Privacy Policy

Next Path Software Consulting Inc., doing business as Metered (“Metered”, “we”, “us”), is a corporation incorporated under the Canada Business Corporations Act, based in Ontario, Canada. Our Privacy Officer can be reached at compliance@metered.ca.

This policy explains how we handle personal information in connection with our website, our customer dashboard and APIs, and the services we provide: the TURN and STUN relay service, the Video SDK (calls, screen sharing and in-call chat), Recording and Composition, the Global Cloud SFU, Real-time Messaging, and any other service we offer from time to time (together, the “Services”). Capitalised terms not defined here have the meaning given in our Terms of Service at metered.ca/terms (the “Terms”) or in the agreement under which you receive the Services.

We act in two different roles, and this policy is written for both.

As a controller. We decide how and why we process personal information about visitors to our website and about the people who hold or administer a Metered account: contact, billing, login and support information, and the usage and diagnostic data we use to operate, secure, bill for and improve the Services. This policy governs that processing.

As a processor. When you use the Services in your own application, the personal information of your users that passes through or is stored in the Services is processed on your behalf and on your instructions. That processing is governed by our Data Processing Agreement at metered.ca/gdpr and by your agreement with us, and your own privacy notice applies to your users. Section 4 describes what each Service processes so that you can give your users accurate information.

If you are an end user of an application built on the Services, we have no direct relationship with you. The operator of that application is responsible for the personal information it collects through it, and questions or requests about your information should go to that operator. We will help the operator respond as our agreement with the operator provides.

Visitors to our website. When you visit metered.ca we collect the IP address, browser and device information, pages viewed, referring site and approximate location derived from the IP address of each visit, and any campaign identifiers in the link you followed, using the cookies and similar technologies described in section 6.

Account holders. To create and operate an account we collect the information you give us: name, company and company size, work email address, password (which we store only in hashed form), billing address, website, and the details of team members you invite. We keep the campaign identifiers and referral source recorded when you signed up with your account. If you sign in with Google, we receive your name, email address and Google account identifier from Google. We record the IP address and time at which you accept our Terms. We verify email addresses at signup, including through an email verification provider.

Payments. Payment card details are collected by our payment processor, Stripe, directly from you. We do not receive or store full card numbers. We receive and keep the information we need to bill you and to show your billing history: the card brand, expiry date and last four digits, invoice records, amounts and payment status.

Account activity. We collect records of how your account uses the Services, including API requests, credentials issued, configuration changes, usage volumes and the diagnostic and performance data generated when the Services are used. We keep logs of requests to our website, dashboard and APIs, including IP addresses, and records of administrative and security-relevant actions on your account.

Support and communications. When you contact us through the dashboard, email, chat or phone, or book a call with us, we collect the information you provide and the content of the conversation. When you use the dashboard, your name and email address are shared with our support platform so that we can help you.

Information from other sources. We may receive information about your organisation from publicly available sources and from the provider we use to verify email addresses.

In this section “you” means the customer whose application uses the Services. It describes what each Service processes on your behalf so that you can inform your users; the Data Processing Agreement governs the processing itself. Data that originates from your users’ devices is processed on your behalf to provide the Services. We use it for our own purposes only to secure the Services and as the Data Processing Agreement permits.

TURN and STUN relay. The TURN relay carries media and data between the endpoints of a connection when a direct connection is not possible; STUN only tells a device its public address and carries no media. To provide the relay we process connection metadata, including the IP addresses and ports of connecting devices, the credential used, timing and the volume of data relayed. We relay media as received, and we do not inspect, store or record it. Where media is encrypted end to end between the endpoints of the connection, we hold no keys to it and cannot access it.

Video SDK and Global Cloud SFU. Media in video calls, screen sharing and streams passes through our media servers, which is what allows calls to scale. It is encrypted between each participant’s device and our servers, and it is not encrypted end to end: our servers can access it. We access media only to provide the Services, including recording and composition when you enable them, for security and abuse prevention, and as required by law. We process participant information that your application supplies, such as display names, email addresses, external user identifiers and metadata, together with the device, browser and IP address information that comes with each participant’s connection, and we make session records available to you in your dashboard. In-call chat, where you enable it, runs on our own servers. You choose whether chat history is kept: not at all, or for up to twenty-four (24) hours. Files shared in chat are stored in cloud object storage and deleted automatically after twenty-four (24) hours.

