Privacy Policy (Canada)

1. Who is accountable for your personal information?

The organization accountable for your personal information under PIPEDA is the company that operates TaskRight:

This is a United Arab Emirates company, and it does not have a Canadian branch, a Canadian office or a Canadian representative. That does not put it outside Canadian privacy law: PIPEDA applies to an organization in respect of personal information it collects, uses or discloses in the course of commercial activities, and it applies to us because we offer our service to people in Canada. Accountability sits with our Privacy Officer, who can be reached in writing at the address above or at hello@taskright.com.

Today we operate in Toronto and the Greater Toronto Area. If that changes, this page changes with it.

2. What personal information do we collect?

From homeowners

• Job request details: service type, city, province, neighbourhood, postal code, budget range, urgency, and your free-text description of the job.
• Contact details: name, email address, WhatsApp or mobile phone number.
• The location of the job, when you drop a pin on the map. The quote form asks "Where's the job?" and shows a map. If you drop the pin, search for an address, or press Use my location, we collect and store the exact coordinates of that pin, the full street address they resolve to, the postal code, and anything you add in the house/flat number, landmark and label fields. This is the address a provider needs in order to turn up, and it is attached to the job request you submit. It goes to the providers we pass that request to — and for an instant booking we choose those providers for you, rather than you picking them. See section 5. The map, the address search box and the coordinate-to-address lookup are all operated by Google — see section 5.
• Your saved location in the app, if you choose to give it. The app asks once, when you first open it, and "Not now" is a real answer — the app works without it. If you press Use my locationand grant permission, your device produces your coordinates once and your phone's own map service turns them into a street address and an area name. We then save on your account the street address, the coordinates, the city, the short label the address is saved under (for example "Home") and the date and time it was captured. A copy is also kept in your device's encrypted storage. We keep the city so it is already selected the next time you post a job, and we keep the address, the coordinates and the label so the app can show you the location it holds and let you correct it — nothing else reads them today. You can change it in the app at any time, and it is removed when you delete your account (see section 9). We read your location only while you are using the app, we never ask for it in the background, and this saved location is not sent to any provider.
• Consent record: the date and time you submitted a job request.
• Communications: messages you send us by email, through the Platform, or over WhatsApp.

From service providers

• Business and contact details: business name, contact name, business address, postal code, the area you cover, business phone, business email, business website and social links, the year you were established, and the service categories you work in.
• Profile content: services offered, service areas, pricing, photographs, credentials and portfolio images you upload.
• Account and billing: email address, phone number, login credentials, subscription status and billing records. Card details are collected and held by our payment processor, Stripe, and are never stored by TaskRight.
• Performance data: leads received, response rate, customer reviews, and account activity.

We also build provider listings from public business information, before that provider has ever contacted us. Most of the Canadian listings on the Platform today began this way: we take the business name, address, phone number, website, Google rating and Google review count from that business's public Google Business Profile. If you are a provider and you would rather not be listed, email hello@taskright.com and we will remove the listing.

Collected automatically when you use the Platform

• IP address, device and browser type, operating system;
• pages viewed, time spent, referring URL, and the search terms you type on the Platform;
• cookie and similar advertising and analytics identifiers (see our Cookie Policy);
• the country and city your internet connection is in, looked up from your IP address so the job form can pre-select your city.

3. What do we use it for?

• To operate the Platform and match homeowners with service providers.
• To pass a homeowner's job description and job address, and their contact details, to the providers that request goes to — the ones the homeowner picked, or, for an instant booking, the ones we picked for them.
• To build provider listings and keep them accurate over time.
• To take provider subscription payments through Stripe.
• To contact you about your account, your requests, and changes to our service.
• To send onboarding and service messages, and — only where you have given express consent — commercial electronic messages such as marketing email. Every one of those carries an unsubscribe link, as Canada's Anti-Spam Legislation (S.C. 2010, c. 23) requires, and unsubscribing takes effect for all marketing.
• To improve the Platform, understand how it is used, and detect and prevent fraud and abuse.
• To meet our legal obligations and to respond to lawful requests from public authorities.

We do not use your personal information for any new purpose without telling you and, where the law requires it, asking you first.

4. What is our legal basis — and when do we rely on consent?

PIPEDA is built on consent. We collect, use and disclose your personal information with your knowledge and consent, except in the limited situations where the Act itself permits an organization to act without it.

• Express consent — you give it by submitting a job request, which tells you before you submit that your details and the job address go to the providers that request reaches; by granting the app location permission; and by ticking the box for marketing email.
• Implied consent — where the purpose is obvious from what you are doing and the information is not sensitive: for example, using the email address you gave us to send you the quotes you asked for, or using your postal code to find providers who cover your area.
• Without consent, where PIPEDA allows it — for example to investigate a breach of an agreement or a contravention of the law, to prevent or detect fraud, to respond to a lawful request from a court or a public authority, or where the information is publicly available in the way the Act defines.

You can withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. We will tell you what withdrawing means in practice — for example, we cannot pass your job to a provider if you withdraw consent to share it. See section 10.

