Privacy Policy

1. Who Is Responsible

Paperticket is operated by Paperticket Software Inc. Our Privacy Officer is responsible for privacy inquiries and can be reached at the support contact below. We process account and service information to run Paperticket. Businesses using the service are responsible for the customer and staff information they enter and for giving appropriate notices and obtaining any required consent.

2. Information & Purposes

We process account names, email addresses, authentication and membership information; company settings; customer names, phone numbers and service addresses; equipment records, job notes, closeout paperwork photos, other attachments, and operational audit records. These support dispatch, recordkeeping, access control, troubleshooting, and customer service. Messaging features process recipients, message contents, delivery status and opt-out records. Enabled push notifications use device subscription endpoints. Billing uses company and contact details, subscription identifiers and payment status; payment details entered at Stripe checkout are handled by Stripe. Support requests include what you choose to send us. Security processing can include network and request information, rate-limit identifiers derived from IP addresses, and bot verification tokens. Hosting providers may also process IP addresses and request logs.

3. Location & Geocoding

Customer site addresses are used for geocoding and maps. Customer arrival ETA messages use a time entered by staff, not an automatically calculated route arrival time. When you request a location refresh and grant browser permission, the app obtains location coordinates, accuracy and capture time for nearby-job sorting and dispatch coordination. The current browser flow requests a location sample rather than continuously tracking you in the background. You can deny or revoke browser location permission; location-dependent features may then be limited. Company location retention settings determine when stored samples become eligible for maintenance cleanup.

4. Product Analytics

Product analytics is enabled for eligible signed-in workspace use. We collect internal company and user IDs, role, random session and flow IDs, feature views and actions, timestamps, durations, outcomes, approved error categories, and coarse device, connection and app-version information. This helps identify usability problems and reliability failures. It is not anonymous simply because reports show aggregates. This analytics stream does not include customer record contents, form values, search text, precise location or session replay. Events and session records become eligible for deletion after 90 days through the maintenance process; actual cleanup depends on that process running. Contact support with questions or requests about analytics; there is no in-app individual opt-out control.

We also keep anonymous visitor analytics on our public pages (the marketing pages, the demo, sign-up, the comparison pages, the HVAC tools and the public equipment tag page, recorded without the tag’s code) to learn what people who arrive from our ads do there. We record which page was viewed, how far down it was scrolled, time on the page, which sign-up or demo buttons were pressed, which demo buttons were tried (by their label), whether a sign-up was started and submitted, and whether a new account’s email was confirmed, together with the campaign tags from the link you arrived by, whether that link carried an ad click identifier (not the identifier itself), the referring site’s name, and a coarse device type and screen width. Each browser tab gets a random visit ID that is not linked to your account. An email confirmation is recorded once per account under its own random ID; we separately note which accounts have been counted, so none is counted twice. We do not record your IP address, browser details, what you type into any field, or anything from a signed-in workspace. These records are kept for 90 days, after which the maintenance process removes them. If your browser sends a Do Not Track or Global Privacy Control signal, nothing is recorded.

5. Cookies, Browser Storage & Offline Copies

Authentication uses browser storage or cookies to keep you signed in. The app also stores preferences and cached dispatch records locally, and uses an IndexedDB outbox for unsynchronized notes, completion details and photos. These copies may contain personal information. Protect shared devices, sign out when finished, and confirm queued work has synchronized before clearing site data. Clearing browser data can remove local copies and unsent work; a server deletion request does not remotely erase every downloaded export or offline device copy. If you arrive through one of our advertising or campaign links, the campaign tags in that link (such as utm_source and utm_campaign, and Meta’s click identifier) are kept in a first-party cookie for up to 90 days and saved with your account if you create one, so we can tell which campaigns lead to sign-ups. On our public pages, the random visit ID for anonymous visitor analytics (section 4) is kept in the tab’s session storage and is cleared when you close the tab; it is not a cookie.

