Privacy Policy

IronLoop Technologies Inc. ("IronLoop", "we", "us") provides a cloud application for construction and equipment companies that manages machines, service, inspections, field time, safety, hauling and related records (the "Service"). This policy explains how we handle personal information when you use the Service, visit ironloopcanada.com, or contact us.

We are subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA). Where a provincial law applies to a customer, we follow it.

The Service is sold to businesses. The company that invites you (your employer or contractor principal, the "Customer") decides what information is entered and who in their company can see it. For that information, the Customer is the organisation responsible for the information and IronLoop processes it on their behalf under the Terms of Service.

Account information: name, work email, phone number (optional), password hash, authenticator (two-step) enrolment, recovery-code hashes, language and theme preferences, and the companies and roles you belong to.

Operational records entered by your company or by you: equipment, work orders, inspections, time entries, safety events and incidents, WCB and certification records, hauling tickets, receiving records, notes, photos and voice notes with their transcriptions, and comments.

Device and usage information: IP address, browser type, approximate location derived from IP, pages viewed, actions taken (kept in the audit log), and the time of each sign-in. If your company enables location on inspections or load confirmations, the GPS position captured at that moment is stored with the record.

Telematics and third-party data: when your company connects a telematics or ELD provider (for example Samsara, Geotab or Motive) or an accounting system (for example Sage Intacct, Sage 300 CRE or Trimble Viewpoint Vista), we receive the machine hours, locations, driver hours-of-service and safety events, or the jobs, cost codes and invoices that your company has authorised.

Payment information: if your company pays by card, card details are entered directly with our payment processor (Stripe or Helcim). We store the processor's customer reference, the card brand and last four digits, and invoice history, never the full card number.

Support communications: emails and messages you send us, and screen-share or support-access sessions your company grants us, which are recorded in your company's audit log.

• To provide the Service: authenticate you, show you the records your role allows, send reminders your company has turned on, and generate reports and exports.
• To keep the Service secure: detect unusual sign-ins, enforce two-step verification, rate-limit abuse, and maintain the audit trail your company relies on for COR, WCB and financial audits.
• To transcribe voice notes: audio you record is sent to a speech-to-text provider configured by the platform and the text is stored with the note. Audio files are retained according to your company's settings.
• To bill the Customer and prevent fraud.
• To support you and to improve the Service, using aggregated or de-identified statistics wherever possible.
• To meet legal obligations, including responding to lawful requests from Canadian authorities.

We do not sell personal information and we do not use Customer records to train machine-learning models.

Within a Customer's workspace, information is collected for the purposes a reasonable person would consider appropriate for managing equipment, work, time and safety. Consent is obtained by the Customer from its workers as part of employment or contracting, and by you when you create an account and accept the Terms of Service.

You may withdraw consent at any time by asking your company's administrator to deactivate your account, subject to legal or contractual restrictions and reasonable notice. Some records (for example completed inspections, time entries and safety reports) must be kept by the Customer under occupational health and safety and employment laws even after an account is closed.

We share information only with service providers that help us run the Service, under contracts that restrict them to our instructions, and with the Customer's chosen integrations. Our current sub-processors are:

Where a provider is outside Canada, your information may be subject to that country's laws. We choose providers with recognised security certifications and limit what is sent to the minimum needed for the task.

We may disclose information if required by law, to protect the rights and safety of people, or as part of a merger or sale of IronLoop, in which case this policy continues to apply until a replacement is published.

• Encryption in transit (TLS 1.2+) and at rest; secrets and API keys are stored encrypted and never shown again after entry.
• Row-level security in the database so each company's records are isolated from every other company.
• Two-step verification required for owners, administrators and finance roles; recovery codes stored only as hashes.
• Single sign-on through the Customer's identity provider (SAML 2.0, Microsoft Entra ID) on the Enterprise plan.
• A tamper-evident audit log of changes, exports, support access and sign-in events, available to Customer administrators.
• Nightly encrypted backups retained for 35 days, a monthly restore drill, and company-level export so the Customer can keep its own copy.
• Staff access to Customer data only with the Customer's time-limited permission, recorded in the audit log.

No system is perfectly secure. If we learn of a breach that creates a real risk of significant harm, we will notify affected Customers without unreasonable delay and report to the Office of the Privacy Commissioner of Canada and provincial commissioners as required.

Customer records are kept for as long as the Customer's subscription is active. When a company closes its account we keep its data for 90 days so it can be exported or reactivated, then delete it from live systems; backups roll off within a further 35 days.

Audit logs are kept for the life of the Customer account plus 7 years, which matches common financial and occupational health and safety record requirements in Canada.

Account information for an individual is deleted or de-identified within 30 days after the account is removed from its last company, except where we must keep it to meet a legal obligation or resolve a dispute.

• Access and correction: you can view and update your profile in Account settings. For records your company controls, ask your company administrator; we will help them respond within 30 days.
• Portability: administrators can export their company's data at any time from Settings → Backups.
• Marketing: we send product and account emails only. You can turn reminder emails on or off in your notification settings.
• Complaints: contact us first. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.

We use strictly necessary cookies to keep you signed in and to remember your theme and company choice. We do not use advertising cookies or third-party analytics trackers. Cloudflare Turnstile may set a short-lived cookie on sign-up to tell people from bots.

The Service is for businesses and their workers and is not directed at anyone under 16. We do not knowingly collect information from children.

We will post any changes here and update the version date. If a change materially reduces your rights, we will notify Customer administrators by email and in the app at least 30 days before it takes effect.

IronLoop Technologies Inc., Privacy Officer. Write to us through the support contact shown in the app footer or by mail at the registered office address published on ironloopcanada.com. We respond to privacy requests within 30 days.