1. Introduction

DoorBot ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the DoorBot web application and related services (collectively, the "Service").

This Privacy Policy applies to all users of the Service and is governed primarily by Alberta’s Personal Information Protection Act ("PIPA"), SA 2003, c P-6.5, and the federal Personal Information Protection and Electronic Documents Act ("PIPEDA"), SC 2000, c 5, to the extent applicable for cross-border data transfers.

By using the Service, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Accountability

DoorBot has designated a Privacy Officer who is accountable for our compliance with this Privacy Policy and applicable privacy legislation. Questions, concerns, or complaints regarding our privacy practices should be directed to:

Privacy Officer doorbot admin@doorbot.app

We will acknowledge receipt of your inquiry within five (5) business days and provide a substantive response within thirty (30) days.

3. Information We Collect

3.1 Information You Provide

When you create an account with an emailed sign-in link or with Google, we collect your email address and name, and, if you use Google, your profile image. When you set up a company, we also collect the information you enter about it:

• Company details: name, address, phone, email, website, licence number and logo
• Pricing data: wages, overhead costs, hours, markups, part costs and price book changes
• Quotes you create, including your customers' names, addresses, phone numbers and email addresses, and their choices on the quote page
• Team members you invite: their email addresses and roles
• Billing: your subscription status and plan. Payment card details are collected and held by our payment processor, Stripe; we do not see or store full card numbers

3.1A Shop Rate Check

The free shop rate check runs in your browser. The numbers you type are saved only in your own browser so you can come back to them; they are not sent to or stored on our servers unless you create a company and choose to import them. If you ask us to email your results, we send the email and do not keep a copy of your numbers.

3.1B Your Customers' Information

When a company enters its own customers' information into a quote, we process it on behalf of that company only to provide the Service (for example, to show the quote page and send quote emails). The company is responsible for its relationship with its customers. Homeowners with questions about their information should contact the door company that sent the quote; we will help that company respond.

3.2 Information Collected Automatically

When you use the Service, we may automatically collect device and browser information (browser type, operating system, device type), usage data (pages visited, features used, time and date of access), IP address, and referring URL.

3.3 Cookies and Similar Technologies

The Service uses cookies and similar technologies for session management and authentication. We may also use analytics tools to understand how the Service is used. These may include Microsoft Clarity, which records how pages are used (taps, scrolling and page layout) with all text hidden, so we can find what is confusing. Clarity never runs on the quote and service report pages that homeowners open. You can control cookie settings through your browser, but disabling cookies may affect the functionality of the Service.

3.4 User-Generated Content

If you submit feedback, error reports, or other content through the Service, we collect that content along with associated metadata (such as the date and time of submission).

4. How We Use Your Information

We use your personal information for the following purposes:

We will not use your personal information for purposes other than those described above without your consent, except as permitted or required by law. We never combine or share one company's pricing data with another company.

5. Disclosure of Your Information

We do not sell your personal information to third parties.

We may disclose your personal information in the following circumstances:

• Service providers: We may share information with third-party service providers who assist us in operating the Service (such as hosting providers (Vercel), our database provider (Turso), email delivery (Resend), payment processing (Stripe), analytics services (Vercel, Google Analytics and Microsoft Clarity), issue tracking for feedback you send us (GitHub), and authentication providers). These providers are contractually required to protect your information and may only use it for the purposes for which it was disclosed.
• Legal requirements: We may disclose information if required to do so by law or in response to valid legal process, including court orders, subpoenas, or government requests.
• Protection of rights: We may disclose information where necessary to protect our rights, property, or safety, or the rights, property, or safety of others.
• Business transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity. We will notify you of any such change in ownership or control.

6. Cross-Border Data Transfers

Your personal information may be stored and processed on servers located in Canada and the United States. When your information is transferred outside of Alberta or Canada, we take reasonable steps to ensure that it is protected in accordance with applicable privacy laws.

Our third-party service providers that process data outside of Canada are contractually required to provide a level of protection for your personal information that is comparable to the protection provided under Canadian privacy law.

By using the Service, you consent to the transfer of your personal information to jurisdictions outside of Alberta and Canada as described in this section. You should be aware that government authorities in these jurisdictions may have the ability to access your personal information under the laws of those jurisdictions.

7. Data Retention and Deletion

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Specifically:

• Account information: Retained for as long as your account is active. You can delete your account yourself from the Account page in the Service; it is deleted as soon as you confirm through the link we email you. If you ask us instead, your identifiable personal information will be deleted within thirty (30) days.
• Company data and quotes: Retained while the company account exists, including after a subscription ends so you can return to it. A company owner who is the only person on the team can delete the company and its data together with their account from the Account page, which also cancels any subscription. A company owner can also ask us to delete the company and its quotes at any time. When a team member deletes their account, the quotes and jobs they made stay with the company.
• Billing records: Kept for as long as tax and accounting laws require.
• Usage data: Retained in anonymized or aggregated form for up to twenty-four (24) months for service improvement purposes.
• User-generated content: Feedback and error reports may be retained in anonymized form after account deletion for the purpose of ongoing service improvement.
• Backup copies: Residual copies in backup systems will be overwritten in accordance with our standard backup rotation schedule, typically within ninety (90) days.

8. Data Security

We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Secure sign-in with one-time email links or Google OAuth 2.0
• Company data is separated so that users can only see the companies they belong to
• Access controls limiting personnel access to personal information
• Regular review of security practices

No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

9. Your Rights

Under PIPA and PIPEDA, you have the following rights regarding your personal information:

• Access: You may request access to the personal information we hold about you. We will respond to access requests within thirty (30) days.
• Correction: You may request correction of any inaccurate or incomplete personal information.
• Deletion: You may delete your account yourself from the Account page in the Service. For anything else, or if you prefer, contact us at privacy@doorbot.app. We will process deletion requests sent to us within thirty (30) days, subject to any legal obligations to retain certain information.
• Withdrawal of consent: You may withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect your ability to use the Service.
• Data portability: Upon request, we will provide your personal information in a commonly used, machine-readable format.

To exercise any of these rights, contact us at privacy@doorbot.app. We may require you to verify your identity before processing your request.

10. Breach Notification

In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm to you, we will:

• Notify the Office of the Information and Privacy Commissioner of Alberta as required by PIPA;
• Notify the Office of the Privacy Commissioner of Canada as required by PIPEDA, where applicable;
• Notify you as soon as feasible, describing the nature of the breach, the information involved, the steps we have taken and will take to address the breach, and steps you can take to reduce the risk of harm;
• Maintain a record of all breaches of security safeguards, regardless of whether notification was required.

11. Children’s Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete that information promptly.

12. Third-Party Links and Services

The Service may contain links to third-party websites or services, including manufacturer documentation and resources. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through the Service.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by email at least fourteen (14) days before the changes take effect. The "Effective Date" at the top of this Privacy Policy indicates when it was last revised.

Your continued use of the Service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. If you do not agree, you must stop using the Service and may request deletion of your account and personal information.

14. Complaints

If you have a complaint about our privacy practices, please contact our Privacy Officer at privacy@doorbot.app. We will investigate your complaint and respond within thirty (30) days.

If you are not satisfied with our response, you may file a complaint with:

Office of the Information and Privacy Commissioner of Alberta: www.oipc.ab.ca Office of the Privacy Commissioner of Canada: www.priv.gc.ca

15. Contact Information

For questions or concerns about this Privacy Policy or our privacy practices:

doorbot admin@doorbot.app