Privacy Policy

1. Who is responsible

14926668 Canada Ltd., [CONFIRM: city, province], Canada, is responsible for personal information collected through SubcontractCheck. Our person in charge of the protection of personal information is [CONFIRM: privacy officer name], reachable at [CONFIRM: email].

2. What we collect

Account information: your email address, and if you choose to add them, your company name, trade, and default job location.

Contract documents you upload, and the reports we generate from them. Contracts often include names and contact details of people at your company and the general contractor.

Clauses you paste into the demo.

Billing information handled by Stripe. We never see or store your full card number.

Basic technical data: IP address (hashed before it is stored for rate limiting), browser type, and error logs.

3. Why we use it

To create and store your reports, run your account, take payments, send you service emails (for example, "your report is ready"), prevent abuse, and fix problems. We do not sell personal information and we do not use your contracts or reports to train AI models.

4. How long we keep it

Uploaded files are deleted as soon as the analysis finishes, whether it succeeds or fails. The text extracted from them is never saved. Reports are kept until you delete them or close your account. Billing records are kept as long as tax law requires.

5. Where it is stored and who processes it

Our database and file storage are hosted in Canada (Supabase, AWS Canada Central region).

Some service providers process data outside Canada, mainly in the United States: our AI provider (Anthropic) reads your document to produce the report, our hosting provider (Vercel) runs the application, Stripe processes payments, and Resend sends email. These providers act on our instructions under contracts that protect the information. Anthropic does not use data sent through its commercial API to train its models. [CONFIRM: retention terms of each provider and completion of a privacy impact assessment for transfers outside Quebec under Law 25.]

Information processed outside Canada may be accessible to courts and authorities in that country.

6. Your rights

Under PIPEDA and, for Quebec residents, the Act respecting the protection of personal information in the private sector (Law 25), you can ask to access or correct your personal information, withdraw consent, and ask us to delete it. You can delete reports and your whole account yourself from the app. Quebec residents also have the right to data portability and to be informed of automated decisions; SubcontractCheck produces reports, it does not make decisions about you.

If you are in the United States, you can make the same requests and we will honour them whatever state you live in.

To make a request, email us. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

7. Security

Files are stored in a private bucket, every database table uses row-level security so each account can only see its own data, all traffic is encrypted, and secrets never reach your browser. No system is perfect; if we ever have a breach that creates a real risk of significant harm, we will notify you and the regulators as the law requires.

8. Cookies

We use a sign-in cookie, and a cookie that remembers whether you chose Canada or the US. We do not use advertising or tracking cookies.

9. Changes

We will post any change here and tell you by email if it is significant.