Privacy Notice

Who is accountable

Check My Contractor is operated by Ryan Johnson (sole proprietorship, British Columbia, Canada). Privacy questions, access and correction requests, deletion requests, and incident reports go to the contact address shown on the website; the accountable person is the owner.

What we collect and why

To deliver a check we collect only what it needs: your name and contact details, the project address, city and province, your contractor's business details as you supplied them, for a Full Check the quote and insurance documents you upload, your stated concerns, and payment confirmation from our payment provider (never your card number).

Free tools on the site (the deposit checker and quote-completeness scan) run in your browser; the numbers and selections you enter there are not transmitted to us or stored.

We do not collect government ID, banking details, credit reports, or alarm/access information, and we prompt you to redact them if they appear in a document.

Where your data lives

Case records are stored in a Canadian-region managed database (Montréal). Uploaded documents are stored in a private Canadian-region object store (Central Canada) and are malware-scanned before anyone opens them. Some service providers named below process data outside Canada, mainly in the United States: our payment provider, our email provider, our website host, the services that research the contractor (which receive only the contractor's details), and, only if you say OK on the ad-measurement bar, Meta and Reddit (see Ad measurement). We will update this notice before adding any other provider that moves personal data outside Canada, and obtain consent where required.

AI processing

Research assistants (AI software, currently Grok from xAI, a US company) search public records about your contractor. They receive only the contractor's business name and any phone number, website or address you gave for the contractor, plus the project's city and province. They never receive your name, email, phone, address or documents. xAI may keep what it receives under its own terms.

AI never decides whether a contractor is trustworthy. A Quick Check is assembled and released automatically, under fixed rules that report only what each source shows. A person reviews every Full Check before it is released.

Retention and deletion

Default retention: uploaded original documents are deleted 30 days after your report is delivered; reports are deleted 90 days after delivery. Financial transaction records are kept separately only as long as tax and accounting law requires.

You may request earlier deletion, or an export of your data, at any time. We honour deletion requests unless a documented legal hold applies (for example an open payment dispute), and we tell you exactly which categories were deleted and, narrowly, anything lawfully retained.

Who sees your data

The person reviewing your case, under least-privilege access with mandatory two-factor authentication and audit logging. We never sell data, never publish reports or contractor information, and never contact your contractor, insurer, or references without your specific consent.

Service providers that process data on our behalf, each only for our documented purposes: Supabase (database and sign-in, Canada) holds your account, case records and reports; Amazon Web Services (document storage with malware scanning, Canada) holds the documents you upload; Vercel hosts the website and counts visits to our public pages (Vercel Web Analytics, which uses no cookies and does not store your IP address; it never receives order, payment, account or report pages); Stripe processes payments and your billing address; Resend delivers our emails to your address; GitHub passes the contractor's details to the research assistants; xAI runs the research assistants (Grok) and receives the contractor's details only.

Meta Platforms and Reddit receive page visits from the marketing pages only, and only after you say OK (see Ad measurement).

Ad measurement

On our marketing pages (the home page, guides, province and city pages, and sample reports) we can use two advertising pixels, from Meta Platforms (Facebook and Instagram) and from Reddit, to learn which of our posts and ads bring visitors. They load only after you click OK on the ad-measurement bar. If you click "No thanks", or do nothing, they never load. They are never used on the order, payment, account or report pages.

When you say OK, Meta and Reddit receive the address of the page you viewed, your browser and device details, your IP address and their own cookies, and may connect the visit to an account you hold with them, under their own privacy policies. Both process this data in the United States. We do not send them your name, email address, documents, your contractor's details, or anything about an order, and we do not report purchases to them.

To change your answer, clear this site's data in your browser; the bar then shows again.

Incidents and complaints

If a privacy incident affects your data we will assess it promptly, notify you where required, and record what happened and what changed. If you are not satisfied with our answer to a privacy request you may complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.