Privacy Policy

ServiceProof (“we”, “us”) provides maintenance- compliance software for buildings. This policy explains what personal information we handle and why. We operate from Calgary, Alberta, and handle personal information in accordance with Alberta’s Personal Information Protection Act (PIPA).

What we collect

• Account & organization:the email address you sign in with (via magic link) and your organization’s details.
• Building & equipment data: buildings, systems, scan points, and maintenance contracts you add.
• Service records: when a technician scans a sticker, we record the self-attested name and company they enter, the checklist items completed, the time, any notes they add, an optional photo, and whether the scan was presence-verified.
• Billing contact: if you subscribe, your admin email, organization name, and the billing address entered at checkout are shared with our payment processor. The address is used to calculate applicable sales tax and is kept on your billing record so renewals and invoices are taxed correctly.
• Invitations: if you invite a colleague, we store the email address you provide to deliver and manage that invitation.

Why we use it

To provide the service (logging and verifying maintenance, comparing it against contracts and regulatory minimums), to manage your account and team, and to bill subscriptions. We do not sell personal information.

Where it’s stored

Your data is stored in Canada (a Supabase project in the ca-central-1 region) at rest. Some processing involves trusted service providers outside Canada (see below).

Service providers & cross-border processing

We use a small number of processors, some located in the United States. Personal information sent to them is subject to the laws of their jurisdiction:

• Supabase (Canada) — database, file storage, and authentication.
• Stripe, Inc. (United States) — subscription billing; receives the admin email, organization name, billing address, and payment details.
• Resend, Inc. (United States) — transactional email; receives recipient email + message content to deliver invitations and notifications.
• Anthropic(United States) — used only when you upload a maintenance contract for automated extraction; receives that document’s contents.

Retention

We keep service records for a rolling 36-month window. After that, we redact the self-attested name, company, notes, and any photo, while keeping a de-identified proof skeleton (what equipment was serviced, when, and which checklist items) so the compliance history remains intact. Redaction can also be performed by our staff — at our discretion, for validated requests — and is audited.

Your choices

Under PIPA you may ask to access or correct your personal information. Note that Alberta’s PIPA does not provide a general “right to erasure”; where we can, we redact identifying details per the retention practice above. Direct access or correction requests to the administrator of your organization, who controls that information; ServiceProof acts as their service provider and will assist them in responding. You can also reach us at the address below.

Contact

Questions about this policy or your information: hello@serviceproof.ca.