Your information,
and what we do with it.

Who we are

StepSpec ("StepSpec", "we", "us") makes the StepSpec app and the website at stepspec.app, where contractors, general contractors, suppliers and their clients run construction jobs together. This policy covers the website, the web app at app.stepspec.app and the StepSpec app for iPhone.

StepSpec is responsible for the personal information it holds about you. Our privacy officer, the person in charge of protecting it, answers at [email protected].

When a company uses StepSpec to run its own work, such as its crew's hours or its clients' details, that company decides what it records about those people and why, and we keep and process those records for it. Questions about them can go to the company or to us.

What we collect

What you give us

• Your account: your name, email address and password (kept only as a one-way hash), how you use StepSpec (contractor, client or supplier) and, if you add them, your phone number, address, bio and logo.
• Sign in with Apple: if you use it, Apple gives us an identifier for your Apple ID, the email address you chose to share (which can be an address Apple makes up that forwards to yours) and, the first time only, your name. We keep the identifier, that address and a token Apple issues, so we can end the link when you turn it off or delete your account.
• Your company: its name and legal name, business number and GST/PST numbers, contact email and phone, e-Transfer address, website, address, time zone and logo, the trades it does and the area it serves, and, for a contractor that asks to be verified, its licence number and insurance certificate.
• The work: projects, tasks and their steps, schedules, requirements, inspections, change orders, bids and quotes, material requests and offers, purchase orders, bills, receipts and expenses, documents and photos, the answers you hand in, your messages, and the ratings and reviews you write.
• Your crew: for a company that runs one, its people's clock-in and clock-out times, shifts, hourly wages, pay periods and paychecks.
• Safety concerns: what you write and photograph when you report a safety concern on a site. A concern is anonymous: we keep no name, account, address or device with it, the photos' location and camera details are removed, and you read the answer with a code only you hold.
• Site sign-ins: on a site with site safety turned on — with an account, or at the site's gate without one, when we also keep the name, company and phone number you give — when you signed in and out, the protective equipment you confirmed and the wording you confirmed it against, and how far from the site you were when you signed in. The site's safety coordinator and the company running the project see who is on site, with their employer and phone number, so everyone can be accounted for in an emergency. When you are given the site's orientation, they record who gave it, when, the topics it went through, and that you confirmed it; when you attend a toolbox talk there, its topic, who led it, when, and that you confirmed you were there.
• First aid and incidents: when you are given first aid on a site, what it was for, the first aid, who gave it and what came after — health information, read only by the site's safety coordinator, whoever recorded it, and you; not your employer. When you are part of an incident on a site — hurt, involved or a witness — your name and employer are on its report, which the site's safety coordinator, the company running the project and your employer read.
• Other people: you may add people who are not on StepSpec, such as a client's or a bill-to contact's name, email, phone and address, or a supplier's account number. Only add what you have the right to share.
• What you send us: your emails to support or to our privacy officer.

Location

The app asks for your location only at these moments, reads it once and never in the background or in between:

• When you clock in or out. It is kept with the punch as a record of where the shift started and ended.
• When you sign in to a site with site safety turned on. It is kept with the sign-in as how far from the site you were; a sign-in far from the site is pointed out to its coordinator, never refused.
• When you tap "Use My Location" on an address. Your device asks OpenStreetMap's Nominatim for the address at that spot and fills it in; you can change it before saving. Only the address you save, with its spot on the map, is kept.
• When you turn on "Near me" in Find Work. Your position, rounded to about a kilometre, is sent with that search to sort the work by distance. It is not kept.

If you say no, the punch or sign-in is saved without it and the rest works without it, and you can change your answer at any time in your device's settings.

Addresses you enter, such as a project's site or your company's address, are turned into map coordinates, so work can be matched with the companies that serve that area.

Camera, photos and files

The app opens the camera or your photo library only when you choose to take or attach a photo, and uploads only the photos and files you pick. A photo can carry details your camera stored in it, such as when it was taken and, if your camera records it, where. StepSpec never uses your microphone.

Payments

Card payments, payouts and plans bought on the web go through Stripe; plans bought in the iPhone app go through Apple. You give your card details to Stripe or Apple, and your bank and identity details for payouts to Stripe on its own pages. We never see or store a full card number or a bank account number. We keep what a payment needs on our side: Stripe's and Apple's references for you and your payments, a card's brand and last four digits, amounts, dates and status. We never ask for a Social Insurance or Social Security number.

What we collect automatically

• Sign-in and security records: the IP address and the kind of browser or device when you sign in, fail to sign in, change your password or two-factor settings, or make another sensitive change.
• Your devices: if you turn on notifications, the device's push token and name, so notifications reach it.
• Cookies that keep you signed in on the web (see Cookies and your device).
• Speed: how long a slow request took on our server, with no name or account attached. The app's own Speed screen keeps its timings on your device.
• Server logs: errors and requests, kept briefly to keep StepSpec running.

