Privacy Policy

Who we are and what this covers

This Privacy Policy explains how the operator of Synhelm (“we”, “us”) collects, uses, shares, protects and deletes personal information when you use Synhelm: the website, the office app, the crew app, client links for estimates and invoices, and our support (together, the “Service”).

We wrote it to meet Canada’s federal privacy law (PIPEDA), Québec’s Law 25, Canada’s anti-spam law (CASL), the UK and EU General Data Protection Regulation (GDPR), Australia’s Privacy Act, and the privacy laws of U.S. states such as California (CCPA/CPRA). This policy is not a certification under any of them.

Privacy Officer

Our Privacy Officer is Synhelm’s founder, who is responsible for how we protect personal information and for answering privacy requests and complaints. Contact: hello@synhelm.ca (put “Privacy” in the subject).

Two roles: your business’s records, and our own

Business records: a business (a “shop”) uses Synhelm to keep records about its own people and customers: employees, clients, jobs, time, safety sheets, photos, messages, estimates and invoices. For those records the shop decides what is collected and why. It is the organization accountable for them (the “controller” under the GDPR), and we handle them only on its behalf and on its instructions, to provide the Service (a “service provider” or “processor”). If you are a shop’s employee or client and want to see, correct or delete records a shop keeps about you, contact that shop first. We will help the shop answer you.

Our own records: for account holders (owners and office admins), website visitors, and people who write to us, we are the organization accountable for the information.

What we collect

Account: name, email, a password we store only as a one-way hash (we can’t see it), optional two-step login settings, and the business profile you enter (name, address, phone, logo, hours, tax and paper settings).

Business records you or your team enter: clients and their contact details, jobs, tasks, schedules, time punches and breaks, time-off and time-change requests, safety sheet answers and signatures, chat messages, documents, photos, videos, drawings, estimates and the files attached to them, invoices, payments and refunds, business expenses and receipt pictures.

Crew: a crew member’s name, role, PIN, optional phone, email and language, and the phones they sign in on (a random device code the app keeps on the phone, plus the phone type, screen size and time zone). The PIN is used only to sign in.

Location, only if the shop turns on location stamps and the phone allows it: one GPS point when someone clocks in or out or takes a photo. The crew app never tracks anyone in the background or between punches.

Payments: plan payments and invoice card payments go through Stripe’s own pages. We receive the result, a reference, the card brand and last four digits, never a full card number.

Sign-in and security: when an account signs in we record the time, the browser and device type, and the network address, so we can stop guessing attacks and email you when a new device signs in. Failed sign-ins and wrong crew PINs are counted to lock out guessing. Unusual patterns (many failed sign-ins, refused access, a flood of requests) are kept as security records our team reviews.

Diagnostics: error reports and slow-screen reports from the app, with passwords, PINs, tokens and private links stripped out.

Website visits: we count visits to our public pages ourselves, without cookies or outside analytics scripts. We keep a daily tally per page, where the visit came from (a search engine, a website or app that linked to us, a campaign tag), and the approximate country and province or state. To count a person once per day we use a one-way code made from the connection and a key that changes daily; it can’t be turned back into an address and is deleted after two days. Visits from people signed in to the app aren’t counted.

Sign-up: the approximate country, province or state and city of the connection when a business is created, the kind of work you pick (optional), and, if you came from one of our Google ads, Google’s click code (see Cookies).

Messages you send us through the Contact page, support requests, and email.

We don’t collect government ID numbers, health information, or biometrics, and we don’t buy information about you from anyone.

Why we use it (and our legal grounds)

To provide the Service you or your shop signed up for: running the clock, jobs, paper, photos, chat, payments and settings (needed to perform our contract).

To send the emails the Service exists to send: confirming an email address, password resets, security notices, estimates, invoices, payment receipts, reminders and updates a shop asks us to send. These are transactional; we don’t send marketing email. If we ever do, we’ll ask first and every message will have a one-click unsubscribe, as CASL requires.

To keep the Service safe and working: stopping abuse and guessing attacks, approving crew phones, fixing errors, keeping backups, and telling our team when a new business signs up (its name, the owner’s email and the approximate place) so we can help it get started (our legitimate interest in a secure, reliable service, and our obligation to protect your information).

To bill plans and meet legal duties such as tax records (legal obligation).

Location stamps and phone notifications only with the permission the phone itself asks for (consent, which can be withdrawn in the phone’s settings at any time).

To understand how our website is found and which ads lead to a sign-up, using the anonymous counts and ad click codes described here.

We don’t sell or rent personal information, we don’t “share” it for cross-context behavioural advertising, we don’t use it for automated decisions that affect people, and we don’t use shop records to train AI models.

Who we share it with

Inside a shop: records are separated by business. One business can never open another’s records; our database refuses it at more than one level. Within a shop, the owner decides which areas each office admin can open, and crew only see what the shop turns on for them.

Our service providers, only for the job each one does, under their data processing terms: Vercel (hosting, file storage and our edge network), Neon (database), Resend (email delivery), Stripe (plan and invoice payments), GitHub (stores our encrypted nightly backups), the browser’s own push service (delivers phone notifications, encrypted), Photon by Komoot on OpenStreetMap data (address suggestions and finding a business or project address on the map for its weather; it receives only the address text), MET Norway (weather forecasts; it receives only the map point, never a name), and Have I Been Pwned’s password check (it receives only the first five characters of a one-way hash of a new password, never the password).

