Privacy Policy

Two kinds of information

Account information: your name, email address and password, used to give you access. We are responsible for this information.

Company information: everything a construction company enters in Trade Manager, such as clients, suppliers, employees, hours, expenses, estimates, contracts, invoices and payroll. The company that subscribes is responsible for this information and decides how it is used. We process it on the company's behalf, only to provide the service.

What we collect

What you and your company enter in the app, including files and photos you upload.

Employee information that companies record for payroll. Social Insurance Numbers, allergies and medical conditions are encrypted by the app before they are stored, can only be seen by people with payroll access, and each time a Social Insurance Number is shown it is recorded.

A record of sensitive actions in each company, such as who viewed private data, changed access or downloaded data. Owners and Admins of that company can see it.

Technical information needed to run the service securely, such as the type of browser that signed a contract and request counts used to prevent abuse.

We do not sell personal information and we do not use it for advertising.

Cookies and storage on your device

We use only the cookies needed to keep you signed in. We do not use advertising or analytics cookies.

On phones, the app keeps a small amount of information on the device so clock marks and expenses can be recorded without signal. It is sent as soon as there is a connection and the offline screen's access is cleared when you sign out.

Where information is kept

The database and uploaded files are stored in Canada (Montréal) with Supabase.

The application runs on Vercel. Requests are currently processed on servers in the United States, so information may pass through the United States while it is being processed. [Review: move processing to a Canadian region if available.]

Service providers we use: Supabase (database, sign-in and file storage) and Vercel (hosting). When these features are turned on, we will also use Stripe (subscription payments), Resend (email) and Anthropic (optional AI writing help). Each provider only receives what it needs for its task.

How we protect it

Connections are encrypted (HTTPS). Information is encrypted at rest by our providers, and Social Insurance Numbers and health information are additionally encrypted by the app with a key kept separately from the database.

Each company's information is isolated from every other company's at the database level. Staff access to the platform requires two-factor authentication.

If a breach creates a real risk of significant harm, we will notify the affected people and the Office of the Privacy Commissioner of Canada, as the law requires.

How long we keep it

Company information is kept while the company's subscription is active. After a subscription ends, the information is kept for [90] days so it can be exported, and then deleted. Backups are deleted within [35] days after that.

Account information is kept while you have an account.

Your choices

You can ask to access or correct your personal information, or withdraw consent, by contacting us. Employees and clients of a company should first contact that company, since it controls their information.

A company Owner can download all of the company's information at any time from Company Settings, as an Excel workbook or as CSV files.

Contact

Privacy Officer: [name], [email address, for example privacy@trademanager.ca], [mailing address].

If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.