Summary: We collect information you give us to run the software, we don't sell it, and we use third-party services (Stripe, OpenAI, DigitalOcean, Brevo, Google) only to deliver the product to you. Read below for full details.
1. Who We Are
Worktools 101 ("Worktools 101," "we," "our," or "us") operates the Worktools 101 software platform accessible at app.worktools101.com and related subdomains (the "Service"). We are based in Canada and subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.
Our designated privacy contact is: nathan@worktools101.com
2. Information We Collect
2.1 Account & Registration Information
When you create an account we collect:
- Full name, email address, and password (stored as a salted hash)
- Company name, phone number, and business address (if provided)
- Profile photo and logo (if uploaded)
- Agreement timestamp when you accept these Terms and our Privacy Policy
2.2 Billing & Payment Information
We collect information necessary to process subscription payments and AI render overage charges:
- Stripe customer ID, subscription ID, and payment method token — we never store raw card numbers; all payment data is tokenized and managed by Stripe
- Subscription plan, billing period, and coupon codes
- AI render usage counts, monthly quota data, and the timestamp of your billing agreement acceptance
- Invoice records and payment history
2.3 Project & Client Data
You may upload or create data in connection with projects, including:
- Project names, addresses, and descriptions
- Client contact information (names, emails, phone numbers)
- Selection sheets, responses, and notes entered by clients through client portals
- Drawings, documents, photos, punch list items, and field notes
- Budget estimates, change orders, invoices, and material lists
- Subcontractor portal data, including portal access tokens and associated contact details
2.4 Employee & Kiosk Data
If you use the Kiosk feature, we collect:
- Employee names and assigned PIN codes
- Clock-in and clock-out timestamps
- Photos captured at the kiosk (if the photo-capture feature is enabled)
- Kiosk permission flags assigned to each employee
2.5 AI Render Data
When you or a client generates an AI design render through the Service:
- The selection data used to build the prompt is transmitted to OpenAI
- The generated image is stored in our cloud storage (DigitalOcean Spaces)
- Render metadata (cost, prompt, creation timestamp) is stored in our database
2.6 Usage & Technical Data
- IP address, browser type, and operating system
- Pages visited and features used within the Service
- Error logs and diagnostic data
- Session tokens and authentication credentials (stored server-side)
2.7 Google Calendar Data
If you connect Google Calendar, we access and store OAuth tokens to read and write calendar events associated with your projects. We do not access any Google data beyond what is required to sync project scheduling.
3. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the Service
- Process payments and send billing-related communications
- Bill AI render overage charges at month-end in accordance with your accepted billing agreement
- Send transactional emails (password resets, email verification, summary emails forwarded to clients at your instruction)
- Generate AI design renders using client selection data
- Sync project scheduling with Google Calendar (if connected)
- Monitor and improve Service performance and reliability
- Detect and prevent fraud and unauthorized access
- Comply with legal obligations
We do not use your data for advertising, and we do not sell your personal information to third parties.
4. How We Share Your Information
We share information only as described below:
- Service providers — we share data with third-party processors listed in Section 5 solely to deliver the Service
- Your clients and subcontractors — data you add to client portals is accessible to the recipients you share portal links with
- Legal requirements — we may disclose information when required by law, court order, or to protect our rights
- Business transfers — if Worktools 101 is acquired or merged, your data may be transferred as part of that transaction; we will notify you in advance
5. Third-Party Services
The following third-party services process data on our behalf. Each has its own privacy policy.
- Stripe (stripe.com) — payment processing, card storage, subscription billing, and Stripe Connect for contractor payouts. Stripe is PCI-DSS compliant.
- OpenAI (openai.com) — AI image generation (DALL-E 3). Selection data used to build render prompts is transmitted to OpenAI.
- DigitalOcean Spaces (digitalocean.com) — cloud object storage for uploaded files, photos, drawings, and AI renders.
- Brevo (formerly Sendinblue) (brevo.com) — transactional email delivery. Email addresses and message content are transmitted for delivery purposes.
- Google (google.com) — Google Calendar integration (OAuth). Used only when you explicitly connect your calendar.
6. Data Storage & Security
Your data is stored on servers located in Canada and the United States. We implement reasonable technical and organizational measures to protect your information, including:
- Encrypted HTTPS connections for all data in transit
- Passwords stored as cryptographic hashes (never in plaintext)
- File access restricted to authenticated users via signed URLs
- Role-based access controls limiting staff access to your data
No method of electronic storage is 100% secure. We cannot guarantee absolute security, and you use the Service at your own risk in this regard.
7. Data Retention
We retain your data for as long as your account is active. If you close your account:
- Your account data is retained for 90 days to allow for recovery, then deleted
- Billing records and invoices are retained for 7 years as required by Canadian tax law
- AI render acceptance timestamps are retained indefinitely for billing dispute purposes
- Files stored in cloud storage are deleted within 90 days of account closure
8. Your Rights
Under PIPEDA and applicable provincial law, you have the right to:
- Access — request a copy of the personal information we hold about you
- Correction — request correction of inaccurate or incomplete information
- Deletion — request deletion of your personal information (subject to legal retention requirements)
- Withdrawal of consent — you may withdraw consent to certain processing; withdrawal may limit your ability to use the Service
- Complaint — you may file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca)
To exercise any of these rights, contact us at nathan@worktools101.com. We will respond within 30 days.
9. Cookies & Tracking
We use session cookies to maintain your logged-in state. We do not use third-party advertising cookies or behavioral tracking cookies. You can disable cookies in your browser, but this will prevent you from logging in.
10. Children's Privacy
The Service is intended for use by business professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us at nathan@worktools101.com.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and require re-acceptance through your account. Continued use of the Service after notice constitutes acceptance of the updated policy. The "Last Updated" date at the top reflects the most recent revision.
For privacy-related inquiries, requests, or complaints: