Privacy Policy

Last updated: October 18, 2026.

This policy explains what personal information TeamProof collects, why, who can see it, and the choices you have. We've tried to write it in plain English.

1. Who we are

TeamProof is a proof-of-visit and subcontracting app for companies that send workers or subcontractors to sites: janitorial contracts, security patrols, snow removal and home care. It runs at app.getteamproof.com, and our website is getteamproof.com.

TeamProof is operated by Pk Technologies Inc., a British Columbia company, 333 Seymour St, Vancouver, BC V6B 5A6, Canada.

Privacy Officer: Parth Katyal. Email: privacy@getteamproof.com.

We follow British Columbia's Personal Information Protection Act (PIPA) and, where it applies, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). We are a BC business and our service is aimed at Canadian businesses. We don't specifically target customers in Quebec or outside Canada.

2. Our role: the company is in charge of its workers' data

There are two kinds of information in TeamProof:

• Account information about our customers (the company that signs up, its owner and office users). For this information, we decide how it is used, and this policy applies directly.
• Information a company puts into TeamProof about its own work: its workers, subcontractors, clients, properties, visits, photos and pay. For this information, the company (our customer) is in charge. We process it only on the company's behalf and follow the company's instructions, to run the service for them. The company is responsible for collecting it lawfully, for having a reasonable purpose, for telling its workers and clients about it and getting any consent the law requires (see section 6), and for answering their requests about it.

If you are a worker or a client of a company that uses TeamProof, please send privacy questions about that company's records to the company first. We will help them answer you, and you can also contact us directly.

3. What we collect

From companies (owners and office users)

• Company name, the name used on client reports, and an optional logo.
• Owner and office user names and mobile phone numbers.
• A PIN for logging in. We store only a scrambled (hashed) version of your PIN, never the PIN itself.
• Email addresses for alerts (for example, missed-visit emails).
• Settings such as language and alert preferences.
• Billing information, once paid plans start. Online card payments aren't switched on yet. When they are, card details will be handled by our payment provider and never stored by us.

About workers (employees and a subcontractor's own workers)

• Name, mobile phone number, preferred language, and a hashed PIN they choose themselves on first login.
• Which company or companies they work with, and their role.
• Pay rate and pay type (per visit, per hour or per month), if the company enters it, and pay statements calculated from visits.
• Visit records: which sites they were scheduled at, check-in and check-out times, and any reason they give for arriving early or late.
• Location (GPS) at specific moments only — see section 4.
• Photos taken in the app (before, after and issue photos), with the time taken and the phone's location at that moment.
• Checklist ticks and notes they add to a visit.
• The date they accepted the in-app privacy notice.

About clients and properties (entered by the company)

• Client names, phone numbers, email addresses, billing notes and other notes.
• Property names, addresses, map pins, phone numbers and access notes (for example, door codes or key instructions).
• Contact people for a property and whether they get visit reports.
• Contract and price information (what the company charges the client, or what a contractor pays a subcontractor).

Please don't put health information in TeamProof. Notes are for the work. Don't store medical or health records in notes, photos or any other field (for example, a home-care client's diagnosis or medications). TeamProof isn't built to hold health records.

When you visit our website or use the demo form

• If you fill in the "Book a demo" form: your name, company, phone, email, team size and message. It is sent by email (through Resend) to TeamProof's own Gmail inbox (hosted by Google), so we can reply.
• If you email us at support@ or privacy@getteamproof.com, the message is forwarded by ImprovMX to the same TeamProof Gmail inbox.
• Our website loads fonts from Google Fonts, which means your browser connects to Google and shares your IP address with them.
• We do not use analytics, advertising or tracking cookies or pixels on the website or the app. If we add analytics later, we'll update this policy first.

Technical information

• Server logs kept by our hosting provider (for example, IP address, browser type, the page requested and errors). These are used to keep the service running and secure.
• A record of wrong PIN attempts per phone number and per network, used to lock accounts against guessing.
• A record of text-code requests and checks per phone number and per network (not the codes themselves), used to stop abuse of text codes.
• A log of emails the app sent (recipient, subject and content), so we can confirm delivery.
• A log of admin actions taken by our own staff.