How we use it

• To run StepSpec for you: your projects, crews, bids, orders and bills, showing your work to the people on it, and working out pay from hours.
• To match work: showing open work to companies whose trades and service area fit it, and a client's request to the contractors who serve that address.
• To take and make payments, and to bill for plans.
• To tell you about your work and your account, such as new bids, messages, approvals, bills or a trial ending, by email, in your inbox, and by push if you turned it on. We don't send marketing email.
• To keep StepSpec safe: secure sign-in, finding and stopping abuse and fraud, and a record of sensitive actions.
• To help you. If you ask for help, a member of our team may open your account to see what you see. Money and account-security actions are blocked while they do, everything they do is recorded, and we email you that it happened.
• To meet the law: tax, accounting and lawful requests.
• To keep StepSpec working well: fixing errors and making it faster.

We do not sell your information, use it for advertising, build profiles of you, or use it to train artificial intelligence models. We don't make decisions about you by automated means alone that have legal or similarly significant effects on you.

Who sees it

People you work with on StepSpec

StepSpec is built for sharing work, so what others see depends on what you do:

• Your company's profile, trades, service area and rating, and the reviews written about it, are shown to people looking for work or for workers.
• A bid or a quote goes to the company or client that asked for it. A task you put out to bid is shown to the companies that could bid on it.
• The people on a project, such as the general contractor, the subcontractor on a task, the crew and the client, see that project's tasks, steps, photos, messages and documents as their part needs.
• A bill goes to whoever pays it, by email if you send it that way.
• A company's owner and managers see its people's hours, wages and pay.
• A share link or QR code shows what it was made to share to anyone who has it.

Service providers

These companies run parts of StepSpec for us, and receive only what their part needs:

Stripe

Card payments, payouts to contractors and suppliers, and plans bought on the web. Receives: Your name and email, your company's name, amounts and what they pay for. Card, bank and identity details you give to Stripe directly, on its own pages.

Apple

Plans bought in the iPhone app, Apple Pay, Sign in with Apple, and delivering notifications to iPhones. Receives: A random account reference with each purchase, a notification's text with the device it goes to, and for Sign in with Apple the request that ends the link.

Expo

Delivering push notifications to the app. Receives: The device's push token and the notification's title and text.

Your browser's push service

Notifications in a web browser, if you turn them on (run by Apple, Google or Mozilla). Receives: An encrypted notification it cannot read, and your browser's subscription address.

Resend

Sending email. Receives: The recipient's email address and the email.

DigitalOcean

The servers StepSpec runs on, managed with Laravel Forge. Receives: Everything StepSpec stores.

Amazon Web Services

Backups. Receives: Encrypted copies of the database and uploaded files.

OpenStreetMap Foundation (Nominatim)

Address search and map coordinates, and the address where you stand when you tap "Use My Location". Receives: The address being looked up, or for "Use My Location" your device's position at that moment. These requests come from your device, so they also see its IP address.

Bunny Fonts

The typeface on StepSpec's web pages. Receives: Your device's IP address and browser type, as with any web request.

Apple Maps or Google Maps

Directions, only when you tap an address to open it in a maps app. Receives: That address.

Other times we share

• When the law requires it, such as a valid court order, or to protect the rights, safety or property of our users, the public or StepSpec.
• If StepSpec is sold or merged, your information may move to the new owner, who must keep the promises in this policy or tell you first.
• With your consent, or when you ask us to.

We do not sell your personal information, and we don't share it for targeted advertising.

Where it is kept

StepSpec's servers and backups are in North America, with DigitalOcean and Amazon Web Services. Some of the providers above, such as Stripe, Apple, Expo and Resend, process information in the United States and other countries, whose authorities may be able to reach it under their laws. When information about people in the European Economic Area, the United Kingdom or Switzerland goes to a country without an adequacy decision, it is protected by the safeguards in our providers' data processing terms, such as the European Commission's Standard Contractual Clauses.

How long we keep it

Your account and profile

Until you delete your account. Then your personal details are erased, as described under Deleting your account.

Projects, bids, orders, bills, payments, messages and photos

Kept as part of the records of everyone on them, also after one of them deletes their account. Financial records at least as long as tax law requires (in Canada, generally six years).

Crew hours, wages and pay

As long as the employer keeps them, which payroll and tax law require for years.

Site sign-ins and their protective equipment confirmations, site orientations, toolbox talks, site inspections, closed hazards and incident reports, and first aid records

Three years, then deleted.

Sign-in and security records

400 days.

Server, error and speed logs

14 days.

"Keep me signed in" on the web

90 days, or until you sign out.

Push notification registrations

Until you sign out of that device or delete your account.

Backups

Up to three years: daily copies for a month, then weekly, monthly and yearly copies, each deleted on schedule. We only restore from a backup to recover from a failure.

Deleting your account

You can delete your account at any time: in the app or the web app, open Menu → Account → Delete Account and confirm with your password, or with Apple if you sign in with Apple and never set one. If other people are still on your company, remove them in Team first, or ask us to hand the company to one of them.

When you delete your account:

• Your name becomes "Deleted user". Your email address, phone, address, bio, logo, licence, insurance certificate and two-factor settings are erased, and every device is signed out. If you signed in with Apple, we ask Apple to end the link, so StepSpec no longer appears under your Apple ID.
• If the company was yours alone, its plan is cancelled at the end of the period you paid for, its open bids and offers are withdrawn, and its work out for bids is taken down.
• If you were part of someone else's company, you leave it.

