Privacy Policy

What we collect

• Account info: your name, work email, phone, company, and login credentials (passwords are hashed, never stored in plain text).
• Project data you enter: estimates, drawings, budgets, billing, schedules, documents, and similar.
• Worker / ProjectID info: profile, certifications, and — where you choose to record it — emergency and medical information for site safety.
• Site sign-in data: sign-in times and GPS location stamps for jobsite attendance and evacuation.
• Basic technical data: standard logs needed to run and secure the service.

How we protect it

• Each company's data is isolated — companies see only their own projects and people.
• Sensitive medical and emergency fields are encrypted at rest.
• Traffic is encrypted in transit (HTTPS).
• Payment cards are handled entirely by Stripe's hosted checkout — card numbers never reach our servers.

We are not yet SOC 2 or ISO 27001 certified, and we'll say so plainly rather than imply otherwise.

Where your data is stored

We use a small number of trusted service providers to run ProjectOS. Some of them process data outside Canada (in the United States), so by using ProjectOS you consent to that cross-border processing. We remain accountable for your information and require comparable protection from each provider:

• Hosting & database — Render (application, database, uploaded files). Processed in the United States.
• Off-site backups — Backblaze B2, encrypted, stored in Canada.
• Payments — Stripe (card processing & subscriptions). United States. We never receive card numbers.
• Email delivery — our email provider, used only to send account and reminder emails.

How we use it

Only to provide and improve the service — run your projects, process your subscription, send service and (with consent) reminder emails. We do not sell your data. We don't use your project data to advertise to you.

Sharing

We share data only with the providers that run the service (e.g. our hosting provider and Stripe for payments), or when required by law. If your company links a project with another company on ProjectOS, only what your company explicitly publishes is shared with them.

Consent

We collect and use personal information with your consent — given when you create an account, add information, or use a feature (for example, recording a worker's certifications, or opting into reminder emails). You can withdraw consent at any time by contacting us, subject to legal and contractual limits.

Your rights

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) you may:

• Access the personal information we hold about you and know how it's used;
• Correct information that's inaccurate or incomplete;
• Export a copy of your data;
• Delete your data, subject to legal/accounting retention;
• Withdraw consent or challenge our compliance.

Workers own their ProjectID profile. To exercise any right, contact our Privacy Officer below — we'll respond within 30 days. If you're not satisfied, you may complain to the Office of the Privacy Commissioner of Canada.

How long we keep it

We keep your information for as long as your account is active. When you close your account we remove your access and delete your data, retaining only what law or accounting obligations require (e.g. invoice records). Backups roll off automatically within about 30 days.

If there's a data breach

If a breach creates a real risk of significant harm, we will notify affected users and the Office of the Privacy Commissioner as required by PIPEDA, and tell you what happened and what to do.

Changes to this policy

We'll post any changes here and update the date above; material changes will be communicated to account admins.

Privacy Officer & contact

Our designated Privacy Officer is accountable for how we handle personal information. Privacy questions, access requests, or complaints: admin@projectos.ca.