Recording and Composition. When you enable recording or composition, we record or compose the media of the session and store the output in cloud object storage, encrypted at rest, until you delete it or close your account. You control who can access, download and delete recordings.

Real-time Messaging. Messages are delivered between your users’ devices through our servers. We do not store message contents. We process the IP addresses of connecting devices and connection metadata to deliver messages, to secure the service and to measure usage.

You are responsible for telling your users how their information is handled in your application, for obtaining any consents the law requires, including for recording, and for complying with the laws that apply to your use of the Services.

We use the personal information we collect as a controller to:

• provide, operate, secure and support the Services and our website, and administer your account;
• bill and collect fees, verify contact and billing information, and keep financial records;
• communicate with you about your account, your usage and the Services;
• send you information about our own products, services and offers, which you can opt out of at any time as described in section 11;
• assess new business accounts from the details provided at signup, to decide whether and how our sales team follows up and which plan information we send;
• detect, prevent and investigate abuse, fraud, security incidents and breaches of our agreements, including by blocking IP addresses and disabling credentials;
• understand how our website and Services are used, and to maintain, improve and develop them;
• comply with law, respond to lawful requests, and establish, exercise or defend legal claims; and
• for any other purpose we describe when we collect the information, or to which you consent.

Legal bases. Where the EU General Data Protection Regulation (GDPR) or similar law applies, we rely on the performance of our contract with you or your organisation for processing needed to provide the Services and administer the account; on our legal obligations, including tax and accounting records; on our legitimate interests in operating, securing and improving the Services, in marketing our own Services to business contacts, in preventing abuse and fraud, and in establishing, exercising or defending legal claims; and on your consent where the law requires it, for example for non-essential cookies. You may object at any time to processing based on our legitimate interests, including marketing, as described in section 11. Where Canadian privacy law applies, we rely on your consent, which may be express or implied from your relationship with us, and on the exceptions the law provides.

Aggregated and anonymised data. We may create aggregated or anonymised data from the information we hold as a controller, in a form that cannot reasonably be used to identify you or any individual, and we may use and share that data for any purpose, including to operate, analyse, improve and develop our Services. We will not attempt to re-identify it. From data we process on your behalf we derive only the usage and diagnostic data the Data Processing Agreement permits.

Artificial intelligence providers. We use AI providers, currently OpenAI and Anthropic, to help assess new business accounts as described above and to generate responses in AI-assisted features where you choose to submit content to them. They process the data on our behalf under business terms that do not permit them to use it to train their models.

We use cookies and similar technologies on our website and dashboard for the following purposes:

• Essential. To keep you signed in, remember your settings, secure the site and dashboard, protect against automated abuse, enable payment through Stripe, and provide support chat through Help Scout. These are necessary for the Services and for supporting you. On signup and login we use Google reCAPTCHA, to which Google’s privacy policy applies.

• Analytics. To understand how the website and dashboard are used. We use Plausible, which sets no cookies, and Google Analytics.

• Advertising measurement. To measure the effectiveness of our own advertising, using Google Ads conversion tracking.

Where the law requires your consent, we set non-essential cookies only after you accept them through the cookie control on our website and dashboard, and you can change your choice there at any time. You can also block or delete cookies through your browser settings; some features may then not work. We do not use cookies to show you third-party advertising.

The main cookies we use are:

Durations are those set by the provider and may change; the cookie control shows the current list.

We do not sell personal information. We share personal information only as follows.

Service providers. We use providers that process personal information for us. They currently include: Stripe (payments and invoicing); Postmark (email delivery); Help Scout (support desk and in-page chat); Google (analytics, advertising measurement, sign-in, bot protection, and business email and productivity tools); Plausible (analytics); Calendly (call scheduling); Twilio and VoIP.ms (telephone support); an email verification provider; OpenAI and Anthropic (as described in section 5); Amazon Web Services (storage of recordings and chat files); content delivery networks and font providers that serve parts of our website; and the hosting providers on which the Services run. Most of these providers act for us under contracts that restrict their use of the information to providing their services to us. Google may also use information collected through its own services, such as sign-in, reCAPTCHA and advertising measurement, as described in Google’s privacy policy. Providers that process personal information on your behalf as part of the Services are listed, with their locations, in the Data Processing Agreement at metered.ca/gdpr.

Affiliates. We may share personal information with entities under common control with us, which handle it in accordance with this policy.

