Privacy Policy

1. Introduction

WorkSitePass — Worksitepass, a corporation organized under the laws of the Province of Quebec, Canada, registered in French as Permit de Chantier ("we", "our", or "us") — is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service").

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) for California residents, and other applicable privacy laws in the jurisdictions where we operate.

2. Information We Collect

Personal Information

When you create an account or use our Service, we may collect:

• Name and contact information (email address, phone number)
• Job position and profile photo (for worker profiles)
• Company name and business information
• Account credentials
• Billing and payment information (processed securely through Stripe)

Documents and Certificates

You may upload various documents to the Service, including:

• Safety certificates and training records
• Trade licenses and certifications
• Insurance certificates (COIs)
• Workers' compensation clearance letters
• Other compliance-related documents

For certificate types enrolled in our Certificate Validation service, uploaded documents are reviewed internally by the WorkSitePass team to confirm authenticity against issuing body records. This review is conducted by authorized WorkSitePass personnel only and is not shared with third parties.

Site and Compliance Activity

When your company uses the Sites feature, we collect and store:

• Site assignments and each worker's readiness status for their assigned sites
• Form submissions for Site Requirements, including answers and any signature fields, with submission timestamps
• Site check-in records — when a worker taps Check In at an active site, we record the worker's name and position, the site, the date and time of the check-in (in the site's timezone), and a snapshot of the worker's requirement statuses at that moment. Check-ins do not collect GPS or other location data. If a worker undoes a check-in, the undo is recorded rather than the original entry being erased.
• Company Documents uploaded by company administrators

Usage Information

We automatically collect certain information when you use the Service:

• Device information (type, operating system, unique identifiers)
• Log data (access times, pages viewed, app features used)
• Location data (only if you grant permission)
• Analytics data to understand how you use the Service

2a. Workers and Companies

Most workers join WorkSitePass through an invitation from their company. If you use WorkSitePass as a worker connected to a company account:

• Your company's administrators can view your profile, the status and documents of the certificates in your wallet, your readiness for the sites you are assigned to, the form submissions you make for those sites, and your site check-ins (including who has checked in on a given day).
• Form submissions (including signatures) and site check-in records are retained as compliance records for your company.
• If your company's subscription ends, your access to the mobile app through that company is revoked. You can delete your worker profile and its data at any time from the app's Settings.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process your subscription and payments
• Send you expiration alerts and renewal reminders
• Manually review uploaded documents as part of the Certificate Validation service
• Respond to your inquiries and provide customer support
• Send important notices about the Service (updates, security alerts)
• Analyze usage patterns to improve user experience
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Information Sharing

We do not sell your personal information. We may share your information only in the following circumstances:

Service Providers

We work with trusted third-party service providers who assist us in operating the Service:

• Cloud hosting and storage (Google Cloud Platform / Firebase)
• Payment processing (Stripe)
• Email communications (Resend)
• Analytics services

Legal Requirements

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers

If WorkSitePass is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

4a. Public Verification Pages (QR Check-in)

Every worker profile includes a personal QR code used for on-site verification. Scanning the QR code opens a read-only verification page on our website that displays the worker's name, photo, job position, company, overall compliance status, readiness for their assigned sites (including whether the worker has checked in at each assigned site on the current day, with the check-in time), and the status of the certificates in their wallet.

This page is intentionally accessible without a login so that supervisors and site personnel can verify a worker at the gate. Anyone who has the worker's QR code or verification link can view it. To limit exposure:

• Verification pages are excluded from search engine indexing
• Access is rate-limited to deter automated scraping
• The page is read-only — viewers cannot edit or download your wallet
• The verification code is a random identifier that is not guessable from your name or email

Deleting your worker profile removes your verification page. If you have concerns about your verification page, contact us at the addresses in the Contact Us section below.

5. Data Storage and Security

We take the security of your data seriously and implement appropriate technical and organizational measures to protect it:

• Data is encrypted in transit (TLS/SSL) and at rest
• Access to personal data is restricted to authorized personnel
• We use secure cloud infrastructure (Google Cloud Platform)
• Regular security assessments and monitoring
• Secure authentication mechanisms

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. After account deletion:

• We will delete or anonymize your data within 90 days
• Some data may be retained longer for legal or business purposes
• Backup copies may persist for a limited time

7. Your Rights (Canada)

Under Canadian privacy law (PIPEDA), you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Withdrawal of consent: Withdraw consent for certain data processing
• Data portability: Request your data in a portable format

To exercise these rights, please contact us at support@worksitepass.ca or support@worksitepass.com. We will respond to your request within 30 days.

7a. Your Rights (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you additional rights over your personal information:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources we collected it from, the business purposes for which we use it, and the categories of third parties with whom we share it.
• Right to delete: Request that we delete the personal information we have collected about you, subject to certain exceptions (such as information we must retain to comply with legal obligations or complete a transaction).
• Right to correct: Request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale/sharing: California law requires us to disclose that we do not sell personal information and do not share personal information for cross-context behavioural advertising. There is therefore no sale or sharing to opt out of.
• Right to limit use of sensitive personal information: Request that we limit our use of any sensitive personal information we collect (such as precise geolocation or government identifiers) to the purposes strictly necessary to provide the Service.
• Right to non-discrimination: We will not discriminate against you for exercising any of the rights above. We will not deny, charge different prices for, or provide a different level of service based on your exercise of CCPA rights.

Do Not Sell or Share My Personal Information. WorkSitePass does not sell personal information and does not share personal information for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA.

To exercise any of the rights above, email support@worksitepass.com with CCPA request in the subject line. We will verify your identity before responding and will respond within 45 days (extendable once by an additional 45 days with notice to you, as permitted by law). An authorized agent may submit requests on your behalf with your written permission.

8. Cookies and Analytics

Our website uses a small number of first-party cookies that are necessary for the Service to work — for example, to keep you signed in to your account, remember your preferences, and complete payments through Stripe. We do not use advertising cookies or third-party tracking cookies.

For analytics, we use Vercel Analytics, which is privacy-friendly and cookieless. It records anonymous, aggregated information (page views, country, device type) so we can understand how the Service is used and improve it. No personal information is stored, and no cross-site tracking is performed.

You can control cookies through your browser settings. Disabling cookies may affect some features of the Service.

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

10. International Data Transfers

Subscriber data — certificates, user profiles, company documents — is stored on Google Cloud / Firebase in the northamerica-northeast1 (Montréal, Canada) region. This applies to every subscriber, regardless of country of residence. U.S. subscribers' personal information is therefore stored in Canada rather than in the United States.

A subset of operational data (server logs, analytics, email delivery metadata) may be processed in other countries — including the United States — by our service providers in the course of operating the Service. These countries may have different data protection laws than Canada or California.

By using the Service, you consent to the transfer and processing of your information in these jurisdictions. We ensure that appropriate contractual and technical safeguards are in place to protect your data in accordance with this Privacy Policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Sending you an email notification
• Displaying a notice in the app

Your continued use of the Service after changes become effective constitutes acceptance of the revised Privacy Policy.

12. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at support@worksitepass.ca or support@worksitepass.com. Both inboxes are handled by the same team.