Records other people rely on stay with them, shown under "Deleted user": the projects, bids, bills, messages, photos and reviews you took part in, and the hours and wages a company recorded for you. They are part of those people's records, and tax law keeps many of them for years. Paychecks from pay periods your employer had already closed keep the name they were issued under, because employers must keep payroll records that name the person they paid. Your company's business details (such as its name, business numbers, contact details and address) stay with its bills and payment records. Stripe and Apple keep their own records of payments, under their own privacy policies.

To have what is left of your company's profile removed, email [email protected] from your account's email address. We'll confirm it is you and reply within 30 days.

Your choices and rights

• See and correct it. Most of what you gave us is in Menu → Account and your company's settings, where you can change it.
• Get a copy. Email [email protected] and we'll send you the personal information we hold about you, in a common format. Many records can also be downloaded in the app, such as tax reports, hours and payroll, and bills.
• Device permissions. Location, camera, photos and notifications can be turned off at any time in your iPhone's Settings → StepSpec. StepSpec keeps working without them.
• Email. We only email you about your own work and account, and some of it, such as sign-in, security and bills, is needed for StepSpec to work.
• Withdraw consent. Where we rely on your consent, you can withdraw it at any time. This doesn't affect what was done before.

Requests are free. We answer within 30 days, and may first ask you to confirm who you are. If you are unhappy with how we handled your information, please tell us first. You can also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), in Quebec to the Commission d'accès à l'information (cai.gouv.qc.ca), or to the data protection authority where you live.

Rights where you live

Canada

We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Quebec, the Act respecting the protection of personal information in the private sector. You can access and correct your personal information and withdraw your consent. In Quebec you can also ask us to stop sharing it or to de-index it, and to receive it in a structured, commonly used technological format.

European Economic Area, United Kingdom and Switzerland

Under the GDPR and the UK GDPR, StepSpec is the controller of your account information, and processes the records a company keeps about its own people and clients on that company's behalf. We rely on these legal bases:

• Contract: to provide StepSpec as you asked, which covers most of the above.
• Legitimate interests: to keep StepSpec secure, prevent fraud and improve it, where your interests don't override ours.
• Legal obligation: tax, accounting and lawful requests.
• Consent: your location (at a punch, a site sign-in, for an address or for work near you) and push notifications, which you can withdraw in your device's settings.

You have the right to access, correct and erase your personal information, to restrict or object to how we use it, to receive it in a portable format, and to complain to your supervisory authority.

United States

If you live in California or another state with a consumer privacy law, you have the right to know what personal information we collect, use and disclose, to get a copy of it, to correct it and to delete it. In the past 12 months we have collected these categories:

• identifiers (name, email address, phone number, IP address, account and device identifiers);
• customer records and commercial information (addresses, business details, purchases and payments);
• professional or employment information (trades, licence, hours and wages);
• geolocation (precise location at a punch or a site sign-in, or for an address you fill in from where you stand);
• visual information (photos);
• internet or other network activity (sign-in and security records);
• the content of messages.

We collect them from you, from the people you work with on StepSpec, from your devices and from our payment providers, for the purposes under How we use it, and disclose them to the service providers above for those purposes. Precise location is sensitive personal information, and we use it only to provide the service you asked for. We do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the past 12 months. We won't treat you differently for using your rights. You may use an authorised agent; we'll ask the agent for proof and may ask you to confirm your identity. To make a request, email [email protected].

Security

Everything travels encrypted (HTTPS). Passwords are kept only as one-way hashes, and two-factor sign-in is there for anyone who turns it on. Uploaded files are private and shown only to people with access to them. Backups are encrypted. Our team's access is limited to what support needs, and every time we open an account it is recorded.

No system is perfectly secure. If a breach puts your information at real risk of significant harm, we'll tell you, and the regulators the law requires, as soon as we can.

Children

StepSpec is a tool for businesses and the people they work with, and is not meant for children. You must be 16 or older to use it. We don't knowingly collect personal information from anyone under 16. If you believe a child has given us information, email [email protected] and we'll delete it.

Cookies and your device

On the web we use only the cookies StepSpec needs to work: one that keeps you signed in, one that protects forms against forgery, and, if you choose "Keep me signed in", one that keeps you signed in on that browser for up to 90 days. We use no analytics, advertising or third-party tracking cookies, so there is nothing to opt in to.

The app and the web app keep some things on your device so they work without signal: work waiting to send (punches, progress and photos), a copy of recent screens, and, in the iPhone app, your sign-in, in the iPhone's Keychain. Signing out clears them.

StepSpec does not track you across other companies' apps or websites, so the iPhone app never asks for permission to.

Changes to this policy

We'll update this policy when StepSpec changes what it collects or how it uses it, and change the date at the top. If a change is significant, we'll tell you in the app or by email before it takes effect.

Contact us

For anything about your privacy or this policy, write to our privacy officer at [email protected]. For anything else, write to [email protected] or see Support.