Draft. This policy is being finalized and isn't in effect yet.
Privacy Policy
The short version. We never sell personal information or use it for advertising. Our business apps keep their main records in Canada. This website has no cookies, analytics or trackers. Our field apps record location only at set job steps (tapping Arrived, taking a job photo, finishing a step), never in the background.
1. Who we are
Verkholm Inc. ("Verkholm", "we") is a Canadian software company based in British Columbia. This policy explains how we handle personal information on this website and in the apps we provide to businesses.
We follow British Columbia's Personal Information Protection Act (PIPA) and, where they apply, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and the privacy laws of other provinces where the work is done. When the work is for a BC public body, such as a municipality, we also meet the duties that the Freedom of Information and Protection of Privacy Act (FIPPA) places on its service providers and their subcontractors.
Our Privacy Officer is responsible for making sure Verkholm follows these laws. Contact: Privacy Officer, Verkholm Inc., privacy@verkholm.ca.
2. This website
- No cookies, analytics or trackers. This site loads no third-party scripts, fonts or ads.
- Server logs. Our web host, Cloudflare, may automatically record basic technical details, such as IP address, browser type, the page requested and the time, to keep the site secure and running. It keeps them under its own retention rules, and we don't use them to identify visitors.
- Email. If you email us, we use your address and message only to reply and keep a record of the conversation.
3. Our business apps
We build field apps that companies give to their staff, such as work-order apps for meter installation crews. An app may show the name and logo of the company that uses it. On Google Play and the App Store, these apps are published by Verkholm Inc., which is shown as the developer or seller. This section applies to every one of those apps, whatever name it appears under.
Our role
The company that uses the app (usually your employer) owns its records and decides what information its app collects and why. For customer and meter information, the utility or municipality the work is for may also set the rules. We act as a service provider: we handle the information only on their behalf, under a written agreement. For questions about how your employer uses this information, contact your employer's privacy officer. We'll help them answer.
How information is collected
Information comes from three places. The company's office enters or imports it (for example, job lists from its utility clients). Workers enter it in the app. Or the app records it with the phone's camera and GPS, at the job steps described below.
What's collected
| Information | Examples | Why |
|---|---|---|
| Account details | Name, email address, phone number (if added), role, company | Sign-in, invitations, assigning work |
| Device details | Phone model, operating system, app version, last sync time, an ID the app creates for each phone, and a notification token | Security, support, sending job alerts, shutting off lost phones |
| Job records | Service addresses, utility account numbers, meter and radio details, reads, materials and extras, notes | Doing the work, reporting and billing it to the company's clients, and working out crew pay where the company pays by the job |
| Customer contact details | Name and phone number of the occupant, if the company or utility provides them | Arranging access and appointments |
| Photos | Meters, radios, meter boxes and pits, conditions before and after work | Proof of work, quality checks, resolving disputes |
| Location | A GPS point captured when a worker taps Arrived, takes a job photo or completes a job step | Confirming the work was done at the right address |
| Signatures and acknowledgements | A customer's or worker's sign-off on a job | Records and proof |
| Activity log | Who created or changed a record, and when | Audit trail, security and resolving disputes |
| Sign-in and server logs | IP address, sign-in times, errors | Security and keeping the service running |
| Diagnostics | Crash reports and error details, set up to leave out personal details | Fixing problems |
Location. Our field apps never track location in the background or outside work. They capture a location only at the job steps listed above, and only while the app is open.
Photos. Job photos are taken with the camera inside the app and stored inside the app. They aren't saved to the phone's photo gallery or its cloud photo backup. We ask workers to frame photos on the equipment and avoid capturing people, faces and licence plates.
How it's used
We use this information only to provide the app to the company: running jobs, syncing between phones and the office, producing reports and exports, keeping the system secure, giving support and fixing bugs. We never sell it or use it for advertising. We use anonymous, combined statistics to improve our apps only where the company has agreed, and only if they can't identify a person, an address or the company.
Who it's shared with
- The company that uses the app, which owns the records, and the clients it does the work for (such as utilities, municipalities or the main contractor on a project), as that company decides.
