Privacy Policy

Jobtract ("we", "our", or "us") operates https://jobtract.ca and related services (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our HVAC and trades business management platform, including our website, web and mobile applications, and integrations (e.g. QuickBooks Online, payment processors).

We are committed to protecting your privacy and handling your data in an open and transparent manner. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), and applicable provincial privacy laws. Where we serve users in the European Economic Area or the United Kingdom, we also comply with the GDPR and UK GDPR respectively. By using the Platform, you consent to the practices described in this policy to the extent consent is a valid legal basis. If you do not agree, please do not use our services.

We collect information that you provide directly, that we obtain automatically, and that we receive from third parties.

Information you provide

• Account and profile: Name, email address, phone number, company name, role, and profile photo when you register or update your account.
• Business data: Projects, jobs, quotes, invoices, expenses, equipment, customers, suppliers, and any other data you enter into the Platform.
• Payment and billing: Billing address, payment method details (processed by our payment providers), and subscription history where applicable.
• Communications: Messages you send to us or through the Platform (e.g. support requests, in-app messaging).

Information we collect automatically

• Usage data: How you use the Platform (e.g. pages visited, features used, time spent), device type, browser, and general location (e.g. country or region).
• Log data: IP address, access times, and referring URLs for security and troubleshooting.

Information from third parties

• When you connect integrations (e.g. QuickBooks Online), we receive data you authorize (e.g. chart of accounts, invoices) in accordance with that service's terms and your consent.

We use your information to:

• Provide, operate, maintain, and improve the Platform and customer support.
• Sync data with accounting and other integrations you enable (e.g. QuickBooks).
• Process payments and manage subscriptions.
• Send service-related communications (e.g. account notifications, security alerts).
• Send marketing communications where you have opted in; you may opt out at any time.
• Analyze usage to improve our products and user experience.
• Comply with legal obligations and enforce our Terms of Service and other policies.
• Protect the security and integrity of the Platform and our users.

Where required by applicable law (e.g. GDPR), we process your data based on:

• Contract: To perform our agreement with you (e.g. providing the Platform).
• Legitimate interests: To operate and improve our business, prevent fraud, and ensure security, where not overridden by your rights.
• Consent: Where we have asked for your consent (e.g. marketing, non-essential cookies).
• Legal obligation: To comply with laws (e.g. tax, anti-money laundering).

We do not sell your personal information. We may share your information in the following circumstances:

• Service providers: With vendors who assist our operations (e.g. hosting, email, analytics, payment processing) under strict data-processing terms.
• Integrations: With third-party services you connect (e.g. QuickBooks) only to the extent you authorize.
• Legal and safety: When required by law, court order, or to protect our rights, your safety, or the safety of others.
• Business transfers: In connection with a merger, sale, or other transfer of assets, subject to the same privacy commitments.

In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm to individuals, we will:

• Report to regulators: Notify the Office of the Privacy Commissioner of Canada (OPC) and, if the breach involves personal information of Quebec residents, the Commission d'accès à l'information (CAI), as soon as feasible and within the timeframes required by applicable law (generally 72 hours for Quebec Law 25 and GDPR; as soon as feasible under PIPEDA BCER).
• Notify affected individuals: Notify affected individuals as soon as feasible when the breach creates a real risk of significant harm, providing information about what happened, the type of information involved, and the steps we and they can take.
• Maintain breach records: Keep a record of every security breach involving personal information, regardless of whether it triggers the reporting obligation, for a minimum of 24 months from the date of the breach.

If you believe your personal information may have been compromised, or if you become aware of a potential security incident involving the Platform, please contact us immediately at privacy@jobtract.ca.

We use industry-standard technical and organizational measures to protect your data, including encryption in transit and at rest where applicable, role-based access controls, and regular security reviews.

We retain your information for as long as your account is active or as needed to provide services, comply with legal obligations, and enforce our agreements. Our general retention periods are:

• Account and profile data: Retained while your account is active and for up to 2 years after account closure to allow for reactivation or dispute resolution, then deleted or anonymized.
• Business transaction data (invoices, quotes, payments): Retained for a minimum of 7 years after the transaction date to comply with Canadian federal and provincial tax record-keeping requirements.
• Security and access logs: Retained for up to 12 months for security monitoring and incident investigation.
• Marketing communications preferences: Retained for the duration of our relationship plus a reasonable period to honour opt-outs.
• Backup copies: May persist for an additional period consistent with our backup rotation schedule (typically 90 days) before permanent deletion.

