Privacy policy

Who we are, and the two roles we play

wearpoint is a multi-tenant platform for equipment-fleet inspections. We handle personal information in two distinct roles, and your rights depend on which applies:

When we are the accountable organization. For the account, contact, and billing details of the customer who signs up, for visitors to our marketing website, and for our own technical, analytics, and security logs, we decide why and how the information is used and we are accountable for it. Payment card details are entered on pages hosted by our payment processor, Stripe, and go to Stripe directly: we never receive or store card numbers.

When we act as a service provider for your organization. When an employer organization invites its crew and records their work, the employer transfers that personal information to us to process on its behalf. This includes crew names, emails, phone numbers, timekeeping hours, inspection records, and work orders. For that information the employer organization is accountable, and we act on its instructions. If you are a worker and want to access or correct this data, or ask to delete it, contact your employer first, as “Your rights” describes. (Some privacy laws call these two roles “controller” and “processor”.)

The written terms under which we act as an organization’s service provider are part of our Terms of Service, in “Acting as your service provider.”

What we collect

We collect only what the service needs:

• Account and contact details — name, email, and phone number, provided by you or by the organization that invited you.
• Inquiries — if you request a demo or contact us from the website, the name, company, contact details, and message you send, together with when and where on the site you sent them. We use these to respond and follow up about the product, and for nothing else.
• Operational records — the machines, inspection templates, inspections, issues, and work orders created in the app.
• Worker hours — tap-in/tap-out session times used for timekeeping. This is employment-related information and is treated with care.
• Technical data — device, log, and usage data needed to operate, secure, and troubleshoot the service.

How we use it

We use it to provide and secure the service: to authenticate you, deliver account and onboarding messages, keep the operational records your organization relies on, send the notifications you have configured, and maintain, debug, and protect the platform. We do not sell your personal information, and we do not use it for advertising.

Consent and legal basis

For information we are accountable for, we rely on your consent and on the reasonable needs of operating the service you signed up for, consistent with PIPEDA and Alberta’s PIPA. For information we process on behalf of an employer, that organization is responsible for having the appropriate basis and for informing its workers. You can withdraw consent or ask us to stop a specific use, subject to legal and contractual limits.

Who we share data with

We share personal information only with the service providers (subprocessors) that help us run wearpoint, under contracts that limit them to our instructions. We do not sell or rent personal information.

We may also disclose information where required by law, or to protect the rights, safety, and security of our users and the service.

AI processing

wearpoint uses an AI provider (Anthropic’s Claude) for two features, and every request is processed in the United States. Each sends the AI provider only the fields listed here:

• Maintenance-schedule suggestions, made only on request, send the machine’s make, model, year, and category, and its serial number/VIN when one is recorded. This is equipment identification only: a suggestion sends no personal information and no free text.
• Work-order repair estimates, made the first time a work order is opened, send the machine’s make, model, year, and category; the work order’s failure category and engine hours at failure; and the work order’s title and description.

A work order’s title and description are free text written by your team, and can contain personal information — a name, for example — if someone types it there. A copy of what was sent is kept with each suggestion and estimate, as part of the machine’s or the work order’s record. The model is instructed to abstain when it does not recognize the equipment or the information is too thin to support a credible answer. AI output is advisory only.

How long we keep it

The records an organization enters — its machines, inspections, defects, tap-in sessions and hour readings, work orders and repairs, with the names of the people who made them — are kept while its account is open. After the account is closed (or, for an account no owner closes, after its last subscription ends), they are kept for 10 years so the organization can rely on them as evidence of its own compliance. The organization can tell us to delete them sooner. At the end of that period they are deleted or anonymized. Names typed into free-text fields, such as a work-order description, and the copies of that text sent for AI estimates, are kept with the record they belong to.

When an account is closed, the phone numbers and email addresses of its members other than its owners are removed, and the owners keep read-only access to export the records.

Unless the organization instructs otherwise, a request to delete a person’s personal information in its records is met by de-identifying that information: we replace the person’s name and contact details on their account and delete their sign-in credential. A name printed on a signed record, such as a signed inspection or a repair entry, stays as it was signed until the record is deleted or anonymized at the end of the period above. De-identifying does not change names typed into free-text fields, the copies of that text kept with AI estimates, or our error reports.