- Our service providers, who help us run the apps and this website under written contracts. Each may use the information only to provide its service to us, and must give it the same or equal protection as this policy:
| Provider | What it does | Where |
|---|---|---|
| Supabase | Main database, photo storage, sign-in | Montreal, Canada |
| PowerSync | Keeps phones and the main database in step, holding a working copy. The US copy holds the job details each phone needs for its assigned jobs (service addresses, access notes, customer names and phone numbers, job status and appointments, meter and radio details, the client's notes and any client fields the office chooses to show, and the work recorded on each job: readings, extras without prices, notes, photo details but not the photos, send-backs, and who did each step and when), program set-up without prices, coworkers' names and each phone's status. It holds no prices or pay, no GPS readings and no client account numbers | United States |
| Google Maps and Apple Maps | Show job pins on a map in the phone app (they see which map area is being viewed) | United States and other countries |
| Expo | Builds and delivers app updates and relays push notifications (no job records, names or addresses) | United States |
| Apple and Google | App stores and delivering push notifications (no personal details in the message) | United States and other countries |
| Amazon Web Services (Amazon SES) | Sends invites and sign-in codes (email address and code only) | Montreal, Canada |
| Microsoft (Exchange Online) | Holds emails sent to our hello, support and privacy addresses | Canada |
| Cloudflare | Serves this website and keeps its access logs | United States and other countries |
- When the law requires it, for example a valid court order. If anyone demands records we hold for a company, we refer them to that company and tell it, unless the law forbids us.
Where it's stored
Our main database, photos and accounts are stored in Canada (Montreal). Our sync service, PowerSync, keeps a working copy in the United States so phones stay up to date. The US copy holds the job details each phone needs for its assigned jobs (service addresses, access notes, customer names and phone numbers, job status and appointments, meter and radio details, the client's notes and any client fields the office chooses to show, and the work recorded on each job: readings, extras without prices, notes, photo details but not the photos, send-backs, and who did each step and when), program set-up without prices, coworkers' names and each phone's status. It holds no prices or pay, no GPS readings and no client account numbers; those stay in Canada. Supabase is a US-based company. Its staff may reach these systems from outside Canada to support them, and US authorities could ask it for information under US law. The other providers above handle limited information outside Canada, such as the phone details needed to deliver a notification or update, and visits to this website. Information handled in another country may be accessed by that country's courts, law enforcement and national security authorities under its laws.
How long it's kept
- Job records and photos: for as long as the company's agreement with us, and its own legal and contract duties, require.
- Account and device details: while your account is active. They're deleted within 30 days after your company removes you or you ask us to delete your account.
- Crash reports: our apps send their own error reports, with personal details removed, to our database in Canada. They're deleted after 90 days.
- When a company stops using our apps: it has 30 days to export its records. We then delete them from our live systems, and backup copies expire within about 35 days after that.
How it's protected
- Encryption in transit and at rest, in the cloud and on the phone
- Invite-only access, with each company's data kept separate from every other company's
- Two-step sign-in for office and admin users, and role-based permissions
- Remote sign-out, and removal of the app's work data from a lost phone the next time it connects
- An activity log of who changed what and when, and backups we test by restoring them
If something goes wrong
If personal information in one of our apps is lost, stolen or seen by someone who shouldn't see it, we tell the company that uses the app without delay, and immediately where the law requires it. We give it the facts it needs and help it notify the people affected and the privacy commissioner where required. We keep a record of every breach for at least two years.
4. Your choices and rights
- See or correct your information. If you use one of our apps at work, ask your employer's privacy officer. If you're a homeowner or occupant and work was done on your meter, ask the utility or the company that did the work. You can also contact us, and we'll promptly pass your request to the right company and help it answer. For information we hold for our own purposes, such as emails you send us, ask us directly and we'll answer within 30 days.
- Delete your account. See how to request account deletion. Job records belong to the company you did the work for and may be kept as described above.
- Turn off permissions. You can switch off the app's camera or location access in your phone's settings at any time. Job steps that need a photo or a location will ask again.
- Complaints. Contact us first. You can also contact the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.
Our apps are for workplace use and aren't meant for children.
5. Changes and contact
If we change this policy, we'll post the new version here with a new effective date. We'll tell the companies we work with about important changes before they take effect.
Privacy Officer, Verkholm Inc.
British Columbia, Canada
privacy@verkholm.ca