Skip to content
CanBuildOS

CanBuildOS Privacy Policy

Version 1.4 · Effective October 24, 2026.

1. Who we are

CanBuildOS is operated by Joomberry Canada Ltd. ("Joomberry", "we", "us"), a company in Ontario, Canada. This policy explains how we handle personal information on canbuildos.com, in the CanBuildOS app, and in the client portal at client.canbuildos.com. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

2. Our two roles

  • Your own account. For information about you as a user (your name, email, sign-in and security records), Joomberry decides how it is handled and is responsible for it.
  • Information inside a workspace. Contractors and owner-builders put information about their clients, homeowners, suppliers and trades into their workspace. The business that owns the workspace decides what goes in and why. We store and process it on their behalf, only to provide CanBuildOS. If your information is in someone's workspace, contact that business first; we will help them respond.

3. What we collect

Account information. Your name and email address; your password, stored only in a scrambled (hashed) form that we cannot read; two-factor authentication settings, stored encrypted; and your role in each workspace.

Workspace content. What you and your team enter: company and legal-entity details, clients and contacts, suppliers, estimates, invoices, costs and payment records, owner-builder consultation notes and recommendations, documents and photos.

Client portal information. For homeowners: your name, email address, password (hashed), which version of our terms you accepted and when, any payments you report, and when your access was granted or removed. If you approve or decline an estimate in the client portal, we record your answer, the name you type for an approval, any reason you give, the date and time, and your IP address. This record is kept with the estimate in your contractor's workspace.

Security records.

  • Sign-in records, including your IP address and browser type, kept for 90 days.
  • A list of your active sessions, which you can review and end yourself.
  • An audit trail of significant actions (for example, who invited whom, or who changed a workspace's status). It records who did what and when, using reference numbers rather than copies of your content.
  • Technical session data, which may briefly include the IP address and browser of visitors who are not signed in. It is deleted when the session expires.

Email records. Whether an email we sent (such as an invitation or password reset) was accepted by our email provider.

Messages to us. What you send when you contact us.

What we don't collect. We don't use advertising trackers or third-party analytics, and we don't sell personal information. CanBuildOS does not collect payment card details.

4. How we use it

  • To provide CanBuildOS: run workspaces, show the right information to the right people, and keep records you create.
  • To keep accounts and data secure: two-factor authentication, limits on repeated sign-in attempts, malware scanning of uploads, and investigating misuse.
  • To send service emails: invitations, password resets, security notices and important changes. We don't send marketing email without your consent.
  • To provide support when you ask for it.
  • To meet our legal obligations.

If you agree to give us a testimonial, we publish your quote with your name, trade and town on our website only with your permission. We keep a copy in our website's page history; if you ask, we take it off the site.

We use information only for these purposes, or for a new purpose you agree to.

5. Cookies

CanBuildOS uses only the cookies it needs to work: a session cookie and a security cookie. In CanBuildOS, the session cookie keeps you signed in and the security cookie protects forms. Our public website pages set the same two cookies for every visitor, signed in or not, because the website runs on the same system; on the website they are used only to run the site, and they expire about two hours after your last visit. We don't use third-party, analytics or advertising cookies.

6. Where your information is stored, and who helps us

We use a small number of service providers. Each may use your information only to provide its service to us.

  • Laravel Cloud: application hosting and our database. The CanBuildOS database is hosted in Canada (Canada Central region).
  • Amazon Web Services: document and photo storage, and malware scanning of uploads, in AWS's Canada (Central) region.
  • Amazon Web Services (Amazon Textract): when someone in a workspace chooses "Read this bill", the supplier bill or receipt they uploaded is sent to Amazon Textract in AWS's Canada (Central) region, which reads the supplier, date, amounts and invoice number so the person can check them before saving. We have opted out of AWS keeping this content to improve its services.
  • Amazon Web Services (Amazon Simple Email Service): our email provider, which sends our service emails, such as invitations and password resets, from AWS's Canada (Central) region.

Some of our providers are based outside Canada and may access or process information outside Canada, for example in the United States, where it may be subject to the laws of that country. We choose providers with strong security and protect information through contracts and technical controls.

7. How we protect it

  • All connections use encryption (HTTPS).
  • Passwords are hashed, and sensitive settings such as two-factor secrets are encrypted.
  • Each workspace's information is kept separate from every other workspace's.
  • Uploaded files are scanned for malware before they are released.
  • Our own staff can see a workspace's content only if the workspace owner grants support access. Every grant is time-limited and recorded.
  • Significant actions are recorded in an audit trail that can't be edited.

No system is perfectly secure. If a breach of security creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as the law requires.

8. How long we keep it

  • Account and workspace information: for as long as the account or workspace is open.
  • After a workspace is closed: we keep its content for 90 days so the owner can request an export, then delete it. Copies in our automatic daily backups are removed 30 days after that.
  • Sign-in records: 90 days.
  • Audit trail: for the life of the workspace, plus 1 year, because it protects you and us if something is disputed.
  • Invitation links: expire after 7 days, and the copy used to send the email is deleted once the email has gone out.
  • Records of setup and notice emails we send to account owners and administrators: deleted 90 days after sending.

We may keep information longer where the law requires it.

9. Your choices and rights

  • You can ask to see the personal information we hold about you, and ask us to correct it.
  • You can withdraw consent to optional uses, and ask us to delete your account, subject to legal requirements and the rights of the workspace your information belongs to.
  • If your information is in a contractor's or owner-builder's workspace, contact them first. They control that information.

Send requests to the contact below. We will reply within 30 days. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

10. Children

CanBuildOS is a business tool and is not intended for anyone under 18.

11. Changes to this policy

We may update this policy. Each version has a version number and effective date. For significant changes, we will tell you by email or in CanBuildOS before they take effect.

12. Contact our privacy officer

Debo Ogungbeje, Privacy Officer
Joomberry Canada Ltd.
support@joomberry.com
hello@canbuildos.com