Google Ads: if you came from one of our ads and create an account, we send Google the ad click code, the step reached and its time. Never your name, email or business records.

Synhelm staff open a business’s records only to answer a support request or keep the Service running; every action is logged, sensitive ones need a written reason, and we never sign in as you.

We disclose information if the law requires it (for example a court order), to protect someone’s safety, or to a buyer of our business that agrees to this policy. We tell the affected shop unless the law forbids it.

Where it’s stored

Our providers store and process information in the United States and may use other countries for parts of their service. That means information can be reached by the courts and authorities of those countries. We choose providers that commit by contract to protect it (including the standard contractual clauses used for transfers out of the UK and EU), and we review how each one protects information before we use it, as Québec’s Law 25 requires.

How long we keep it

Business records: as long as the shop’s account is open, so the shop can keep its own history (time, safety and tax records often have to be kept for years). The shop can delete records itself at any time; a deleted record stays in the shop’s recycle bin for 30 days (so a mistake can be undone) and is then removed for good.

Closing an account: Settings → Data & export → “Close this business and delete its data” schedules a full deletion in 30 days (you can cancel until then). After that the business and everything in it is removed from the live system, and from our backups within the following 30 days as they expire.

Error and slow-screen reports: 14 days. The activity history shops see, and our security records: 400 days. Encrypted backups: 30 days. Website visitor codes: 2 days. Ad click codes: 90 days. Sign-in guessing counters: minutes to hours.

We keep billing records and a deleted business’s name and deletion date for as long as tax and accounting law requires, then delete them.

How we protect it

Every connection is encrypted (HTTPS, with browsers told to never use an unencrypted one). Passwords are stored only as strong one-way hashes, and new passwords that appear in known data breaches are refused. Two-step login is available for every account, and sign-ins from a new device trigger an email.

Each business’s records are separated in the app and protected again by the database itself, which refuses access to any login but the app’s own. Files are kept in private storage, only reachable through the app.

A business’s crew sign-in opens only on phones the business has approved, so a guessed or copied crew link shows no names. Guessing attacks on passwords and PINs are locked out, and the Service is limited per network address to resist floods.

The database keeps restore points, and we make encrypted nightly copies that are checked by restoring them. Staff access is limited by role and every support action is logged.

No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm, we will notify affected shops and people, and the regulators who must be told (such as the Office of the Privacy Commissioner of Canada, Québec’s Commission d’accès à l’information, or an EU/UK authority within 72 hours), as the law requires, and keep a record of every incident.

Your rights

Everywhere: you can ask what personal information we hold about you, get a copy, have it corrected, and have it deleted when we no longer need it. Shop owners can see, correct and export their records themselves from Settings, and delete the business from Settings → Data.

Canada (PIPEDA and provincial laws, including Québec’s Law 25): access, correction, withdrawal of consent, and, in Québec, data portability and to be told about any decision made only by automated means (we make none). You can complain to the Office of the Privacy Commissioner of Canada, or in Québec to the Commission d’accès à l’information.

UK and EU (GDPR): access, correction, deletion, restriction, portability, and to object to processing based on our legitimate interests. You can complain to your local data protection authority (in the UK, the ICO).

U.S. states (such as California, Colorado, Virginia, Connecticut, Utah and Texas): to know, access, correct and delete, and to opt out of sale, sharing or targeted advertising. We don’t sell or share personal information, and we honour Global Privacy Control signals. We won’t treat you differently for using any of these rights.

Australia (Privacy Act 1988): access and correction; you can complain to the OAIC.

How to ask: email hello@synhelm.ca with “Privacy” in the subject. We answer within 30 days, free of charge, and may need to confirm who you are first. An authorized agent can ask for you with your written permission. If a request is about records a shop keeps, we pass it to that shop and help it answer.

Cookies and phone storage

Our public website sets no cookies and runs no advertising pixels, ad scripts or outside analytics.

The app uses only what it needs to work: a sign-in cookie that keeps you signed in; a random device cookie set on the sign-in page that lets us email you when your account signs in from a new device; a cookie that skips the two-step login code for 30 days on a device you choose to trust; and, on a crew phone, a cookie that remembers that the business approved that phone. All are strictly necessary and can’t be used to follow you on other sites.

On phones and computers, the app keeps some things in the browser’s own storage: your settings, a random device code (used to approve a crew phone), crew sign-in on that phone, and copies of jobs, drawings and punches so the crew app works without signal. Clearing the browser’s site data removes them.

If you reach our website from one of our Google ads, the browser keeps Google’s ad click code for up to 90 days, and it is used only as described under “Who we share it with”.

Children

Synhelm is a tool for businesses and isn’t directed to children. We don’t knowingly collect information from children under 16 for our own purposes. A shop that employs minors is responsible for the records it keeps about them.

Changes to this policy

We post every change on this page and update the date at the top. If a change is significant, we tell shop owners in the app or by email before it takes effect.

Contact

Privacy questions, requests and complaints: hello@synhelm.ca (subject “Privacy”). We are based in Canada.