Privacy Policy
Version 2026-09-16b · HomeUpgraders (Home Upgraders), Orléans, Ontario, Canada
The short version
We collect what the tools need to work and nothing for advertising. We do not sell personal information, we do not run advertising trackers, and we do not share your records with other contractors. Some of the data is stored in the United States — see Where your data lives, which is the part most people want to know.
Who we are
HomeUpgraders is operated by Ryan Trebell, a renovation contracting business in Orléans, Ontario. For any privacy question, correction, copy of your data, or deletion request, contact us through the account page. We are the organisation accountable for the personal information described here under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
What we collect, and why
If you have an account
| Information | Why |
|---|---|
| Email address and password | To sign you in. Passwords are hashed by our authentication provider and are never visible to us. |
| Display name, business details, GST/HST number | To appear on invoices and estimates you produce. |
| Your rates, overhead percentage, expenses | To calculate your margins. These are yours and are never shown to anyone else. |
If you use InVoice, about your clients
| Information | Why |
|---|---|
| Client name, email, phone, site address | To identify the job and to appear on the documents you send them. |
| Job photographs | Before and after evidence of work. |
| GPS coordinates and timestamps from photographs | Read from the photo's EXIF data, on your device, to cross-check the hours recorded against when and where photos were taken. This means we hold the location of your clients' homes. |
| Voice recordings of your daily notes | Transcribed into a written work record, then discarded after transcription. |
| Receipt photographs | Kept as proof of purchase. The image is stored; amounts are read from it automatically. |
Automatically
Our hosting provider records standard server logs, including IP address and browser type, for security and reliability. We do not use advertising trackers, Google Analytics, Facebook pixels, or session-recording tools.
We do record our own visit counts inside InVoice, to see which parts of the app get used and where people give up. It is deliberately thin: a random visit identifier, which page, the domain a visitor arrived from rather than the full address, a rough device class, and whether the visit is a return. No IP address, no browser fingerprint, and nothing that identifies a person is stored with it. If you are signed in, your account id is recorded so we can tell a signed-in session from an anonymous one. Nobody outside the business can read this table — it has no read access for any logged-in user, including you.
Cookies
We use cookies for one purpose: keeping you signed in. These are strictly necessary for the service to function, and under PIPEDA they do not require a consent banner. We set no advertising or tracking cookies. If you block them you will not be able to sign in.
Where your data lives
We are moving this to Canadian hosting. Until that is complete, the position above is accurate and we would rather say so plainly than let you assume otherwise. This page will be updated when the move is done, and the date will change.
Who else processes your data
| Provider | What they handle | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage | United States (Oregon) |
| Google (Gemini) | Voice transcription and reading receipts. Audio and receipt images are sent for processing. | United States |
| Vercel | Website hosting and server logs | United States and global edge |
| Stripe | Payments, where you buy something. We never see or store your card number. | United States / global |
These providers process data on our instructions. We do not permit them to use it for their own purposes.
What we never do
- Sell, rent or trade personal information.
- Show your jobs, rates, margins, clients or photos to any other user.
- Use your job data to train AI models of our own.
- Send marketing email you did not ask for.
How long we keep things
Business records — invoices, estimates, expenses — are kept for at least seven years, because Canadian tax law requires it. Job photographs, daily records and receipts are kept while your account is open. If you close your account we delete your data within 90 days, except records we are legally required to retain.
Your rights
Under PIPEDA you may ask what personal information we hold about you, get a copy, have errors corrected, withdraw consent, or make a complaint. Ask us and we will respond within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
If you are a homeowner and a contractor using this service holds information about you, contact them first — the records belong to their account. If that does not resolve it, contact us and we will help.
Security
Data is encrypted in transit and at rest. Every record is restricted at the database level so an account can only reach its own. Job photographs and receipts are kept in private storage, reachable only through short-lived signed links. Documents shared with a client use a single-use token that expires, and only a hash of that token is stored, so a copy of our database would not produce a working link.
Children
This service is for contractors and homeowners conducting business. It is not directed at children and we do not knowingly collect information from anyone under 18.
Changes
When this policy changes materially we will ask you to read and accept it again before you continue using the tools. The version date at the top identifies what you agreed to.