Legal and safety. We may disclose personal information where the law requires or permits it, including to comply with a subpoena, court order, warrant or other legal process, to respond to lawful requests from public authorities, to protect the rights, property or safety of Metered, our customers or others, and to enforce our agreements. Where the law permits and it is practicable, we will tell you before we disclose your personal information in response to legal process. Personal information we process on your behalf is disclosed only as the Data Processing Agreement and your agreement with us allow, or as the law requires.

With your direction. We share personal information when you ask us to, for example when you connect a third-party service to your account.

Our primary systems are located in Canada. The Services run on servers in many regions around the world, so that traffic can be relayed close to your users, and connection metadata is processed in the regions that serve your traffic. Recordings and files shared in chat are stored in the United States. Several of our service providers are located in the United States or operate globally.

Where personal information from the European Economic Area, the United Kingdom or Switzerland is transferred to Canada, we rely on the adequacy decisions that recognise Canadian privacy law. For providers outside Canada we rely on contractual protections and, where available, their participation in recognised transfer frameworks; a description of the protections that apply is available on request. Information about your users that we process on your behalf is transferred as the Data Processing Agreement describes, and you can restrict the regions from which the relay service is provided as set out there. If you are in Quebec, personal information may be communicated outside Quebec, including to other provinces and to the countries described above.

We protect personal information with administrative, technical and physical safeguards appropriate to its sensitivity, including encryption of data in transit over public networks, encryption at rest for recordings, restricted and logged administrative access, and monitoring. Our staff access account information only to provide and support the Services, for security and abuse prevention, for billing, and to comply with law. No method of transmission or storage is completely secure, and you are responsible for keeping your credentials confidential and for the security of your own systems. Where a security breach affecting personal information occurs, we will notify affected persons and authorities as the law requires, and our customers as the Data Processing Agreement provides.

We keep personal information for as long as needed for the purposes described in this policy, and longer where the law requires, to resolve disputes or to enforce our agreements. In particular:

Copies may persist in routine backups until they are deleted in the ordinary course.

Your rights. Depending on where you live, you may have the right to ask for access to the personal information we hold about you, to have it corrected or deleted, to receive a copy in a portable form, to object to or restrict certain processing, and to withdraw consent where processing is based on it. You can exercise these rights by emailing compliance@metered.ca. We may need to verify your identity before responding, and we will respond within the time the law requires. These rights are subject to exceptions, for example where we must keep information to meet a legal obligation or to complete a transaction.

Account information. You can review and update your account details, manage payment methods, and delete recordings in your dashboard. You can ask us to close your account and to delete the personal information we hold about you as a controller, subject to the retention periods in section 10.

Marketing. We may send you information about our own products and services based on our relationship with you. Every marketing email includes an unsubscribe link, or instructions to reply STOP, and we will act on your request promptly. Messages about your account, billing, security and the operation of the Services are not marketing and continue for as long as you have an account.

End users. If your information was collected by an application that uses the Services, please contact the operator of that application, which is responsible for it.

Complaints. If you have a concern about how we handle personal information, contact our Privacy Officer at compliance@metered.ca and we will work with you to resolve it. You may also lodge a complaint with the Office of the Privacy Commissioner of Canada, with the Commission d’accès à l’information du Québec, or with the data protection authority in your country.

We use automated tools to protect the Services and to run our business, including automated abuse-prevention controls that can block IP addresses or disable credentials, billing controls that can suspend access when a balance is exhausted or a payment fails, and the assessment of new business accounts described in section 5. The account assessment uses the details you give at signup, such as company size and intended use, and affects only the information and follow-up you receive from us, not your access to the Services. Where an automated decision significantly affects you, you may contact support@metered.ca to ask for human review and for the principal factors behind it.

The Services are provided to businesses and are not directed to individuals under 18. We do not knowingly collect personal information from children in our own capacity, and customers that use the Services in applications available to minors are responsible for complying with the laws that protect them.

We may update this policy from time to time. We will post the new version at metered.ca/privacy with its version number and effective date. Where a change materially reduces your rights under this policy, we will notify account holders by email at least thirty (30) days before it takes effect. The version posted at metered.ca/privacy applies from its effective date. Where a new purpose requires your consent, we will ask for it.

Privacy Officer: compliance@metered.ca

Support: support@metered.ca or +1 (647) 483-3172

Next Path Software Consulting Inc. DBA Metered.