Privacy Policy

Effective 22 August 2026

The short version. We collect what the software needs to run your projects and nothing else. We do not sell personal information, we run no advertising or third-party analytics, and we never see your clients’ card numbers. Location is only ever recorded if a worker’s device grants permission, and the app works fully without it.

1. Who we are

Ridgepole Software Inc. (“Ridgepole”, “we”) provides construction management software to general contractors. We are based in Canada.

This policy is governed by Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). Where provincial privacy legislation applies to you, that legislation applies in addition.

2. Two different roles, this matters

We handle personal information in two distinct capacities, and your rights differ depending on which applies:

As the organisation responsible, for the account information of our own customers: the contractor businesses that subscribe, and the people at those businesses who sign in. We decide how that information is used, and this policy governs it.
As a service provider, for everything a contractor enters about their own projects: their homeowner clients, their subcontractors and suppliers, their employees, their leads. We process that information on the contractor’s instructions, for the purpose of providing the software, and for no purpose of our own. The contractor decides what is collected and why.

If a contractor holds information about you, because you are their client, their subcontractor or their employee, and you want to see, correct or delete it, contact that contractor directly. They control it. We will assist them in responding, but we cannot act on their data without their instruction. If you do not know who holds your information, write to us and we will route your request.

3. What we collect

Account and billing information

Name, work email, phone number, company name, business address, and role. Subscription status and billing history.

We never receive or store payment card numbers. Card details are entered directly with Stripe, our payment processor, and we receive only a token, the last four digits, the card brand and the result.

Project information entered by our customers

Contractors use Ridgepole to record project addresses and budgets, client contact details, subcontractor and supplier contacts and their insurance documentation, leads, estimates, proposals, invoices, payments, daily site logs, photographs, documents and drawings, change orders, requests for information, punch lists, warranty claims, and messages exchanged with clients and subcontractors.

Time records and location

Where a contractor uses time tracking, we record hours worked, the project, and, for clock-in and clock-out entries and some field forms, an approximate latitude and longitude.

Location capture is optional and permission-based. The app requests location from the device; if permission is refused, unavailable, or the request times out, the entry is saved without it and nothing is blocked. We capture a single coordinate at the moment of clocking in or out, or at the moment a field form is submitted. We do not track continuous location, we do not track anyone in the background, and we do not track anyone who is not clocked in.

If you are a worker: your employer decides whether to use this feature and is responsible for telling you and for obtaining any consent the law requires of them. It is their record, not ours. Some provinces impose specific obligations on employers who electronically monitor employees; those obligations fall on your employer.

Photographs and documents

Files uploaded to Ridgepole are stored on our behalf by Google Cloud Storage. Photographs may contain embedded metadata such as the time taken and, depending on device settings, camera location. We do not strip that metadata, and we do not read it.

Technical information

IP address, browser and device type, pages and features used, and error diagnostics. We use this to keep the service running, to investigate faults, and to detect abuse.

We run no third-party analytics, no advertising trackers, and no cookies that follow you off our site. The only cookies and local storage we use keep you signed in and remember interface preferences such as light or dark mode.

4. Why we use it

To provide the software and the features our customers have chosen to use
To authenticate users and keep accounts secure
To send transactional messages: magic links, invitations, notifications a user has enabled, and reminders about overdue items
To take payment for subscriptions, and to enable our customers to take payment from their own clients
To provide support, including diagnosing faults reported to us
To meet legal, tax and accounting obligations

We do not sell personal information. We do not share it for advertising. We do not use customer project data to train machine learning models.

5. Support access to customer accounts

A small number of authorised Ridgepole staff can access a customer’s account to investigate a problem, including by temporarily viewing the software as that customer sees it. Every such access is recorded in an audit log that identifies the staff member, the account and the time.

We do this only to operate and support the service, or where we are legally required to. We state it plainly because it is true of essentially all hosted software and is rarely disclosed.

6. Who we share information with

We use a small number of service providers to run Ridgepole. Each receives only what it needs for its function, and none is permitted to use it for its own purposes. The current list, what each does, and where each stores data, is published at ridgepole.ca/subprocessors.

Beyond those providers, we disclose personal information only:

On our customer’s instruction, for example, emailing a proposal to their client
Where required by law, or by a warrant, subpoena or court order
To protect the rights, safety or property of Ridgepole, our customers, or the public
To a successor in a merger or acquisition, subject to this policy continuing to apply

Information stored outside Canada

Some of our providers store or process information in the United States or elsewhere. Information held in another country is subject to the laws of that country, and may be accessible to its courts and law enforcement. The sub-processor list states where each provider holds data.

7. How long we keep it

While your account is open, we keep project data for as long as the contractor keeps it. Deleting a record in the app marks it deleted and removes it from view; it remains recoverable for a limited period so that a mistaken deletion can be undone.
After an account closes, data is available for export for 30 days, then deleted from live systems.
Backups, encrypted backups are retained on a rolling schedule and overwritten in turn. Data may persist in a backup for a period after live deletion.
Records we must keep, invoices, payment records and tax documentation are retained for the period Canadian tax law requires, currently six years.

8. Security

Traffic is encrypted in transit with TLS. Passwords are never stored by us, authentication is handled by Google Firebase Authentication. Access to production systems is limited to staff who need it. Each customer’s data is isolated by an account identifier enforced centrally rather than in individual features, so that a fault in one part of the software cannot expose another customer’s records. Backups are encrypted and stored separately from the systems they protect.

No system is perfectly secure. If a breach occurs that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and we will tell our customers what happened, what was affected, and what we are doing about it.

9. Your rights

Under PIPEDA you may:

Ask what we hold about you, and receive a copy
Correct it if it is inaccurate or incomplete
Withdraw consent, subject to legal and contractual limits, withdrawing consent to essential processing may mean we can no longer provide the service
Complain, to us first, and to the Office of the Privacy Commissioner of Canada if we do not resolve it

We respond within 30 days. There is no charge unless a request is unusually repetitive or costly, in which case we will tell you the cost before proceeding. We may need to verify your identity first.

Requests about information a contractor holds go to that contractor, see section 2.

10. Children

Ridgepole is business software and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe we have, contact us and we will delete it.

11. Changes

We will post any change here and update the effective date. If a change materially affects how we handle personal information, we will notify account holders by email at least 30 days before it takes effect.

12. Contact us

Our Privacy Officer answers privacy questions, access requests and complaints:

Privacy Officer, Ridgepole Software Inc.
Canada
privacy@ridgepole.ca
(431) 276-0325

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.