Privacy Policy

1. Our Roles: Controller and Processor

Jobyo plays two different roles depending on the information involved:

• As a controller: When we handle account, billing, and website-visitor information for our own purposes (managing your subscription, operating and marketing the Service), we determine how that information is used, and this Privacy Policy applies.
• As a processor/service provider: When our customers upload their own business records to the Service (for example, their clients, employees, work orders, and invoices), we process that information on behalf of and under the instructions of the customer, who is the controller. Our handling of that information is governed by our Data Processing Agreement. If your information was entered into Jobyo by a business you deal with, please contact that business to exercise your rights.

2. Information We Collect

• Account and contact information: name, email address, phone number, company name, and login credentials.
• Billing information: subscription plan and billing details. Card payments are processed by Stripe; we do not store your full card number.
• Customer Data: the operational records you create in the Service, such as work orders, tasks, projects, quotations, invoices, customer and supplier records, attachments, and uploaded documents.
• Usage and device data: IP address, device and browser information, and activity logs.
• Geolocation: GPS coordinates recorded at each check-in and check-out whenever your device’s location permission allows it. Your employer’s managers can view these locations, and your employer decides how they are used.
• Support communications: messages you send us and information submitted through our contact form.

3. How We Use Information

• To create, secure, and manage your Jobyo account and users.
• To provide, maintain, and improve the features of the Service.
• To process subscription payments and manage billing.
• To provide customer support and respond to your requests.
• To send service-related and, where permitted, marketing communications (which you can opt out of).
• To detect, prevent, and address fraud, abuse, and security issues.
• To comply with legal obligations.

4. AI and Automated Processing

Some features use automated processing to assist you. In particular, our invoice-capture (OCR) feature transmits document images you upload to a third-party artificial-intelligence provider, Anthropic (Claude), to extract structured information from those documents. Anthropic processes this data as our sub-processor under a data-processing agreement, does not use it to train its models, and deletes it in accordance with its retention terms (by default within approximately 30 days). Automated output may contain errors and should be reviewed before you rely on it. Jobyo does not make any decision based exclusively on the automated processing of personal information. If this changes, we will inform you no later than at the time of the decision and, on request, provide the personal information used to make it, the reasons and the principal factors and parameters that led to it, and your right to have that information corrected; you may also submit observations to a member of our staff who is able to review the decision.

Separately, Jobyo offers an optional AI Assistant connector, which is off by default. Unlike the OCR feature above, when a team chooses to connect it, your data is sent to the team’s own Claude account (Anthropic) or ChatGPT account (OpenAI) and is governed by that account’s own plan terms with Anthropic or OpenAI — not by Jobyo’s data-processing agreement. For that reason we recommend connecting only from a Team or Enterprise workspace (Claude or ChatGPT). This can include limited personal information about your team members — the name and role of a person linked to a record. For details on exactly what is and is not shared, and how to control it, see our AI Data Sharing disclosure.

5. How We Share Information

We do not sell your personal information. We share it only as follows:

• Sub-processors and service providers who help us operate the Service (see Section 6).
• Within your organization: Customer Data is accessible to the authorized users of the account it belongs to, according to the roles and permissions you configure.
• Business transfers: if Jobyo is involved in a merger, acquisition, or asset sale, information may be transferred subject to confidentiality and this Policy.
• Legal and safety: where required by law, legal process, or to protect the rights, property, or safety of Jobyo, our users, or others.

6. Sub-Processors and Service Providers

We rely on the following categories of third-party providers, each bound by confidentiality and data-protection obligations:

• Google (Firebase & Google Cloud): authentication, notifications, cloud hosting and storage, and address lookup.
• MongoDB, Inc. (MongoDB Atlas): managed hosting of the databases that store your Customer Data.
• Amazon Web Services (SES / S3): receipt and temporary storage of emails sent to your invoice-intake address, when you enable that feature.
• Anthropic: AI features — OCR document extraction and, where used, the in-app AI assistant, as described in Section 4.
• Stripe: subscription billing and, where you enable payment collection, processing of payments from your customers.
• Microsoft and Google (email): optional invoice-inbox import, when you connect an email account.
• Transactional email provider (Resend): sending account and notification emails.
• Contact-form provider (Web3Forms): delivering messages you submit through our website contact form.

We will keep this list current and provide notice of material changes as described in our Data Processing Agreement.

7. Where Your Information Is Processed

Jobyo is operated from Canada. Our infrastructure runs on Google Cloud and MongoDB Atlas, and your information (including Customer Data) is processed and stored on Google Cloud and MongoDB Atlas servers primarily located in the United States, and may be processed by our sub-processors in other countries. Your personal information may therefore be communicated and hosted outside Québec and Canada, including in the United States. Before communicating personal information outside Québec, we consider the applicable privacy factors and enter into written agreements providing appropriate safeguards (including Standard Contractual Clauses where applicable). By using the Service, you understand that your information may be processed outside Québec and Canada.

8. Data Security

We use reasonable technical and organizational measures designed to protect personal information, including encryption in transit (TLS), encryption at rest, access controls, and multi-tenant data isolation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a confidentiality incident, we take reasonable steps to mitigate its effects and prevent recurrence, and we record the incident in a register. Where the incident presents a risk of serious injury, we promptly notify the Commission d’accès à l’information du Québec and affected individuals, as required by law.

9. Data Retention

We retain personal information for as long as needed to provide the Service and for legitimate business and legal purposes. When those purposes are fulfilled, or following account closure or a valid deletion request, we destroy or anonymize personal information (typically within 30 days; anonymization being carried out in accordance with applicable standards), unless we are legally required to retain it.

10. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to withdraw consent, and to object to or restrict certain processing.

• Canada (PIPEDA and Québec Law 25): you may access and correct your personal information, request information about how it is handled, withdraw consent (subject to legal or contractual limits), and, where applicable, request de-indexing or portability.
• EU / UK (GDPR): where we act as controller, we process personal data on the bases of contract, consent, legitimate interests, or legal obligation, and you have rights of access, rectification, erasure, restriction, portability, and objection.

To exercise these rights, contact us at info@jobyo.io. We respond to access, rectification, and portability requests within 30 days of receipt. The right to portability allows you to obtain, in a structured and commonly used technological format, the computerized personal information you have provided to us, subject to the exceptions provided by law. If your personal information was entered into Jobyo by a business that uses our Service, please direct your request to that business, and we will assist them as their service provider.

11. Cookies and Tracking

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and understand usage. Cookies strictly necessary to operate the site (such as maintaining your session) do not require your consent; you can control other cookies through your browser settings. Separately, the Service records your location when you check in or check out whenever your device’s location permission allows it. Today the only way to stop this is to deny location permission in your device or browser settings. Your employer, as the organization responsible for your personal information, decides how this information is used and is responsible for informing you of it. For details, see our Cookie Policy.

12. Children’s Privacy

Jobyo is a business tool that is not directed to children and is not intended for use by minors. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised “Last Updated” date, and material changes will be communicated by email or in-app notice.

14. Contact and Complaints

For privacy questions or requests, or to exercise your rights, contact Jobyo’s Privacy Officer (responsable de la protection des renseignements personnels):
Privacy Officer
Email: info@jobyo.io
NidSons Inc. (doing business as Jobyo), Montréal, Québec, Canada

If you are in Canada and are not satisfied with our response, you may contact the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada. If you are in the EU/UK, you may contact your local supervisory authority.