When we no longer need personal information, we delete or anonymize it in accordance with these retention periods. Statutory obligations (e.g. tax, anti-money laundering) may require us to retain certain data longer; in those cases, we will retain only what is required and limit access accordingly.

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you (PIPEDA / GDPR Art.15 / QC Law 25).
• Correction: Request correction of inaccurate or incomplete data (PIPEDA / GDPR Art.16 / QC Law 25).
• Deletion: Request deletion of your personal information, subject to legal retention obligations (GDPR Art.17 / QC Law 25).
• Portability: Receive your data in a structured, machine-readable format (GDPR Art.20 / QC Law 25).
• Object or restrict: Object to or request restriction of certain processing, including direct marketing (GDPR Art.18–21).
• Opt out of profiling: Object to processing of your personal data for profiling purposes where it produces decisions that significantly affect you (GDPR Art.21–22).
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Complain: Lodge a complaint with the supervisory authority in your jurisdiction (e.g. the OPC in Canada, the CAI in Quebec, or a GDPR supervisory authority in the EU/UK).

To exercise any of these rights, contact our Privacy Officer using the details in Section 15. We will acknowledge your request within 5 business days and respond substantively within 30 days (extendable by an additional 30 days for complex requests, with notice). We will not charge a fee for reasonable requests.

We use cookies and similar technologies (e.g. local storage) to keep you signed in, remember preferences, and understand how the Platform is used. For a detailed description of the cookies we use and how to manage them, see our Cookie Policy. Essential cookies are required for the Platform to function; you can control optional cookies through your browser or our cookie preferences where offered.

When you connect third-party services (e.g. QuickBooks Online, payment gateways), their privacy policies and terms also apply to data processed by those services. We only access data you explicitly authorize for the integration and do not control how those third parties use your data. A list of key sub-processors used to operate the Platform is available on request.

The Platform includes AI-powered features (such as automated estimates, job scheduling assistance, and an AI assistant) that may process your business data to generate suggestions, predictions, or recommended actions. These features are designed to assist you and do not make legally binding or similarly significant decisions about you automatically without human involvement.

Where AI or automated processing is used:

• Outputs are recommendations or drafts; final actions (e.g. sending a quote, approving a payment) require your explicit confirmation.
• You may choose not to use AI features at any time without affecting access to the core Platform.
• AI processing uses the business data you have submitted to the Platform and does not use sensitive personal data categories for AI model training without your separate consent.

If you have concerns about how AI features process your data, please contact us using the details in Section 15.

Your information is primarily hosted and processed in Canada. Our infrastructure and service providers (e.g. cloud hosting, database services) may process data in Canada, the United States, or other countries. Where transfers of personal information leave Canada, we rely on appropriate safeguards as required by applicable law, including contractual protections with our service providers. Transfers to the United States are governed by contractual clauses consistent with our obligations under PIPEDA and Quebec Law 25.

If you are located in the European Economic Area or the United Kingdom, transfers of your personal data outside those regions are made under appropriate transfer mechanisms (e.g. Standard Contractual Clauses). Contact us if you would like more information about these mechanisms.

The Platform is a business-to-business service intended for use by adults. You must be at least 18 years of age to create an account or use the Service. We do not knowingly collect personal information from individuals under the age of 18. If you believe we have collected such information, please contact us immediately and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated policy on this page and update the "Last updated" date. For material changes, we will provide at least 30 days' advance notice by email or through the Platform. Your continued use after the effective date constitutes acceptance of the updated policy. If you do not agree with a material change, you may close your account before it takes effect.

We have designated a Privacy Officer responsible for our compliance with PIPEDA, Quebec Law 25, and other applicable privacy laws. You may contact our Privacy Officer for any privacy-related questions, requests, complaints, or to exercise your rights under applicable law:

• Privacy Officer: Jobtract Privacy Office
• Email: privacy@jobtract.ca
• Website: https://jobtract.ca (use the Contact or Support form)

We will acknowledge your request promptly and respond within the time required by applicable law (generally 30 days under PIPEDA; 30 days under GDPR). If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca), the Commission d'accès à l'information du Québec if you are in Quebec, or the applicable supervisory authority in your jurisdiction.