Privacy policy

1. Who we are and what this covers

MARA is operated by Integrity Industries North Inc. (“IIN”, “we”, “us” or “our”). This policy covers the MARA mobile applications, mara.iinorth.com and MARA support communications.

MARA is a professional workspace used by participating organisations and their authorised users. We handle account, service administration and support information to operate MARA. We also process workplace records for the organisations that use it. Your organisation is responsible for its own collection and use of workplace information and may have additional privacy notices.

This policy does not replace the separate policies for the IIN corporate website, MARS, NorthStar or other third-party services. Information handled within MARA’s NorthStar approval tools is covered here; use of the separate NorthStar application is not.

2. Information we handle

• Account and access information: name, email address, sign-in identity, account activation status, company memberships, roles, invitations and access-change history.
• Work records: clients, projects, job locations and maps, crew information, daily activities, planned work, production and safety statistics, field tickets, rates and charges where your role permits them, revisions and audit records.
• Inventory and uploaded content: item descriptions, quantities, labels, serial numbers, condition, locations, report and inventory photos, company logos and imported files. Text, photos and files may contain personal information or location metadata supplied by you or others.
• AI inputs and results: audio, transcripts, photos, relevant report or inventory context, generated suggestions and the information you accept or save, as explained below.
• Communication information: recipient addresses, connected mailbox identity and authorisation tokens, email subject and body, PDF attachments, delivery records, support messages and notification settings.
• Approval information: applicant identity, associated device or access details, requested company access, decisions and audit history when you use MARA’s NorthStar administration tools.
• Technical information: account and device identifiers used by the service, push registration tokens, app or platform version, request timestamps, IP addresses and operational or error logs generated by our systems and hosting providers.

Information may come from you, your company’s administrators and authorised coworkers, or a service you connect. Please provide only information needed for the work and only information you are authorised to share.

3. Why we use it

We use this information to authenticate users; enforce company and role permissions; create, save and revise work records; manage inventory; generate charts, summaries and PDFs; provide optional AI assistance; deliver requested or configured communications; administer access approvals; investigate support issues; and protect and maintain the service.

We also use necessary records to meet applicable legal obligations and address disputes or misuse. We do not sell personal information or use MARA content for targeted advertising.

4. Your company and access

MARA workspaces are company workspaces, not private personal notebooks. Authorised users and managers can see information allowed by their company memberships and roles. Some warehouse views and management summaries combine information from more than one company where the recipient has the relevant access.

Managers assign MARA access separately for each company. A person’s NorthStar access does not automatically grant MARA access. Some accounts share underlying sign-in infrastructure, so privacy requests concerning both applications need to identify that scope.

We may access information where needed to operate, secure or support MARA. Your organisation may separately share reports with clients or other recipients and is responsible for those decisions.

5. Optional AI and voice

MARA uses OpenAI’s API services for AI-assisted features. These features process information outside your device:

Before starting an AI feature, MARA asks for permission and explains what that feature sends. You can decline and continue manually. Permission choices are remembered separately for each feature and signed-in account on this device or browser, and can be changed in Privacy & Account → AI permissions. Turning a feature off stops future use; it cannot recall information already sent. Device camera or microphone permission is a separate choice.

• Talk with MARA: microphone audio streams to OpenAI during the conversation. Relevant project, report date and report fields provide context. If you request a spoken email review, the sender, recipients and subject are also shared with OpenAI for that read-back. MARA does not keep a server-side archive of the full conversation audio or transcript; accepted report information is saved as part of the report. Live conversation text may appear on screen during the session.
• Dictation and guided voice: recorded audio is sent for transcription, and transcribed text may be processed to organise report entries. Audio processing and temporary device files are separate from saved report content.
• Inventory photo identification: the selected photo, relevant candidate item and asset details, warehouse locations and a pseudonymous user safety identifier are sent for analysis. This happens before you confirm the suggested inventory record. Confirmation can then save the photo, suggestion and corrected inventory details in MARA.
• Project Pulse and takeaways: relevant production and weather facts, and in some workflows activity text, are sent to generate or select a report suggestion. Accepted content becomes part of the saved report.

AI suggestions can be inaccurate. Review them before saving, issuing or sharing a record. You can use manual report and inventory entry without these AI features. Do not include unrelated conversations, sensitive personal details or confidential information you are not authorised to send for processing.

Provider processing and retention

Not storing a conversation in MARA does not mean that its provider retains nothing. OpenAI’s published API policy says content is not used to train models by default unless the customer opts in. Its default abuse-monitoring logs may include content and are retained for up to 30 days, with exceptions for legal or safety needs. Retention varies by endpoint and applicable controls. MARA’s requests to avoid storing certain AI responses do not eliminate all provider retention. See OpenAI’s API data controls.

6. Email and document sharing

If you connect Microsoft 365, Microsoft authorises the connection. MARA stores the mailbox identity and protected connection tokens, and sends the recipient addresses, message and PDF to Microsoft when you request a send. The connection requests identity, mail-sending and ongoing authorisation permissions, not permission to read your inbox.

You can disconnect a company mailbox in My email accounts. This removes that MARA company connection; it does not erase messages already delivered, remove separate company connections or necessarily revoke consent in Microsoft itself. Your Microsoft organisation’s policies also apply.

When you use a native mail or sharing app, MARA hands the selected PDF and message information to that app. Its provider controls subsequent processing and delivery. Copy controls place the selected recipients or subject on your device clipboard.