6. Service Providers & Disclosure

Providers receive the information needed for their enabled functions. The application integrates with:

• Vercel: Application hosting, DNS and request processing. Application functions are configured in the United States; network delivery and provider support may involve other countries. See provider security and subprocessor information.
• Supabase: Authentication, database and file storage; the configured project is hosted in Canada, including for customers in the United States. Support and subprocessors may process information in other countries. See the processing terms and subprocessor list.
• Mapbox: Geocoding and mapping using addresses or coordinates, with US processing and international network delivery. Provider locations and subprocessors.
• Anthropic: When AI capture is enabled and a user asks the app to read an equipment nameplate photo, a supplier receipt photo, pasted call notes, or files uploaded to import customers and equipment, that photo, text or file is sent to Anthropic’s Claude API to propose field values, which a user reviews before anything is saved. When anyone uses the free nameplate decoder on our HVAC tools pages, the nameplate photo they choose is sent to Anthropic’s Claude API to read it; we do not store that photo or the reading. Processing may take place in the United States or other countries. See the commercial terms.
• Twilio: SMS phone numbers, message contents and delivery information, including US processing and telecommunications carriers involved in delivery. Provider locations and subprocessors.
• Resend: Authentication emails through the configured SMTP service, and transactional notification emails when enabled; also receives emails forwarded to a company’s receipt address (sender, subject, body and attachments are processed to read the receipt). Message content and delivery records are stored in the United States. Provider locations and subprocessors.
• Stripe: Checkout, billing addresses, sales tax calculation for US subscriptions, recurring billing and payment processing through its Canadian service and international providers, including US cloud infrastructure. Provider locations and subprocessors.
• Cloudflare: Turnstile bot verification, including browser and network signals processed through its international infrastructure. See the Turnstile Privacy Notice and provider locations.
• Meta Platforms: Advertising measurement on our public pages only — the marketing page, the demo, sign-up, the comparison pages and the HVAC tools — using the Meta Pixel. It sets Meta cookies in your browser and reports page views and completed sign-ups, with United States and international processing. A sign-up counts once its email is confirmed: that one event is reported from the page you land on right after confirming and, unless the browser you signed up or confirmed with sends a Do Not Track or Global Privacy Control signal, also from our server through Meta’s Conversions API, both with an event ID derived from your account ID so Meta counts it once. The server report carries your email address and account ID as one-way hashes, the Meta browser and ad-click identifiers saved when you signed up, and the IP address and browser details of the request that confirmed your email; we keep those network details only until the report is sent, and no longer than about a week if it cannot be. Apart from that event it does not run inside a signed-in workspace, and customer, job and equipment records are never sent to Meta. See the provider privacy policy.
• Apple iCloud Mail: Support email delivery and storage, including information you send to our support address. Apple may process information internationally under its privacy policy.

Device push services selected by your browser or operating system, such as Apple or Google, deliver notifications when you enable them. Their processing locations depend on the provider; enabling notifications does not confine processing to Canada. Optional integrations selected by your company may receive the records needed for that integration. Company members see information according to their permissions; authorized operator access may be needed for support and security. Information may also be disclosed where required or permitted by applicable law. Providers may process information outside Alberta or Canada, where local laws may allow government access. The provider links above form part of our written information about processing locations and purposes. They cover services beyond those we use; a listed provider location does not mean every record is processed there. Serving customers in Canada and the United States is not a promise of Canada-only storage or processing. Contact the Paperticket Privacy Officer through Support for our current processing inventory, questions about a particular provider or information about our foreign-provider practices.

7. Retention, Deletion & Exports

Business records are retained to provide the service and meet applicable recordkeeping requirements. Cancelling a subscription or reaching the trial end does not automatically erase records. Some equipment and service records have longer retention requirements. Request account closure or deletion through support so we can verify authority, identify the records involved, and explain any legal or operational retention limits. After an authorized closure request, we agree an export and deletion plan, remove records no longer needed, and explain any records retained for accounting, disputes or legal requirements. Backups and provider copies may persist after active records are removed. Backups are retained separately and rotated by the operator; provider copies follow their retention processes. Immediate deletion of every copy is not promised. A restricted deletion record is kept so deletions can be reapplied if a backup is restored. Active company owners can use Company Settings to export company records and the available attachment archive, including during billing restriction. Product analytics and restricted platform records are excluded from ordinary company exports; use a privacy request for personal information access.

8. Safeguards, Choices & Requests

The service uses authentication, company access controls and restricted administrative access to protect information. No online service or device is risk-free. Avoid putting unnecessary sensitive information in notes, photos or support messages. You may request access to or correction of your personal information, ask about retention or disclosure, withdraw consent where applicable, or raise a privacy complaint through Support. We may need to verify identity and authority; legal exceptions may limit access or deletion, and withdrawing information needed for a feature can prevent its use. For records entered by your service company or employer, contact that business as well. You can also contact the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada, as applicable.

9. Policy Updates

The published version and effective date identify this policy. Material changes to purposes or practices will be communicated, and additional consent sought where required. Draft previews are not a confirmation that publication requirements or operational checks are complete.