Privacy policy

1. Who we are

Trussloom is an app for construction companies. It is run by SJNC inc., mailing address coming soon. In this text, "we" means that company.

This text covers the trussloom.com site and the Trussloom apps. It follows Québec’s Law 25 and the federal law, PIPEDA.

2. What we collect, and why

We collect only what we need to make Trussloom work.

What we collect	Why
Your name, language, cell number and email	To sign you in and write to you
Your sign-ins, your devices and when you signed in	To protect your account
The number or email a company enters to invite you	To invite you to a project
The work: projects, site addresses, tasks, plans, photos, messages, voice notes	So companies can work together
Your work hours, if your employer manages them in Trussloom	To pay you correctly
Your help requests, with their screenshots and voice notes	To answer you and fix the problem
What was done and when, the IP address and the type of browser	To protect the service and fix errors

We remove the GPS location from photos before we keep them. We count how the app is used per company, never per person. We count your use only if you agree. Some facts about the company are always counted, without your name. For example: companies created, invitations sent and accepted, help requests.

We never sell your information. We never share your number with other companies for advertising.

Who sees your information

• Companies on the same project see what is shared in that project.
• Your employer sees your hours and the work you do for them.
• Our team sees only what it needs to help you or protect the service.
• Our team looks at your information only from Québec.

The company that adds the work or the hours is responsible for them. We keep them on its behalf, under a written agreement.

3. Where your information is kept

We keep your information in Canada, with Google Cloud, in Montréal. Your files and photos also stay in Canada. Backup copies are kept in Toronto, in Canada, outside Québec.

These service providers receive part of your information to do their work. Some may handle it outside Canada.

Service provider	What it does for us	What it receives	Where
Google Cloud	Runs the app and keeps your information	Everything in Trussloom	Montréal and Toronto, in Canada
Google Identity Platform	Sends sign-in codes	Your cell number, your email, your sign-ins	Possibly outside Canada (see below)
Google reCAPTCHA	Checks that a person is signing in, on the web	Your IP address and details about your browser	Possibly outside Canada
Twilio	Sends text messages	Your number and the text of the message	United States
Brevo	Sends emails	Your email and the content of the message	European Union (to be confirmed)
Cloudflare	Carries the site, the app and the API between you and us	Everything you send and receive, decrypted in passing and not kept. Its security records keep the address and page of requests a rule catches	Its data centre nearest you, usually in Canada. This isn’t guaranteed
Expo, Apple and Google	Send alerts to your phone	Your phone’s address for alerts, the title and text of the alert	United States
The status page provider (to be chosen)	Shows whether the service is working	The email of people who subscribe	To be confirmed
Google Workspace	Receives the emails you send us	What you write to us	United States and elsewhere

Cell numbers used to sign in. Google Identity Platform keeps your cell number and email so you can sign in. We don’t know yet whether Google keeps them in Canada. They may be kept outside Canada, for example in the United States. We will settle this before Trussloom opens to everyone.

We assess the risks before sending information outside Québec. Each service provider is bound by a contract that protects your information.

4. How long we keep it

We keep your information only as long as needed. Then we delete it.

Information	How long
Your account	While it exists, then 30 days after it is deleted (to be confirmed)
Devices used to sign in	180 days after they were last used
The history of your numbers and emails	2 years (to be confirmed)
Requests to get back into an account	2 years after they are closed (to be confirmed)
The number or email in an invitation	90 days after the invitation ends
Work shared in a project	While the project exists
The record of actions: who did what, and when	7 years (to be confirmed)
Your work hours	6 years after the year worked (to be confirmed)
Text messages and emails we send	13 months
Your help requests	90 days after they are closed
Reported messages	1 year, longer during a review
Your requests about your information	7 years after our answer
Your acceptance of the terms	3 years after your account is deleted (to be confirmed)
Your refusals of messages (STOP, unsubscribe)	While they apply. The proof: 3 years
Emails you send us	3 years (to be confirmed)
Technical records	30 days
The security record of links to your files	90 days
Backup copies	6 weeks at most

A law may require us to keep some information longer.

5. Your rights

Law 25 and PIPEDA give you these rights:

• See: know what information we have about you.
• Correct: have wrong or incomplete information corrected.
• Delete: have your information deleted, except what a law requires us to keep.
• Get a copy: receive your information in a common format a computer can read.
• Withdraw your consent: change your mind about a choice you made.
• Complain: see section 11.

To make a request, write to the person in charge (section 8). We answer within 30 days. We may ask you to prove who you are.

A request may be about a company’s work or hours. We then pass it to that company within 2 business days. We help it answer you.

6. Cookies

• This site: no cookies, no tracking tools. Nothing is kept on your device.
• The web app: two sign-in cookies, needed to stay signed in. They are used for nothing else.
• The app’s language and theme are kept on your device.
• The web sign-in page: Google reCAPTCHA checks that a person is signing in.
• For this check, Google may use its own cookie.
• The phone apps: no advertising ID, no tracking tools.

There is no banner: nothing asks for your consent.

7. No advertising

• We don’t send advertising, by text message or by email.
• We write to you only about your account and your work.
• For example: sign-in codes, invitations, job site notices, answers from our help team.
• A company that works with you may invite you with your number or email.
• Its invitation says who it is.

To stop getting our messages:

• Text messages: reply STOP. To start again, reply START.
• Emails: tap "Unsubscribe" at the bottom of the email.

Unsubscribing doesn’t stop sign-in codes or required notices about your account. We keep proof of invitations sent and of refusals for 3 years.

8. Who is responsible

Legal name

SJNC inc.

Person in charge

Serge Nassar

Their title

president

Their email

privacy@trussloom.com

Mailing address

Coming soon

Questions in the meantime? Write to the person in charge of the protection of personal information: help@trussloom.com.

They answer your questions and requests. They keep the record of privacy incidents.

9. How we protect your information

• Your information is encrypted while it is kept.
• It is encrypted while it travels. Cloudflare decrypts it in passing to carry it (section 3).
• Each company sees only its own information and that of its projects.
• Our team’s access is limited and recorded.

An incident may carry a risk of serious harm. We then tell you, and Québec’s Commission d’accès à l’information.

10. Age and changes

Trussloom is for people 16 and older. An employer must not add a worker under 16.

We tell you at least 30 days before an important change to this policy. The version in effect is always on this page.

11. Contact us

• Questions and requests: privacy@trussloom.com
• By mail: SJNC inc., mailing address coming soon
• Complaint in Québec: Commission d’accès à l’information
• Complaint at the federal level: Office of the Privacy Commissioner of Canada