Last updated: 8 November 2026

Privacy Policy

Austin Excell, operating as Click & Done Digital ("we", "us") runs SubCert Sentinel. This policy explains what personal information we handle, why, and what rights you have. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's anti-spam law (CASL). Our privacy contact is Austin Excell, support@clickdonedigital.tech, 136 San Pedro Drive, Hamilton, Ontario L9C 2C8, Canada.

1. Whose information, and our role

• Our customers' staff (the owner and team members who log in): we collect their information to provide the account, and we are responsible for it.
• Subcontractors and their insurance agents: our customer (the general contractor) enters their details and decides what to ask them for. For this information we act as the customer's service provider and handle it only on the customer's instructions. A subcontractor who has a question about their information should first contact the contractor that sent the request; they can also contact us at the address above and we will help.

2. What we collect

• Account information: your name, work email, company name, role, and a salted hash of your password (we cannot read your password). The time you accepted the Terms and this policy.
• Subcontractor records you enter or they send us: company name, contact name, email, phone number, insurance agent contact details, project assignments, policy details (insurer, policy number, limits, dates, endorsements), uploaded certificate files, and for Ontario the WSIB clearance certificate number, its valid-until date, the date it was last checked, and an optional copy of the certificate.
• Messages: a log of every email the Service sends (recipient, subject, text, time) so you can see what was sent.
• Activity and notifications: a log of actions in your account (who approved, changed or deleted what, and when).
• Technical information: your IP address (used for rate limiting and security) and two cookies, described below.
• Billing: payments are handled by Stripe. We receive a Stripe customer and subscription identifier, your plan and its status. We do not receive or store your card number.

3. Why we use it

To provide and secure the Service: check certificates against your requirements, show who may be on site, send certificate requests and reminders, run billing, give support, prevent abuse, and meet legal obligations. We do not sell personal information and do not use it for advertising. Where consent is needed we rely on it: for our customers' staff, you consent when you accept this policy; the contractor is responsible for having an appropriate basis to enter its subcontractors' details. You may withdraw consent (see section 10), though we may then be unable to provide the Service.

4. Emails and CASL

Certificate requests, expiry reminders, rejection notices, invitations and account messages are transactional: they relate to insurance paperwork or accounts in an existing business relationship. They are sent on behalf of the contractor that uses the Service. We do not send marketing email today. If we ever do, we will first obtain consent, identify ourselves clearly, and include a working unsubscribe link in each message; we will honour an unsubscribe request without delay and no later than 10 business days.

5. Cookies

We use only what the Service needs: a session cookie that keeps you logged in, and a "known browser" cookie that keeps the login lockout from locking you out of your own browser. No advertising or cross-site tracking cookies are used.

6. Who we share it with

• Stripe (payment processor) receives your name, email and payment details to process your subscription, under its own privacy policy.
• Email delivery provider: the mail service we use to send the Service's emails sees the recipient, subject and text of each message.
• Hosting: Contabo Inc. virtual server in St. Louis, Missouri, United States stores the data.
• Others: a professional adviser or authority where the law requires it, or a buyer of our business that agrees to protect the information in the same way.

Some of these providers are outside Canada (for example, Stripe processes payments in the United States), so the information may be subject to the laws of, and accessible to authorities in, those countries.

7. How long we keep it

• Account and subcontractor data: for as long as the account is open. When the owner deletes the organization, the data is removed from the live system immediately, and from backups within [30] days.
• Billing records: as long as tax and accounting law requires (for Canadian businesses, generally six years). [Confirm period.]
• Security logs (IP addresses in rate limits): short-lived, not kept beyond [30] days.

8. How we protect it

Passwords are hashed; sessions use secure, HTTP-only cookies; access is limited by role (owner, admin, viewer) and by organization, and certificate files are available only to logged-in staff of the owning organization. No system is perfectly secure; we limit who on our side can reach the data and keep it up to date.

9. What the service operator can see

The service operator can see aggregate account statistics for the Service as a whole: the number of organizations and users, trials and paid subscriptions by plan, recurring revenue, sign-ups per week, and recent technical errors (the page and error message only). The operator does not browse customers' documents or personal data through that statistics page: it shows no customer names, subcontractor records, certificate files or other personal information, and it offers no way to open them.

10. Your rights: access, correction, withdrawal

You may ask us for access to the personal information we hold about you, ask us to correct it, or withdraw your consent, by writing to support@clickdonedigital.tech. We will answer within 30 days (we may ask you to prove who you are first, and if we refuse part of a request we will say why). Customers' staff can also correct or delete most information themselves in the app.

11. Breaches

If a security breach involving personal information creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected people (and the affected customer) as soon as feasible, saying what happened, what information was involved and what to do. We keep a record of every breach for 24 months, as the law requires.

12. Complaints

Please raise concerns with us first at support@clickdonedigital.tech. You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

13. Children

The Service is for businesses and is not directed at anyone under 16.

14. Changes

We will post changes here and, for material changes, email the account owner. Contact: Austin Excell, operating as Click & Done Digital, 136 San Pedro Drive, Hamilton, Ontario L9C 2C8, Canada, support@clickdonedigital.tech.

Terms of Service · Privacy Policy