Privacy Policy

2.1 Applicable Law

PaidPainter is subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Additional rights for California, USA residents are described in Section 12 of this Policy.

2.2 Consent

Under PIPEDA, we obtain meaningful consent from individuals before collecting, using, or disclosing their personal information, except where the law permits otherwise. By registering for an Account and using the Services, you provide express consent to the practices described in this Policy. You may withdraw consent at any time by contacting hello@paidpainter.com, subject to legal and contractual restrictions. Withdrawal of consent may result in our inability to provide some or all of the Services.

3.1 Information You Provide Directly

• Registration information: name, email address, and password.
• Organization details: business name, address, and contact information.
• Billing information: payment method details processed by Stripe. PaidPainter does not store full payment card numbers.
• Quote and project data: client names, site addresses, pricing inputs, scope of work details, and all data you create within the Services.
• Company Profile data: labour rates, overhead expenses, crew size, operational assumptions, and other configuration data you enter.
• Client data: names, addresses, and contact details of your clients that you enter into quotes. See Section 8 regarding your obligations as data controller for client data.
• Communications: support requests, feedback, and correspondence you send to us.

3.2 Information Collected Automatically

When you access the Services, we and our service providers may automatically collect:

• Log data: IP address, browser type and version, operating system, referring URLs, and pages viewed.
• Device information: device identifiers and hardware model.
• Usage data: features accessed, actions taken within the Services, timestamps, and session duration.
• Analytics data: collected via Firebase Analytics (see Section 5.1 for details).
• Cookies and similar tracking technologies (see Section 7).

3.3 Information from Third Parties

• Authentication providers such as Google, if you use single sign-on.
• Stripe, which may provide transaction confirmations and billing status.

3.4 AI Feature Data

When you use AI Features, including My Coach and AI-generated scope of work descriptions, the content you input is transmitted to Google Gemini via the Genkit framework for processing. This data is subject to Google’s applicable data processing terms. PaidPainter does not use your individual AI inputs to train its own models.

5.1 Service Providers

We disclose personal information to third-party service providers that perform services on our behalf:

All service providers are contractually required to use your personal information only to provide services to PaidPainter and to maintain appropriate security safeguards.

5.2 Business Transfers

If PaidPainter undergoes a merger, acquisition, reorganization, or asset sale, your personal information may be transferred as part of that transaction. We will notify you before your personal information becomes subject to a materially different privacy policy.

5.3 Legal Compliance

We may disclose your personal information if required by law, regulation, or valid legal process, including court orders or law enforcement requests. Where permitted, we will notify you of such disclosure.

5.4 Protection of Rights

We may disclose your personal information where necessary to investigate, prevent, or take action against violations of our Terms of Service, fraud, or safety issues.

5.5 With Your Consent

We may share your personal information with third parties when you have provided express consent.

9.1 Storage Location

Your personal information is stored in Firebase Firestore, a cloud database operated by Google Cloud. Data may be stored and processed in data centres located outside of Canada, including the United States. By using the Services, you acknowledge and consent to this transfer.

9.2 Security Measures

PaidPainter implements reasonable administrative, technical, and physical safeguards, including:

• Encrypted data transmission via TLS/HTTPS.
• Firebase Authentication for secure access management.
• Role-based access controls limiting employee access to personal information.
• Firestore security rules restricting data access on a per-user and per-organization basis.

No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

9.3 Data Retention

• Active Account data is retained for as long as your Account is active or as necessary to provide the Services.
• Upon cancellation, User Data is retained for thirty (30) days to allow for export, then deleted.
• Billing records and transaction history are retained for a minimum of seven (7) years to comply with tax and accounting obligations.
• Anonymized and aggregated analytics data may be retained indefinitely.
• Data required to be retained by applicable law will be retained for the legally mandated period.

11.1 Right to Access

You may request access to the personal information we hold about you. Contact hello@paidpainter.com. We will respond within thirty (30) days.

11.2 Right to Correction

You may request correction of inaccurate or incomplete personal information. Many fields can be updated directly through your Account settings.

11.3 Right to Deletion

Subject to legal retention obligations, you may request deletion of your personal information by contacting hello@paidpainter.com. We will process your request within thirty (30) days and notify you of any information we are legally required to retain.

11.4 Right to Withdraw Consent

You may withdraw consent to our processing of your personal information at any time by contacting us. Withdrawal may limit our ability to provide certain Services.

11.5 Right to Lodge a Complaint

If you believe we have not handled your personal information in accordance with applicable law, you may lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca, or with the applicable provincial privacy commissioner.

12.1 Categories of Personal Information Collected

In the past twelve (12) months, PaidPainter has collected: identifiers (name, email, IP address); commercial information (billing records, subscription history); professional information (business name, trade details); and internet activity data (usage data, log data).

12.2 Your CCPA/CPRA Rights

California residents have the right to: know what personal information we collect and how it is used; request deletion of personal information; correct inaccurate personal information; opt out of the sale or sharing of personal information (PaidPainter does not sell or share personal information for cross-context behavioral advertising); and non-discrimination for exercising privacy rights.

To exercise these rights, contact hello@paidpainter.com. We will respond within forty-five (45) days, with a possible extension of an additional forty-five (45) days where reasonably necessary.

12.3 Authorized Agents

California residents may designate an authorized agent to submit requests on their behalf. The agent must provide written authorization signed by you.