5. Who do we share it with?

We share your personal information only with the recipients below, and only to the extent necessary. We do not sell it.

• The providers you are matched with. When you submit a job request we pass the job details and the job address to the providers that request reaches, and how those providers are chosen depends on which kind of request it is. If you asked for quotes, they are the providers you picked. If you made an instant booking at a fixed price, you did not pick anyone and we chose for you — we offer the job to verified providers who work in your category and cover your area, one at a time, each for a limited time until one accepts. Every provider we offer it to sees the job and the address before deciding, and the one who accepts also gets your name and phone number. A provider who declines or lets the offer lapse gets nothing further, but will already have seen the job and the address we showed them. If no one accepts, we tell you.
• Google (Google Maps Platform). The map, the address search box and the address lookup on our quote form are Google services. When you use them, what you type into the address box, and the coordinates of the pin you drop, go to Google in order to return an address. Your device also contacts Google to load the map itself. We separately read a provider's public Google Business Profile — its rating and review count — to build and update provider listings.
• Stripe (Stripe Payments Europe, Ltd.) — provider subscription payments. Stripe collects card details directly and is an independent controller for them; TaskRight never sees or stores a full card number.
• Resend — the service that delivers our email. It receives your email address and the content of the message we send you.
• Meta (WhatsApp Business Platform) — where we message you on WhatsApp about a job, your phone number and the content of that conversation are processed by Meta. Meta Pixel also receives website activity for advertising measurement (see the Cookie Policy).
• Google Analytics and Google Ads — website and app usage measurement and advertising measurement.
• Artificial-intelligence providers, and exactly what each one gets. These are not interchangeable, so we name them separately. Anthropic powers the assistant that drafts WhatsApp replies about a live job; where it runs, it receives the job context — your first name, city, the service you asked for, the recent messages in that conversation, and the names and prices of the providers quoting. OpenAI powers the search on the Platform and receives the text you type into it. Google (Gemini) helps write provider profile text and receives that provider's own public business information. None of them is permitted to use your information to train their models.
• ipapi.co — when the app opens it asks this service which country and city your internet connection is in, so the job form can pre-select your city. That request discloses your IP address and nothing else.
• Google reCAPTCHA — to tell real submissions from bots on our forms.
• Expo, Apple and Google — to deliver push notifications to your device.
• Hostinger — the hosting company whose servers store the TaskRight database and uploaded files.
• Legal and regulatory. Authorities, courts or law enforcement, where we are legally required to disclose or where we need to establish or defend a legal claim.
• Corporate transactions. On a merger, acquisition, financing or sale of all or part of the business, personal information may transfer to the acquirer subject to equivalent protections.

We remain accountable for your personal information after we transfer it. PIPEDA treats a transfer to a supplier for processing as our own use of the information, and requires us to use contractual or other means to give it a comparable level of protection while that supplier holds it. That obligation does not disappear because the supplier is in another country.

We do not give a homeowner's contact details to a provider that homeowner has not agreed to be matched with.

6. Where is your information stored, and what does that mean for you?

Your personal information is stored outside Canada, and it is accessed from outside Canada. We want that to be plain rather than buried.

• The servers are in the United States. The TaskRight Canada database, the job requests you submit, the photographs you attach and the provider profiles all sit on servers operated by our hosting provider in the United States.
• The company that runs TaskRight, and the people who administer the Platform, are in the United Arab Emirates. Our staff access your information from there in order to run the service and support you.
• Our suppliers are in several countries — including the United States, Ireland and the European Union — as listed in section 5.

While your personal information is in another country it is subject to the laws of that country, and it may be accessible to the courts, law enforcement and national security authorities of that country. No contract we sign can override those laws. This is true of a great many online services, but you are entitled to know it before you decide to use ours — which is why it is also at the top of this page.

PIPEDA does not prohibit this. What it does is hold us responsible for your information wherever it goes, and require us to be transparent about it. We use written agreements with our suppliers, restrict access to the people who need it, and encrypt your information in transit.

7. What about cookies and tracking?

We use cookies and similar technologies to operate the Platform, remember your preferences, measure usage and deliver advertising. Full details — including how to refuse them — are in our Cookie Policy.

8. How long do we keep it?

We keep personal information only as long as it is needed for the purposes in section 3, or for as long as the law requires. We would rather publish what we actually do than a schedule we do not run, so:

• Job requests and leads: kept for as long as the account exists, and acted on when you ask us to delete it. We do not delete these rows automatically on a timer — there is no such job, and we will not claim one. When you delete your account, your name, email address, phone number and the job address are taken off the record and the photographs you attached are destroyed; the job itself stays as a two-party record, because the provider you dealt with needs their own copy of what was agreed. See section 9.
• Account or contact records where no job was submitted: kept until you ask us to delete the account.
• Provider account and profile data: for the duration of the subscription and for 6 years after the last billing event, because the company that operates TaskRight is required to keep its accounting records and business correspondence for a minimum period under the law of the country where it is registered.
• Payment and billing records:held by Stripe under Stripe's own retention policy; summary records held by TaskRight for 6 years.
• Web and app analytics: Google Analytics is configured to retain event-level data for 2 months and user-level data for 14 months, after which Google deletes it and only aggregated reporting remains.
• Records of a security breach: kept for 24 months after the day we determine the breach occurred, because PIPEDA requires us to keep a record of every one.
• Legal and dispute files: for as long as the applicable limitation period runs and any claim remains live.

