personal Information Protection and Electronic Documents Act, SC 2000, c. 5 (Canada).
- CASL: An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, SC 2010, c. 23, commonly called Canada’s Anti-Spam Legislation.
- CARs: Canadian Aviation Regulations, SOR/96-433.
Thermal Sky Privacy Policy, version 1.0. Effective 25 August 2026. See also the Terms of Service.