This notice explains what Contractor ManagementPro collects, why, and what you can do about it. It describes how the product and this website actually behave.
What we collect
- Account data: name, work email, company, role, and password hash. Passwords are stored as one-way bcrypt hashes and are never readable by us.
- Contractor program data that you enter into the platform: contractor companies, contacts, safety performance metrics, insurance details, documents, form submissions, and status changes.
- Access and audit data: sign-in events, the actions you take in the platform, timestamps, and IP address, which are used for the audit trail and for security monitoring.
- Website data: if you submit the early-access form, we store the name, work email, company, contractor volume, and message you provide.
Why we collect it
- To provide the service you sign up for, including the contractor compliance workflow and its audit evidence.
- To authenticate users, enforce role-based access, and protect accounts.
- To reply to early-access requests and provide support.
- To meet our own legal, tax, and accounting obligations.
Where it is stored and who processes it
- Application data is stored in a PostgreSQL database hosted by Supabase.
- The application is hosted on Vercel, which processes requests and access logs.
- Early-access submissions and notification emails are processed by Supabase and Resend.
- If you subscribe to a paid plan, payment details are handled by Stripe. We never receive or store your full card number.
- If AI features are enabled, a summary of your contractor records — or the document image you upload — is sent to the configured AI provider (OpenAI or Anthropic) to produce the requested output. Disable the AI provider keys if you do not want this processing.
AI-assisted processing
- AI output is a draft. It may be inaccurate or incomplete and must be reviewed by a person before use.
- We do not use your data to train third-party models, and we do not sell it.
- Documents you scan are processed to extract fields and are not retained by us beyond the submitted record, subject to the provider’s own data-handling terms.
Health and medical information
- Some modules can record health-related information about workers — for example pandemic screening responses, vaccination or wellness confirmations, or medical surveillance records.
- This is sensitive personal information. Under Canadian health privacy laws (such as PHIPA in Ontario) and the GDPR it attracts stricter requirements, including a valid legal basis and limits on collection, use, and retention.
- Your organisation is responsible for having that legal basis and for collecting only what the program needs. We recommend recording a clearance decision (for example “cleared to work”) rather than clinical detail, and deleting screening records once they are no longer required.
- Access is restricted by role and entries are written to the audit log. Our staff do not review the content of these records.
Security
- Access is protected by hashed passwords, session cookies, and role-based permissions. Sensitive actions are written to an audit log.
- Data is encrypted in transit. Hosting and database providers maintain their own security certifications and controls.
- No system is completely secure. If we become aware of a breach affecting your data, we will notify you without undue delay and describe what we know and what we are doing about it.
Cookies and sessions
- We use a single first-party session cookie to keep you signed in. It is HTTP-only and is not used for advertising.
- We do not run third-party advertising or cross-site tracking scripts on this site.
How long we keep it
- Account and program records are retained for as long as your account is active, because audit trails are the point of the product.
- After account closure, we delete or anonymise records on request, except where a legal obligation or an existing audit requirement requires longer retention.
- Early-access submissions that do not become accounts are removed within 24 months.
Contractor personnel and the contractor portal
- A contractor firm may be asked to submit information through the contractor portal: company and contact details, insurance certificates, safety program documents, orientation and screening records, and the names of its workers.
- That information is collected on behalf of the company that engaged the contractor, and that company decides what is required and how long it is kept. We process it on their instructions as a service provider.
- We do not use it for our own purposes, we do not sell it, and we do not use it to train AI models. Contractors are told this on the portal page and are directed to the engaging company to exercise their access, correction, or deletion rights.
Email and anti-spam law
- Messages sent from the platform are operational: reminders that a certificate is expiring, invitations to complete a form, incident follow-ups, and account notices. They relate to a record the recipient is already part of, and they identify the sending organisation and how to reach it, as Canada’s Anti-Spam Legislation requires.
- We do not send marketing email to contractors. If a message does not belong to a record you are part of, tell the sender and they can stop it.
Your choices and your privacy officer
- You can request a copy, correction, or deletion of your personal data by emailing the address below.
- You can export your program data from inside the platform at any time.
- Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and comparable provincial laws, you may ask what personal information we hold, how it has been used, and to whom it has been disclosed. Our privacy officer is reachable at the address below.
- Where the GDPR or similar law applies, you may also object to processing, request restriction or portability, or lodge a complaint with your local supervisory authority.
- If you submitted an early-access request, we rely on your implied consent to reply to that business enquiry. You can ask us to delete the request at any time.
Contact
Privacy questions, data requests, and the privacy officer: lcloon@roadrunner.com
This notice describes how the product behaves. It is a plain-language summary and not legal advice; where a signed agreement contains stricter or different privacy commitments, that agreement applies.