9. How do you delete your account?

You can delete your account at any time, and you do not need the app installed to do it. Full instructions are on our Delete your account page.

How to delete it

• In the TaskRight app: open your account settings and choose Delete account. It happens straight away and signs you out on every device.
• Without the app: email hello@taskright.com from the address on the account, or use the Delete your account page. We verify that the account is yours before deleting anything, and we confirm by email when it is done. We never act on a deletion request we cannot tie to the account holder, because doing so would let a third party close your account.

What is removed

Your name and contact name, email address, phone and WhatsApp numbers, the job address, the map coordinates and the postal code where we hold them, your profile text, profile photographs, website and social links, your password and one-time codes, every sign-in token and emailed sign-in link, every registered app device, and your saved providers. The photographs you attached to a job request are deleted outright — both the record of them and the image files themselves, so the links stop resolving. This cannot be undone.

What is retained, and on what basis

• Jobs, quotes and messages are a two-party record: the other side to the transaction keeps their own copy, so the record stays and your name, email address and phone number are removed from it.
• Reviews you wrote stay, attributed to Former customer, so a provider is not penalised for your decision. Reviews written about your businessstay because they are the authors' personal information and their words, not yours to erase.
• Invoices and payment records are retained for 6 years after the last billing event, as stated in section 8 above. Deleting an account also cancels any paid subscription at the end of the period already paid for; no further payment is taken.
• Records required for a live dispute, for security or for fraud prevention, for as long as that purpose subsists.

Where a record must survive for one of the reasons above, it is anonymised rather than kept in your name: the identifiers are overwritten so the record can no longer be tied to you.

If work is booked

A booked job does not prevent you from deleting your account. If you are a provider who has been chosen for a job, deleting your account cancels that booking, reopens the customer's request so the other quotes are live again, and notifies that customer — so nobody is left expecting a provider who will not arrive.

10. What are your rights under PIPEDA, and how do you use them?

Under PIPEDA you have the following rights over the personal information we hold about you. Every one of them is exercised the same way: email hello@taskright.com from the address on your account, or write to the Privacy Officer at the address in section 1.

• Access. On written request you can be told that we hold personal information about you, what we use it for, and to whom we have disclosed it — and be given access to the information itself.
• Correction. You can challenge the accuracy and completeness of what we hold and have it amended. Where a correction matters to someone we already shared it with, we will pass the correction on.
• Withdrawal of consent. You can withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, and we will tell you what that means for the service before it takes effect. Withdrawing consent to marketing is immediate and costs you nothing else.
• Deletion. You can delete your account outright — see section 9 for what goes and what stays.
• Complaint. You can challenge our handling of your information, and we must investigate.

We will respond to an access request within 30 days of receiving it. PIPEDA lets an organization extend that by up to a further 30 days in defined circumstances — if we ever need to, we will write and tell you why before the first 30 days are up. Access is free unless we tell you in advance that a cost applies and you agree to it.

If you are not satisfied: complain to us first, then the OPC

Start with us. The Office of the Privacy Commissioner of Canada asks you to raise the issue with the organization before bringing it to them, and may not accept a complaint if you have not. So write to hello@taskright.com and say what went wrong — we will investigate and reply.

If we do not respond, or you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada. It is free, and you do not need a lawyer.

11. How do we protect it, and what happens if there is a breach?

We apply technical and organisational measures appropriate to the sensitivity of the information: encryption in transit (HTTPS/TLS), access controls that limit who can see what, logged administrator actions, regular backups, written agreements with the suppliers listed in section 5, and vetting of personnel.

No system is perfectly secure. If a breach of our security safeguards creates a real risk of significant harm to you — the standard PIPEDA sets — then we will:

• report it to the Privacy Commissioner of Canada as soon as feasible after we determine the breach has occurred;
• notify you directly, unless the law prohibits it, with enough information for you to understand what happened and to take steps to reduce the risk of harm;
• notify any other organization or institution that can reduce the risk of harm to you; and
• keep a record of the breach, as PIPEDA requires of every breach whether or not it is reportable, and give it to the Commissioner on request.

"Significant harm" is broad: it includes humiliation, damage to your reputation or relationships, loss of employment or business opportunity, financial loss, identity theft, and damage to or loss of property.

12. Do we collect information from children?

TaskRight is not directed at children under 18 and we do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact hello@taskright.com and we will delete it.

13. How will you know if this Policy changes?

We may update this Privacy Policy to reflect changes in our practices, our technology or the law. The "Last updated" date at the top shows when this version took effect. Material changes will be notified by email or by a notice in the Platform.

14. How do you contact us?

To exercise your rights, ask a question, or raise a concern about your personal information, write to our Privacy Officer at: