Privacy Policy

1. Our role and your employer’s role

Shepherd is used by landscaping and snow-removal businesses (our “Customers”). Our role depends on the information:

• Customer Data. When a Customer enters information about its staff, clients, properties or job applicants, the Customer decides why and how it is used, and we process it on the Customer’s behalf as its service provider. If you work for or applied to a Customer, or are one of its clients, that Customer is your first point of contact, and its own privacy practices apply.
• Our own information. We are responsible for the information we handle for our own purposes, such as Customer account and billing contacts, website visitors, people who contact us, and forum accounts.

2. Information we handle

Account and billing. Names, work email addresses, login details, company details and subscription history. Stripe processes payment details at checkout. We do not store full card numbers.

Customer Data in the app, depending on the features a Customer uses:

• staff names, usernames, roles, profile photos, contact details, schedules and assignments;
• time entries, supervisor confirmations, pay rates, hours worked and gross pay figures;
• GPS location recorded at specific events, such as arriving at and leaving a site during snow operations;
• photos, captions, receipts, notes and proof-of-service records;
• client and property information, invoices and access notes;
• job applications and resumes submitted through a Customer’s careers page;
• messages, announcements and notifications sent in the app.

Forum. Your posts, profile details and any “looking for work” status you choose to show. Other people can see forum content, even if it is posted without your name.

Technical and security data. Log data, IP address, browser and device details, error reports (which are tagged with an organization and user role), audit logs and the times of actions.

Website. Pages viewed, referring site, campaign tags in links, general device and country information, page performance, buttons clicked, and your language choice. If you contact us, we keep your message and contact details.

Voice and chat assistant. If you choose to talk to or message the assistant on our website, your voice, messages and the conversation are processed by ElevenLabs and may be recorded and transcribed. Please do not share sensitive information in that conversation.

3. How we use it

• to provide, operate and maintain the Service, and to do what a Customer instructs;
• to create and secure accounts, process payments and send service and billing messages;
• to provide support and respond to you;
• to detect, investigate and prevent errors, fraud, abuse and security incidents;
• to understand how our website is used and to improve the Service, using aggregated or de-identified information wherever possible;
• to tell business contacts about our products, where the law allows, with a way to unsubscribe from marketing messages;
• to comply with the law, enforce our agreements and protect rights and safety.

We do not sell personal information, and we do not use Customer Data for advertising. Where consent is required, we rely on the consent you give, or on the Customer to obtain it from its staff and others. You may withdraw consent, subject to legal and contractual limits, though we or the Customer may then be unable to provide some features.

4. Who we share it with

We share personal information only as described here:

• Infrastructure and app providers: Supabase (database, login, file storage), Fly.io (hosting), Stripe (payments) and Sentry (error monitoring), plus providers we use to deliver email and supply weather information.
• AI provider: when a Customer’s authorized user uses the AI Query Panel or AI-generated metrics, their question and related information about the database are sent to DeepSeek, an AI provider based outside Canada and the United States, to generate a result.
• Integrations a Customer turns on: for example, QuickBooks Online receives and sends customer, employee, time and invoice data once connected.
• Website providers: Umami (analytics), ElevenLabs (the assistant), unpkg (which delivers the assistant’s code) and DiceBear (sample avatars on our demos). These providers may receive your IP address and browser details when your browser loads their content. Google Maps receives information only if you follow a map link.
• Within a Customer’s organization: a Customer’s administrators and supervisors can see Customer Data according to the roles the Customer sets. Anything shown on a Staff Board display can be seen by anyone near it.
• Our team: our staff access Customer Data only when needed to support or secure the Service or to meet a legal requirement.
• Legal and business reasons: where required by law or legal process, to protect rights and safety, or as part of a merger, financing or sale of our business, subject to appropriate confidentiality protections.

5. Storage outside your province or country

We and our providers may store and process personal information outside your province or country, including in the United States and, for AI features, wherever DeepSeek operates. While it is there, it is subject to local laws and may be accessible to courts, law enforcement and national security authorities in that place. You can contact our Privacy Officer to ask about our practices for service providers outside Canada.

6. How long we keep it

We keep personal information only as long as needed for the purposes above or as the law requires. A Customer controls most of its Customer Data during its subscription and can delete many records itself.

• After a subscription ends: the Customer may request read-only access to export its data for 30 days. We then delete Customer Data, including from backups, within 90 days of the end of the subscription, unless the law requires us to keep it.
• Billing and tax records: as long as tax and accounting laws require, generally at least six years.
• Logs and error reports: for a limited period, for security and troubleshooting.
• Forum posts: until they are removed by you, a moderator or us.

7. Security

We use safeguards suited to the sensitivity of the information. These include separating each organization’s data with row-level security, encrypted connections, encrypted storage of third-party credentials, access controls and audit logs. No system is perfectly secure, so we cannot guarantee absolute security. If a breach creates a real risk of significant harm, we will notify affected Customers, individuals and regulators as the law requires. Please keep your login confidential.

8. Cookies and similar technology

Our marketing website uses Umami for analytics, which does not use cookies. We store your language choice in your browser’s local storage and how you first reached the site in session storage, so we can understand which campaigns lead to sign-ups. The application uses technology such as browser storage to keep you signed in and to let you work offline. We do not use advertising cookies. If you block these technologies, some features may not work properly.

9. Your rights

Subject to legal limits, you may ask for access to your personal information, ask us to correct it, ask how it has been used or disclosed, withdraw consent, and, where your local law provides, ask for it to be deleted or to receive a copy. We may need to confirm your identity and will respond within the time the law requires.

If your request concerns Customer Data, such as your records as an employee or applicant, please contact that Customer first. If you contact us, we will direct you to the Customer or help it respond, as appropriate.

Canada. If you are not satisfied with our response, you may complain to the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada, or your provincial privacy regulator.

United States. Some states give residents additional rights over personal information, such as rights to know, correct and delete it, and to opt out of its sale or use for targeted advertising. We do not sell personal information or share it for targeted advertising. You may use the contact details below to exercise any rights your state provides, and we will not discriminate against you for doing so.

10. Children

The Service is designed for businesses and is not directed at children. We do not knowingly collect personal information directly from children under 13. Customers who employ minors are responsible for meeting the legal requirements that apply to them. If you believe a child has given us personal information, please contact us.

11. Changes to this policy

We may update this policy as the Service or the law changes. We will post the new version here with its effective date and, for material changes, give notice by email or in the Service.

12. Contact our Privacy Officer

Privacy Officer, Shepherd Software, Inc.
hello@sheprd.works