Short-lived operational data is removed on its own schedule: an in-app notification 180 days after it is created, a notification’s delivery record 365 days after, and push-notification subscriptions, login identity links, and expired tokens when they end. Error reports, which can contain personal information from the failed request, are kept by Sentry for up to 90 days. Information we are accountable for, such as website inquiries and our technical and security logs, is kept only as long as the purposes above need it.

When someone opts out of our text messages or emails, we keep a record of the opt-out — the phone number or email address, and when and how it was made — after the account ends, so that the opt-out continues to be honoured.

How we protect it

We use technical and organizational safeguards appropriate to the sensitivity of the data — including encryption in transit, access controls, and tenant isolation so one organization’s data is not exposed to another.

If a breach involves personal information we process for an organization, we notify that organization without undue delay and give it the information we have about the breach. For information we are accountable for, if a breach creates a real risk of significant harm, we notify the affected individuals and the relevant regulator (the OIPC under PIPA and/or the OPC under PIPEDA), as the law requires. Not every incident meets that threshold.

Your rights

Under Canada’s federal PIPEDA and Alberta’s Personal Information Protection Act (PIPA) — PIPA for provincially regulated organizations in Alberta, such as ours, and PIPEDA for information handled across provincial or national borders — you may request access to the personal information we hold about you, ask us to correct it, and withdraw consent to a use. You may also ask us to delete your personal information: for information we are accountable for, we answer as the law requires, and we keep the record of an opt-out so it continues to be honoured; for information an organization entered, the request is met as “How long we keep it” describes. To exercise a right, contact us using the details below. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada (OPC) or the Office of the Information and Privacy Commissioner of Alberta (OIPC).

If your personal information was entered by your employer, your employer is accountable for it. Send access, correction and deletion requests to your employer. If you contact us instead, we will forward your request to your employer and tell you we have. If your employer no longer uses wearpoint, can’t be reached, or doesn’t respond within 30 days, contact us and we will respond to you directly. Requests about information we are accountable for (text-message and email opt-outs, website inquiries, and our technical and security logs) come to us.

Additional rights by region

Depending on where you live, extra rights may apply on top of the Canadian baseline above. These apply only where their conditions are met:

• Quebec (Law 25). If your data flows through wearpoint and you are located in Quebec, Quebec’s private-sector privacy law gives you additional protections.
• California (CCPA/CPRA). Where the CCPA applies, California residents have the right to know, access and correct their personal information, to request its deletion, and not to be discriminated against for using these rights. For information we process for an organization, we act as its service provider: send your request to that organization. For information we are accountable for, we delete it on request, unless a CCPA exception applies, such as a legal obligation to keep it. In that case we tell you which exception applies and keep only what it covers. We do not sell or share personal information as the CCPA defines those terms.

We do not claim compliance with the EU/UK GDPR; wearpoint is not currently offered to customers with workers in those regions.

Children

wearpoint is a workplace tool and is not directed to children. An organization may add workers under 18 where the law allows them to work. The organization is responsible for that information and for any consent the law requires, including a parent’s or guardian’s consent for a minor under 14 in Quebec. We do not knowingly collect personal information directly from children under 16. If we learn that we have, for example through a website inquiry, we delete it.

Where your data is stored

Personal information is stored and processed in Canada and the United States. The application database, sign-in and rate limiting are hosted in Canada (Supabase and Upstash), and the application, the API and the scheduled jobs run in Canada (Vercel). The providers we use for email (Resend), text messages (Twilio), payments (Stripe), AI suggestions and estimates (Anthropic) and error monitoring (Sentry) process the information they handle in the United States, and the website runs there (Vercel). Every request passes through Vercel’s global network. The table in “Who we share data with” says what each provider handles and why we use it. When information is handled outside your province or country, it may be subject to the laws of that jurisdiction, including lawful access by courts and authorities there. We use reputable providers bound by contractual protections.

Changes to this policy

We may update this policy. When we do, we will ask account owners to accept the new version in the app, and each update changes the version and the “Last updated” date above.

We record which version of the Terms of Service and of this policy an account owner accepted, in which language, and when. Crew members see a one-screen notice when they first sign in that says who holds their information and where to send requests about it.

Contact us

Questions or requests about your privacy can be sent to our Privacy Officer:

RealEasy Technologies Inc.
Alberta, Canada
support@wearpoint.io