Privacy Policy

Who we are

KriCert is a marketplace that connects homeowners and property managers with contractors across Canada. We are [BUSINESS LEGAL NAME].

If you have questions about your privacy, contact our Privacy Officer at [PRIVACY EMAIL] or by mail at [MAILING ADDRESS].

What we collect

Account: your name, email, password (stored only as a one-way hash so we can't read it), and role (homeowner or contractor).

Jobs and contact details: the job description, address (city and postal code), photos, and the name, email and phone of the homeowner who posted it.

Contractors: your business name, trade, service area, and portfolio photos.

Verification: government ID, trade certificate, insurance certificate, WCB clearance, and the details you enter for them (such as certificate and policy numbers and expiry dates). Only you and KriCert admins can see these documents.

Ratings and messages: star ratings and comments (homeowners and contractors rate each other after a job), and your messages in job responses, quotes and scope items.

Reports: if you report someone, we record what you report and why.

Payments: Stripe holds your card details, not us. We keep your subscription status and payment records (not full card numbers).

Technical data: if the app crashes, we collect error reports through Sentry. We turn off the collection of details that identify you, such as your IP address and account details. We do not use session replay.

Cookies: we use cookies to keep you signed in. We do not use cookies for advertising or tracking.

Why we collect it

To run the marketplace and match jobs to contractors in their trade and area.

To verify that contractors are qualified and insured.

To process payments through Stripe.

To send you account and job emails (sign-up, password reset, job updates, verification decisions, and free month reminders). Stripe sends payment receipts.

To prevent fraud, misuse, and rule-breaking.

To meet Canadian tax and legal duties.

Who sees what

Homeowners see a contractor's business profile, the checks they have passed, and their ratings and comments.

Contractors see job details for work in their trade and service area.

When you pick a contractor, KriCert shares your contact details (name, email, phone) only with that contractor.

Verification documents (ID, certificates) are seen only by you and KriCert admins. Every admin view is logged.

We never sell your personal information.

Service providers and where your data is stored

Supabase (database, file storage, sign-in) stores data in the United States (Oregon).

Vercel (app hosting) runs the app in the United States (Virginia).

Stripe (payment processing) stores payment information.

Sentry (error reporting) stores error logs in the United States.

Resend (email service) sends emails.

Data stored outside Canada may be accessed by courts and authorities there under their laws.

How long we keep your information

ID images, and any document we reject: deleted 30 days after our review decision.

Approved trade certificates, insurance, WCB clearance and portfolio files: kept while your account is open.

Logs of who viewed your documents: kept for 2 years.

Payment and tax records: kept for 6 years as Canadian tax law requires.

Everything else (account, messages, ratings): kept while your account is open, then deleted or anonymized when you delete your account.

We keep what we are required to by law.

Your choices and rights

You can see and correct your information in your account.

You can ask for a copy of your information or corrections at [PRIVACY EMAIL]. We will answer within 30 days.

You can delete your account from Settings. Most information is deleted; we keep payment records for 6 years and breach records as required by law.

You can withdraw consent, but that may mean closing your account.

Security

Your data is encrypted when it travels to and from KriCert and encrypted while stored.

Access is limited by your role (homeowner, contractor, or admin).

Admin access to verification documents is logged so we know who saw what and when.

If a breach creates a real risk of significant harm, we notify you and the Office of the Privacy Commissioner of Canada. We keep a record of every breach.

Children

KriCert is not for people under 18. If you create an account, you confirm you are 18 or older.

Complaints

If you have a privacy concern, contact us at [PRIVACY EMAIL].

You also have the right to complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Changes

We may update this policy. The date at the top shows the latest version.

For important changes, we will tell you by email or in the app.

Using KriCert after we update this policy means you accept the new version.