Draft — under review

Privacy Policy

Last updated: October 31, 2026 · Effective: [EFFECTIVE DATE]

This policy explains, in plain language, what personal information Drawline collects, why, where it's kept, who can see it and what you can do about it. It's written to follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), which applies to private businesses in Ontario.

Who we are

Drawline is a progress-billing tool for construction subcontractors in Ontario. It is operated by [OPERATOR LEGAL NAME] ([CITY, PROVINCE]), referred to here as “Drawline”, “we” or “us”. The person accountable for privacy at Drawline is [PRIVACY OFFICER NAME OR TITLE], reachable at [CONTACT EMAIL].

What we collect

Your account: your email address and a password (stored only as a secure hash; we can't read it).
Company details you enter: company name, address, phone, email, HST number and logo.
Project and billing data: projects, contract values, schedules of values, monthly progress, change orders, invoices, payments received and holdback records.
Documents you upload: such as WSIB clearance certificates, certificates of insurance and statutory declarations.
Details of other people you enter: billing contacts at general contractors (name, email, phone, billing address) and email addresses you send invoices to. Please only enter details you have a business reason to use for billing.
Basic logs: technical records such as IP address, browser type, the pages and actions requested, and when, plus records of the invoice and reminder emails sent from your account.

We don't use advertising trackers, and we don't track whether emails sent through Drawline are opened.

Why we use it

To provide the service: sign you in, store your projects and calculate and produce your invoices.
To send the invoices and payment reminders you ask us to send, to the recipients you choose, from your company's name with replies going to your company email.
To support you: answer questions, fix problems and keep the service secure and working.

We use your information only for these purposes, or as the law requires. If we ever want to use it for something new, we'll ask first.

Where it's stored

Your database records and uploaded files are stored with Supabase in its Canada (Central) region.
The app is hosted on Vercel, and invoice and reminder emails are delivered by Resend. These providers may process data in the United States, where it may be subject to US law, including lawful access by US authorities.

Who we share it with

We share personal information only with the service providers above, and only as needed to run Drawline. They are bound by contract to protect it and use it only to provide their services to us. Emails you send through Drawline go to the recipients you choose.

We never sell personal information, and we don't share it with advertisers. We disclose information without consent only where the law requires or permits it (for example, a valid court order).

How long we keep it, and deletion

We keep your information while your account is open. You can ask us to delete your account at any time by emailing [CONTACT EMAIL]. We'll delete or anonymize your information, except for records we must keep: issued invoices and related billing records may be kept for as long as the law requires (for example, tax record-keeping rules).

How we protect it

All connections to Drawline are encrypted in transit (HTTPS/TLS).
Per-company access controls in the database mean only members of your company can see your company's projects, invoices and documents. Uploaded files are private and shared only through short-lived links.

No system is perfectly secure. If a breach creates a real risk of significant harm, we'll notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

Your rights

Access: ask what personal information we hold about you and get a copy.
Correction: fix anything inaccurate. Most details can be edited in the app.
Deletion: ask us to delete your account and information, subject to the records we must keep (see above).
Withdraw consent: you can stop using Drawline at any time; some uses are needed to provide the service.
Complain: if you're not satisfied with how we handle your request, you can complain to the Office of the Privacy Commissioner of Canada.

Send requests to [CONTACT EMAIL]. We'll respond within 30 days.

Changes to this policy

If we change this policy in a meaningful way, we'll update the date above and ask you to accept the new version the next time you sign in.

Contact

[OPERATOR LEGAL NAME]
[CITY, PROVINCE]
[CONTACT EMAIL]