4. Location: only at check-in, check-out and photos

TeamProof does not track anyone continuously. The app asks the phone for its location only at these moments:

1. When a worker taps Check in.
2. When a worker taps Check out.
3. When a worker takes a photo in the app, so the photo can be tied to the site.

The app does not follow workers during a shift, between jobs, or after they leave. It does not run in the background. We save the position, its accuracy, and whether it was inside the site's boundary ("geofence"). If a worker refuses location access, they can still check in, and the visit is marked "No location".

Photos are saved with the time they were taken and the phone's location at that moment. This is a single reading per photo, not tracking.

5. Why we use it

We use personal information only to:

• Run the service: log people in, show schedules, record visits, store proof and send reports and alerts.
• Show proof to the right people: the company, its subcontractors (for jobs passed to them) and its clients (for their own properties).
• Calculate pay totals from visits for the company.
• Keep accounts secure: hash PINs, lock accounts after repeated wrong PINs, send one-time text codes, prevent one company from taking another company's clients, and investigate misuse.
• Answer support requests and demo requests.
• Bill for the service (once paid plans start).
• Comply with the law.

Our promise: We and our affiliates, including any service company we own, will never use your data to contact your clients, bid on your work or compete with you.

We do not sell personal information. We do not use workers' or clients' data for advertising. We do not use your data to train AI models.

6. Consent and notice

• Owners and office users consent by creating an account and agreeing to our Terms and this policy.
• Workers see a short privacy notice the first time they log in, explaining when location is saved, that they are not followed during the shift, and that photos should show the work, not people. They must accept it before using the worker app.
• The company is responsible for telling its workers, before they start using TeamProof, what is collected and why (location at check-in/out and photos, visit times, and pay), and for getting any consent that BC PIPA, PIPEDA or employment law requires. Under BC PIPA, an employer may collect employee information that is reasonable to manage the work relationship, but it must notify employees first. We provide the in-app notice to help, but it does not replace the company's own notice.
• Clients and property contacts: the company is responsible for having permission to add their details and to send them visit reports.

7. Who can see what

TeamProof is built so each person sees only what they need:

Client report links are private links that don't need a login. Anyone who has the link can open it, so treat it like a password.

• Links to a single visit report stop working after 90 days. The company can turn one off at any time from the visit page.
• Links to a client's or property's recent visits (sent in visit emails) don't expire yet and can't yet be turned off from the app. If one has been shared with the wrong person, the company can email support@getteamproof.com and we'll turn it off.

8. Service providers (subprocessors)

We use trusted companies to run TeamProof. They process data only to provide their service to us:

Data outside Canada. Our app, database and photo storage are hosted in the United States, and some other providers also process data there. While it's there, it may be accessible to courts, law enforcement and national security authorities of that country. BC PIPA and PIPEDA allow this, but we have to tell you, and we do. We choose providers with strong security and contracts that protect your data.

We don't use any analytics, advertising or error-tracking services. We will update this list when we add or change providers.

Legal requests. We may keep or disclose information if a court order, warrant or the law requires it, including in Canada. Where the law allows, we'll tell the affected company first.

If TeamProof is sold. If our business or TeamProof is sold, merged or reorganized, the information moves to the new owner, who must keep protecting it under this same policy. We'll tell company owners before that happens.

9. Text messages and emails

• Text codes (SMS). We send a one-time code by text when a company signs up, when someone logs in for the first time to choose their own PIN, when someone uses "Forgot PIN", and when someone changes their phone number. Codes are sent by Twilio Verify. Codes come in English or Hindi only: Hindi users get them in Hindi, and everyone else, including Punjabi users, gets them in English. Normal daily logins use phone and PIN only and don't send a text. Standard message rates from your carrier may apply.
• Service emails. We send visit reports to client contacts the company has chosen, and missed-visit alerts to the company's office emails. These are service messages, not marketing.
• Marketing. We will only send marketing emails or texts with your consent, as Canada's Anti-Spam Legislation (CASL) requires, and every marketing message will include a way to unsubscribe.

