Privacy Policy

This policy explains what personal information Paladdio handles, why, where it is kept and what your choices are. [BUSINESS NAME] ("Paladdio", "we") follows Alberta's Personal Information Protection Act (PIPA) and, where it applies, the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Our privacy contact is [PRIVACY OFFICER NAME], [CONTACT EMAIL].

1. Who is responsible for what

When a company uses Paladdio for its workers, the company decides what is recorded about its workers, contractors and visitors, and is responsible for that information. Paladdio holds and processes it on the company's behalf and on its instructions. For a worker's own personal account, and for the account details of everyone who signs in, Paladdio is responsible.

2. What we hold

• Account details: name, email address, a scrambled form of the password (never the password itself), role, and when you agreed to these documents.
• Work records a company keeps: employee details (job, department, site, supervisor, phone, emergency contact), training and certificates (with copies of the certificates), hazard assessments, inspections, permits, meetings, corrective actions, site sign-ins (who was on which site and when), emergency plans and roll calls, contractors and their workers.
• Health and injury information: incident reports and investigations, injuries and time away from work, first aid, and physical demands and capacity forms. This is sensitive; the Service limits who in the company can see it.
• Photos and files that people upload, and the place a photo or report refers to. Photos sent anonymously are redrawn on the phone first, which removes the location and device details stored inside them.
• Locations: a site's address and map point; a person's position only when they tap "use my location" (it is used to fill in an address and is not tracked).
• Phone alerts: if you turn alerts on, the address your phone's push service gives us and which kind of phone it is. Alerts show only a short title, never names or what happened.
• Technical information: the address your connection comes from (used to limit password guessing), and error logs kept by our hosting provider.

3. Why we use it

Only to provide the Service: to keep the company's records, show them to the people the company allows, send the notices and reminders the Service sends, keep the Service secure and backed up, and answer your questions. We do not sell personal information, use it for advertising, or share it with anyone except the service providers below.

4. Where it is kept: outside Canada

Paladdio's information is stored and processed in the United States by these service providers, who handle it only on our instructions and must protect it:

• Neon (database), servers in Ohio, United States.
• Netlify (the website and uploaded files), United States.
• Resend (sending email), United States.
• The push services of Google, Apple and Mozilla, to deliver phone alerts you turn on (a short title only).
• OpenStreetMap (Nominatim and map pictures), which receives an address or map point when someone looks up a location or a map is drawn.

Information held in the United States may be accessed by courts, law enforcement and national security authorities there under United States law. You may ask our privacy contact about how service providers outside Canada handle it.

5. Who can see it

• Each company's information is kept separate; one company can never see another's records or files.
• Inside a company, what a person sees depends on the role the company gives them.
• A small number of Paladdio staff can open a company's account to support it; each time is recorded in that company's audit log.

6. How long we keep it

A company's records are kept while it uses Paladdio, because occupational health and safety law often requires records to be kept for years. [RETENTION AFTER A COMPANY LEAVES, for example 90 days, then deleted.] Backups are kept for [BACKUP RETENTION, for example up to one year] and then deleted.

7. How we protect it

Information travels encrypted. Access is limited by company and by role; files open only for people in the company they belong to; repeated wrong passwords lock an account for a while; changes are recorded in an audit log; and the database is backed up and restore is tested. If a breach creates a real risk of significant harm, we will tell the people affected, the company and Alberta's Information and Privacy Commissioner as the law requires.

8. Your choices and rights

• You can ask to see the personal information held about you, and to have it corrected.
• For records kept by your employer, ask your employer first; we will help them answer.
• A worker controls which of their own certificates any company can see, and can stop sharing at any time.
• You can turn phone alerts off, and you can send a near-miss or hazard report without your name.
• Write to [CONTACT EMAIL]. If you are not satisfied, you may contact the Office of the Information and Privacy Commissioner of Alberta.

9. Cookies and storage on your device

Paladdio uses one cookie to keep you signed in, and stores a few preferences on your device (text size, theme, recent searches, whether you dismissed a message). No advertising or tracking cookies are used.

10. Children

The Service is for workplaces and is not meant for children under 16.

11. Changes

If we change this policy in a way that matters, we will ask you to agree again the next time you sign in. See also the Terms of Use.