MARA also sends account invitations and service messages. Configured safety summaries are emailed to eligible managers using their company access; a manager with access to several companies may receive a combined document. Check recipients before sharing. Deleting a MARA record does not recall emailed or downloaded copies.

7. Device permissions and notifications

The camera is used for selected photo and scanning workflows; photo or file selection allows you to attach chosen content; the microphone is used for voice and dictation; and notification permission enables push messages. You can manage permissions in your device settings. Denying an optional permission limits the associated feature, not ordinary typed entry.

Push delivery uses Firebase Cloud Messaging and, on iOS, Apple Push Notification service. Registration associates a device token with your account. Notifications can include access-approval or service information and may appear on your lock screen depending on your settings. You can turn them off in MARA or device settings.

MARA uses configured job coordinates for maps and weather. The current MARA apps do not request phone GPS permission or perform background phone-location tracking. Location entered in a project or included in an uploaded file is still information processed by the service.

8. Providers and other disclosures

We use service providers to deliver MARA. Depending on the feature, these include:

• Supabase: authentication, databases, file storage and backend processing.
• Google Firebase and Apple: hosting and/or mobile push delivery, as applicable.
• OpenAI: the AI processing described above.
• Microsoft: connected-account authorisation and requested email sending.
• Resend: transactional account emails and configured safety-summary delivery.
• Google Maps and OpenWeather: maps and weather using job coordinates and related requests.

Providers receive information needed for their services and operate under applicable service terms and privacy obligations. A service you independently choose, such as your mail app, also has its own privacy practices.

We may disclose information when required by law, to respond to lawful requests, or where necessary and permitted by law to protect people, security or legal rights. Information may also transfer as part of a business transaction, subject to applicable privacy obligations.

9. Local storage and diagnostics

MARA and its sign-in services use browser or device storage for authentication sessions, preferences, notification choices and necessary working data. Selected photos, voice processing and PDF exports can create temporary files; downloads and files shared with other apps can remain on your device or in its backups.

Operational services can record technical logs needed for security, reliability and troubleshooting. MARA’s current app configuration disables Firebase Analytics collection and does not include advertising trackers. This does not mean that hosting, authentication or other providers produce no service logs.

Clearing local app data or uninstalling MARA does not delete your server-side account, company records or copies already exported to another app.

10. International processing

IIN is based in Canada. Our providers may store or process information in Canada, the United States or other countries where they operate. Information processed abroad may be subject to the laws and lawful access requirements of those countries. MARA does not promise that all information remains in Canada. Contact us with questions about cross-border processing.

11. Security

We use measures designed to protect information, including authenticated access, company and role restrictions, secure connections and protected Microsoft connection tokens. No system or transmission method is completely secure.

Keep your sign-in details private, secure your device and check recipients before sending documents. Do not send passwords, invitation links, security codes or API keys to support. Report suspected unauthorised access using the contact below.

12. Retention

We retain personal information only for as long as needed for the purposes described here and applicable legal requirements. The period depends on the record, your organisation’s use of MARA, applicable workplace, safety or financial recordkeeping obligations, and any necessary dispute or security investigation.

Account information, work records, uploaded files, audit history, delivery records and technical logs may have different retention needs. Issued documents and revision history are not automatically erased when a person leaves a company. Any continued retention of personal information must have a valid purpose or legal requirement; an audit trail is not a blanket exception to privacy rights.

When information is no longer required, it should be deleted or anonymised. Removal from active systems does not necessarily remove backup copies immediately; backups and provider-held records have separate lifecycles. We can explain the applicable handling when responding to a specific request.

13. Your choices and privacy requests

Depending on applicable law, you may request access to your personal information, correction of inaccurate information, withdrawal of consent where applicable, or deletion of information that is no longer needed. You may also raise a concern about how information is handled. Some requests may be limited by legal obligations or the rights of others.

Contact admin@summitgeoinc.com with your account email and a description of your request. Say whether it concerns MARA, NorthStar or both. Do not include your password. We may need to verify your identity and coordinate with your organisation. We will respond within applicable legal time limits and explain any information we cannot provide or delete and the reason.

To request MARA account deletion, use Privacy & Account in MARA or the online account-deletion request page. Sign in, verify ownership with an email code and confirm your request. The privacy team processes verified requests within 30 days and emails a receipt and completion notice. You can track your request and cancel before review begins. Contact us immediately if you want to stop a request already under review.

Removing a company membership or disabling sign-in is not the same as deleting an account and its associated personal information. A MARA request covers all your MARA companies, not separate NorthStar access. Shared sign-in information still needed for NorthStar remains for that purpose. We review personal information in work records, files, audit history, backups and connected providers for removal or anonymisation and explain legally required retention in the completion notice. The request itself does not immediately erase data. If you cannot access your account or email, contact us for help verifying ownership.

For your employer’s separate use of workplace records, you may also contact its privacy representative. You can raise an unresolved concern with the applicable privacy regulator, such as the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.

14. Children

MARA is a professional workplace service and is not directed to children. If you believe a child has provided personal information without appropriate authority, contact us so we can review and address it.

15. Policy changes

We may update this policy as MARA or applicable requirements change. We will date the published policy and provide additional notice or obtain consent where required for a material change. A policy update does not replace any permission or consent required for a new use of personal information.

16. Contact us

For product help, visit MARA Support. For the separate IIN website and MARS policy, visit IIN’s privacy policy.