10. Cookies

The app uses only the cookies it needs to work:

• Login session — keeps you signed in for up to 30 days on that device.
• Selected company — remembers which company you are working in, if you belong to more than one.
• Invite — remembers an invite link for up to 14 days while you finish signing up.
• Language — remembers your language for up to a year.
• Short-lived step cookies — remember a step in progress, such as a text code that was sent or checked while you finish signing up, setting your PIN or changing your phone. They expire within 30 minutes.

The worker app also remembers on the phone whether location access was allowed, so it doesn't keep asking. We don't use advertising cookies or sell cookie data.

11. How long we keep it

These are our standard periods. A company can ask us to use a shorter period for its data.

• Photos and locations (check-in, check-out and photo): 2 years from the visit, then deleted.
• Visit records, schedules and pay statements: kept while the company's account is active, so the company has its business and payroll records. The company keeps its own legal duty to hold payroll and employment records (for example, under BC employment standards). Download or export what you need to keep, because TeamProof isn't a records-retention service.
• Removed workers: when a company removes a worker, they can no longer log in. One year after removal, we delete or anonymize that worker's name, phone number and pay rate in that company's records, unless they still work with another company in TeamProof.
• Free trials that never became paid accounts: deleted 90 days after the trial ends.
• Closed accounts: when a company closes its account, we delete or anonymize its data within 90 days, except what we must keep by law (for example, billing records).
• Server logs (kept by our hosting provider, Vercel): deleted automatically after a short time, currently 1 hour and never more than 30 days.
• Wrong-PIN and text-code attempt records: 90 days.
• Log of emails the app sent (this includes the full email, such as a visit report): 90 days.
• Log of our own staff's admin actions: 2 years.
• Demo requests: 12 months, unless you become a customer.
• Links: single-visit report links expire after 90 days (see section 7). Sign-in links in emails expire within 24 hours; PIN-setup links expire after 14 days.
• Backups: our providers overwrite backups on their normal schedule, within 30 days.

12. How we protect it

• PINs are stored hashed, never in plain text.
• Accounts lock after repeated wrong PINs, and the number of attempts from one network is limited.
• One-time text codes confirm phone numbers at sign-up, first login, "Forgot PIN" and phone changes, with limits on how many codes one phone or network can request.
• Everyone chooses their own PIN on first login, easy PINs are refused, and changing a PIN signs out other devices.
• Photos and logos are kept in private storage and are only shown to signed-in users or through private report links.
• All connections use HTTPS encryption.
• Each company's data is separated, and the app checks permissions on every request.
• Only a small number of our own staff can access production data, and admin actions are logged.
• Staff of any affiliated service business (for example, a cleaning company we own) have no access to TeamProof production data.

No system is perfectly secure, but we work to protect your information and fix problems quickly.

13. If there's a data breach

If a breach of security creates a real risk of significant harm to anyone, we will:

• Notify the affected company (our customer) without unreasonable delay, so it can meet its own duties to its workers and clients.
• Notify affected individuals and the Office of the Privacy Commissioner of Canada, and the Office of the Information and Privacy Commissioner for BC where required.
• Keep a record of every breach, as PIPEDA requires.

14. Your rights

You can ask us to:

• See the personal information we hold about you.
• Correct anything that is wrong.
• Export a copy of your company's data (owners).
• Delete your account or your company's data.
• Withdraw consent, subject to legal or contract limits. If a worker withdraws consent for location or photos, they may not be able to use the check-in features their employer requires.

Email privacy@getteamproof.com. We will reply within 30 days. There's no self-serve export or delete button yet, so we handle these requests by email. We may need to confirm your identity first. If the information is controlled by your employer or the company that hired you, we'll pass your request to them and help them answer it.

If you're not happy with our answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

15. Children

TeamProof is for businesses and their workers. Workers using the app under their employer's account must be at least 16. Anyone who creates a company account or accepts our Terms for a company must be at least 19. TeamProof is not meant for children, and we don't knowingly collect information about anyone under 16. Companies must not add anyone under 16 as a user.

16. Changes to this policy

We may update this policy. If we make an important change, we'll show a notice in the app or email company owners before it takes effect. The date at the top shows when it was last updated.

17. Contact us

Pk Technologies Inc. — TeamProof
Attn: Privacy Officer, Parth Katyal
333 Seymour St, Vancouver, BC V6B 5A6, Canada
Email: privacy@getteamproof.com