Privacy Policy

SupplyAxis is field service software for contractors in Canada and the United States. This policy covers two different groups, and the distinction matters because our responsibilities differ for each.

Contractors are the businesses who sign up and use SupplyAxis. We decide what personal information we need from them to run the service, so for that information we are the controller.

Clients are the homeowners and businesses that contractors serve. Their details reach us because a contractor entered them. We hold and process that information on the contractor's instructions — we are the processor, and the contractor is responsible for having a lawful basis to collect it. If you are a client and want your information corrected or deleted, contact the contractor you hired; we will help them action it.

We never see full card numbers. Card details are entered on Stripe's own payment page and never touch our servers.

Online card payments run through Stripe. Each contractor connects their own Stripe account, and money moves from the client to that account directly. SupplyAxis never holds your funds and has no ability to move them.

We take a platform fee on card payments only — a percentage, capped per invoice and per calendar month. That fee is deducted by Stripe at the time of payment; we see the amount, not the card.

Stripe is an independent controller for the payment data it collects. Its handling is governed by Stripe's own privacy policy.

When you send a quote or invoice, your client receives a link containing a unique token. That token is what identifies them — there is no password, because asking a homeowner to create an account to view one invoice is a good way to never get paid.

The practical consequence: anyone holding that link can view that client's documents. Treat it like the document itself. We keep those tokens out of our error reports and analytics for the same reason.

To provide the service; to secure it; to bill our fee; to support you; and to fix faults.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use your client records to train AI models.

Where an AI feature is used (for example, estimating from a photo, or transcribing a voice note), the content you submit is sent to the AI provider named below to generate that specific result. The feature is only active if it has been enabled for your account.

During our beta, this carries a limitation you should know about.We currently use our AI providers' free service tiers. On those tiers, the provider may use the content you submit — a photo, a drawing, the audio of a voice note — to improve their own models, and their staff may review it. That is the provider's term for free access, not our choice about your data, and it applies only to what you put into an AI feature. It does not apply to your client records, invoices, or anything else in the app, which are never sent to an AI provider and never used for training.

Two things follow from that. Don't put anything into an AI feature that you would not want reviewed by a third party— and if that rules the feature out for you, don't use it; nothing else in the product depends on it. And we will move these features to paid tiers, where submitted content is not used for training, before the beta ends. We will update this page when we do.

We use a small number of providers. Each receives only what its job requires.

This list changes as the product does. We will keep it current here rather than describing our vendors in the abstract.

Our servers are in the United States. If you are in Canada, your information — and your clients' information — is stored and processed in the US and is subject to US law, including lawful access requests by US authorities.

We are telling you this plainly because Canadian privacy law expects it, and because a contractor should be able to answer the question honestly when a client asks where their address ended up.

We keep account and service data for as long as your account is open. If you close your account, we delete or anonymise your data within a reasonable period, except where we must keep records for legal, tax, or accounting reasons — payment records in particular are typically retained for seven years.

Backups are kept on a short rolling window and overwritten in the ordinary course, so data can persist in a backup briefly after deletion from the live system.

Traffic is encrypted with TLS. Passwords are hashed with bcrypt and are not readable by us or recoverable by anyone. Access to production systems is restricted to authorised personnel over key-based SSH. Error diagnostics are scrubbed of credentials, request bodies, and client-identifying URLs before they leave our systems. Databases are backed up nightly.

No system is perfectly secure. If a breach affects your information and creates a real risk of significant harm, we will notify you and the relevant regulator as required by law.

You may request access to the personal information we hold about you, ask us to correct it, ask us to delete it, or withdraw consent to optional processing such as marketing email. You can also ask how we handle it and challenge our compliance.

Canada: these rights come from PIPEDA and provincial equivalents. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.

United States: depending on your state you may have rights to know, delete, correct, and to opt out of sale or sharing. We do not sell personal information or share it for cross-context behavioural advertising.

If you are a client of a contractor, ask that contractor first — they control the record. We will support them in responding.

We use storage in your browser to keep you signed in and to remember preferences such as your region. These are necessary for the service to work.

We do not use advertising cookies or third-party ad trackers.

SupplyAxis is a tool for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe we have, contact us and we will delete it.

If we change this policy materially, we will update the date at the top and, for significant changes, notify account holders by email.

Privacy questions, access requests, and complaints: privacy@supplyaxis.ai.