Privacy Policy

Effective September 23, 2026 · Version 2026-09-23

This Privacy Policy explains how CoManager collects, uses, shares and protects personal information when you use the CoManager website at comanager.ca, the web app at app.comanager.ca, and the CoManager mobile apps (together, the "Service").

CoManager is operated by Matthew Khoury, a sole proprietor carrying on business as CoManager in Ottawa, Ontario, Canada ("CoManager", "we", "us"). We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable Canadian privacy laws.

1. Who this policy applies to

CoManager is business software. Companies ("Organizations") subscribe to it and invite their owners, managers, workers, subcontractors and clients ("Users") to use it. This policy covers:

• Account holders who sign up for or are invited to the Service;
• Visitors to comanager.ca, including people who submit the early access form; and
• Other individuals whose information an Organization enters into the Service (for example, customer contacts, vendors or job-site details).

For information an Organization enters about its own staff, clients and projects ("Customer Data"), the Organization decides what is collected and why, and CoManager processes it on the Organization's behalf and according to its instructions. If you are a worker or client of an Organization and have questions about that information, please contact the Organization first. We will help them respond.

2. Information we collect

Information you give us

• Account information: name, email address, password (stored only as a secure hash by our authentication provider), company code, and role.
• Profile and organization information: company name, team members, roles, weekly hour targets, hourly rates and payroll settings that an owner or manager enters.
• Project content: projects, tasks, schedules, daily logs, photos, files, voice notes, chat and direct messages, RFIs, submittals, estimates, proposals, invoices, purchase orders, change orders, budgets, expenses, contacts and other records you create or upload.
• Early access and support requests: name, email, phone number, company, role, crew size, how you heard about us, referral details and any message you send us.

Information collected when you use the Service

• Location: if you allow it, your device's location is used to show nearby job sites and to clock you in and out. Background location is used only if you turn on Background Auto Clock-In in your profile, to detect arrival at and departure from job sites you are assigned to, even when the app is closed. It is off by default and you can turn it off at any time in the app or in your device settings.
• Time and attendance records: clock-in and clock-out times and the job site they relate to.
• Device and usage information: device type, operating system, app version, push notification token, IP address, log and error data, and security events such as failed sign-in attempts.
• Calendar access: if you allow it, the app adds project events to your device calendar. We do not read your other calendar entries.
• Camera and microphone: used only when you choose to take a photo, scan a receipt or record a voice note.

Information from third parties

• QuickBooks: if an Organization connects its QuickBooks account, we exchange customer, invoice and expense information with Intuit as directed by the Organization.

3. How we use information

• to provide, operate and maintain the Service and the features you choose to use;
• to create and secure accounts, including detecting and preventing fraud, abuse and unauthorized access;
• to send service messages, such as invitations, security alerts, and notifications about work assigned to you (you can choose which notification emails you receive in your profile settings);
• to provide AI-assisted features you request, such as transcribing voice notes, turning site notes into tasks, and answering questions about a project;
• to respond to early access requests, support questions and other messages;
• to maintain records needed for billing, tax and legal compliance; and
• to understand and improve how the Service performs.

We do not sell personal information, we do not use Customer Data for advertising, and we do not allow our AI service provider to use Customer Data to train its models.

4. Consent

We collect, use and disclose personal information with your consent, or as otherwise permitted or required by law. By creating an account you consent to the practices in this policy. Some features (location, background location, camera, microphone, calendar, push notifications) ask for your separate permission through your device. You may withdraw consent at any time, subject to legal or contractual restrictions, but some features may no longer work. An Organization that invites Users is responsible for having the authority and any consent needed to add their information to the Service, including informing workers about time and location tracking where required by employment law.

5. How information is shared

We share personal information only as described here:

• Within your Organization: information you add to a project is visible to the members of your Organization who have access to that project, according to the roles and access settings your Organization chooses. Clients invited to a project see only the client portal content the Organization makes available to them.
• Service providers who host and operate the Service for us under contracts that require them to protect the information and use it only to provide their services:
  • Google Cloud / Firebase (authentication, database, file storage, hosting, cloud functions), United States;
  • Cloudflare (website hosting, DNS, email forwarding, security), global network;
  • Resend (transactional email delivery), United States;
  • OpenAI (AI transcription and text features, only when you use them), United States;
  • Expo and Apple / Google (push notification delivery);
  • Intuit QuickBooks (only if your Organization connects it).
• Legal and safety reasons: when required by law, court order or other legal process, or to protect the rights, property or safety of CoManager, our users or the public.
• Business transfers: if CoManager is sold, merged or reorganized, information may be transferred to the successor, which must continue to protect it consistent with this policy.

6. Storage outside Canada

Our service providers store and process information in the United States and other countries. While there, it is subject to the laws of those countries, and may be accessible to their courts, law enforcement and national security authorities. We use contracts and technical safeguards to protect information wherever it is processed.

7. How we protect information

We use safeguards appropriate to the sensitivity of the information, including encryption in transit (HTTPS) and at rest, access controls that restrict each User to their own Organization's data, server-side enforcement of permissions, rate limiting, sign-in attempt protection, password strength requirements, security alerts to Organization owners, and restricted administrative access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for telling us promptly about any unauthorized use of your account.

If a breach of security safeguards involving personal information creates a real risk of significant harm, we will notify affected individuals, the Organization and the Office of the Privacy Commissioner of Canada as required by law.

8. How long we keep information

We keep personal information only as long as needed for the purposes described above. Customer Data is kept while the Organization's account is active and deleted or anonymized within 90 days after the Organization closes its account or asks us to delete it, except where we must keep it longer for legal, tax or dispute-resolution reasons. Backups are overwritten on a rolling basis. Early access requests are kept for up to 24 months unless you ask us to delete them sooner.

9. Your rights

Deleting your account: you can delete your account yourself in the app under Profile > Delete Account. Your account is suspended immediately and we email you a link to reactivate it within 30 days. After 30 days, your login and profile are permanently deleted and you are removed from every organization. Records you added to an Organization's projects remain with that Organization as its business records. See Support for details.

You may ask to access the personal information we hold about you, to correct it, or to withdraw your consent. You can update most profile information and notification settings directly in the app. To make a request, email [email protected]. We will respond within 30 days, and may need to verify your identity first. If your request concerns Customer Data controlled by your Organization, we may refer it to the Organization. Residents of Quebec and other jurisdictions may have additional rights under local law, and we will honour them as required.

10. Children

The Service is intended for businesses and is not directed to children. You must be at least 16 years old (or the age of majority where required by your employer or local law) to use it. We do not knowingly collect personal information from children.

11. Commercial emails

We send service and account messages as needed to operate the Service. We will only send marketing emails in accordance with Canada's Anti-Spam Legislation (CASL), and every marketing email will include a way to unsubscribe.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify account holders by email or in the app before the changes take effect, and may ask you to review and accept the updated policy. The version and effective date at the top show when it was last changed.

13. Contact us

Our Privacy Officer is responsible for our compliance with this policy:

Privacy Officer, CoManager
Matthew Khoury, carrying on business as CoManager
Ottawa, Ontario, Canada
[email protected]

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.