Privacy Policy

Privacy contact: privacy@siteaxis.app. Responsible legal entity: SiteAxis, Ontario, Canada (mailing address available on request from legal@siteaxis.app). Effective date: November 8, 2026. Last reviewed: November 8, 2026. Applicable geographic supplement: Canada (PIPEDA and, for Québec residents, Québec's private-sector privacy law).

This Privacy Policy describes how SiteAxis handles personal information in connection with the public website, sales, controlled trials, account creation, application use, support, billing and security. It also explains how the SiteAxis B2B service processes customer-controlled construction project information.

1. Our distinct privacy roles

For marketing enquiries, website visits, sales contacts, account-security and business administration, SiteAxis generally determines the purposes and means of its own processing, subject to applicable law. For information contained in customer-directed project records, forms, photos, schedules, Safety and Incident records and shared documents, SiteAxis generally processes data on behalf of the organization or organizations with legal authority over those records. The applicable controller/business and processor/service-provider relationships depend on the actual processing activities and applicable law and are documented in the service contract and Project Collaboration Schedule; an organization can be a controller for one activity and a processor or joint participant for another.

A subcontractor or project participant who uses SiteAxis is not necessarily a SiteAxis third-party subprocessor. A true SiteAxis subprocessor is an external provider hired by SiteAxis to process covered personal information for its services.

2. Individuals covered

Visitors, prospects, representatives of existing or prospective customers, employee/contractor/subcontractor users, project owners and client representatives, inspectors, incident subjects and witnesses named in project records, suppliers, billing contacts and people communicating with our support/sales teams. This policy is not a substitute for the employing company's notice to its staff or a project's required privacy notices.

3. Data categories

We may receive or generate: (a) business identity, company, roles, work email, phone and invited account membership; (b) authentication, verification, MFA, session and security logs; (c) projects, participating organizations, location/sublocation assignments, contact records and role settings; (d) contractor/subcontractor hierarchy and authorized Site Contacts; (e) uploaded documents, schedules, permits, observations, inspections, incidents, daily reports, corrective actions, risk/quality/commercial records, photos, attachments, comments, signatures if used, workflow history and audit trails; (f) work-related injury or medical-attention descriptors, body-part fields and witness statements when a customer chooses to enter those details in an incident workflow; (g) user-requested approximate or device location used for site/weather functions where enabled; (h) customer-service communications, service notifications and safe support diagnostics; (i) customer invoice, account and subscription metadata with payment methods generally handled by designated billing providers; and (j) browser session, consent preferences, necessary cookies and optional analytics events only to the extent actually enabled.

Government-issued IDs, unrelated medical charts, background checks and biometric identification are outside the ordinary intended scope of the service unless separately agreed and supported by appropriate safeguards. Users must avoid unrelated sensitive disclosures.

4. Sources and purposes

We obtain data directly from account users and public forms; from authorized customer/company/project administrators; from other authorized project collaborators; automatically from essential technical service operation; and where configured from identity, payment or customer-directed integration providers. Purposes include account/provisioning, project collaboration, role enforcement, record storage, import/export subject to authorization, safety and quality workflows, notification delivery, payments, support, abuse prevention, audits and compliance, service reliability and lawful business communication. Optional AI features process submitted materials only when a company enables them (see Section 7). Optional marketing/analytics processing requires separately applicable controls and a lawful basis.

5. Legal bases / consent

Where legal-basis terminology applies, processing may rely on performance of contracts, compliance with law, consent and appropriately assessed legitimate interests, depending on role and jurisdiction. Canadian consent, Québec requirements, EU/UK legal bases and U.S. rights must be assessed rather than assumed identical. We do not treat required service-notification consent as consent to commercial marketing. Consent can be withdrawn where withdrawal rights apply, though that may limit optional functionality or communication.

6. Project content and independent participant visibility

Customer-selected administrators and users may access information according to validated company/project/role/module permissions. An invited general contractor, owner representative or subcontractor may have authorized access to shared project evidence. The platform's default role checks do not establish which construction participant owns or controls particular underlying records. Customer contracts, record origins, legal obligations, participation agreements and configured permissions inform decisions about sharing, retention, requests and disputes. SiteAxis does not sell personal information, including project records, or disclose project records for another customer's unrelated project use.

7. Service providers, AI and sign-in

We share information only with the providers we use to run SiteAxis, under written agreements that limit their use of it to providing their service:

The current list is also published as the subprocessor list. We may also disclose information when required by law or valid legal process, to prevent fraud or protect safety and security, to professional advisers under confidentiality, or to a successor in a merger or acquisition under equivalent protections.

AI features

SiteAxis offers optional AI features: summaries of records, insights on module dashboards, and analysis of site photos (for example, hazard suggestions).

• Provider and region. AI requests are processed by Alibaba Cloud Model Studio in its United States (Virginia) region.
• What is sent. Only the content needed for the feature you use: the text of the record or dashboard figures being summarized, safety form answers, and the photo being analyzed. Names that appear in that content can be included. Passwords, payment details and data from other companies or projects are never sent.
• No training. Under the provider's terms, data sent through the API is not used to train its models. SiteAxis does not use your data to train any AI model.
• Retention. AI results are stored in SiteAxis with the record they relate to, so the same analysis is not re-run. The provider does not keep the content after processing beyond short-term operational logs under its terms.
• Your choice. AI is off for a company until its administrator enables it, and the administrator can turn it off at any time in Settings, for the whole company or for individual modules. Individual users can also turn off AI suggestions in their own preferences. With AI off, SiteAxis shows non-AI summaries and nothing is sent to the AI provider.
• Human review. AI output is a suggestion; it must be reviewed by a qualified person before anyone relies on it.

Signing in with Google or Microsoft

If you choose to sign in with Google or Microsoft, that provider confirms your identity and sends SiteAxis your name, email address and a signed identity token. SiteAxis never receives your Google or Microsoft password. We use this only to sign you in and link the login to your existing SiteAxis account; signing in this way does not create a new company or give access to anything you were not already invited to. The provider's own privacy policy applies to your account with them. You can stop using it at any time by signing in with your email and password, and you can remove SiteAxis's access in your Google or Microsoft account settings.

8. Security and incident response

SiteAxis protects information with administrative, technical and organizational safeguards appropriate to its sensitivity, including encryption in transit and at rest, company and project access controls enforced in the database, role-based permissions, optional and enforceable multi-factor authentication, and audit logs of sensitive actions. No system is perfectly secure; SiteAxis does not currently hold a third-party certification such as SOC 2 or ISO 27001. If a breach of security safeguards creates a real risk of significant harm, we will notify affected customers and individuals and report to the Office of the Privacy Commissioner of Canada as required by law; customers under a DPA are notified within 72 hours of SiteAxis becoming aware of a breach affecting their data.

9. Where information is stored

Project records, files and account data are stored in Canada (Montréal). Some providers listed in Section 7 process information in the United States, so it may be accessed by courts, law enforcement and national security authorities there under U.S. law. We use contractual and technical safeguards with these providers. Where required for Québec residents, we assess transfers outside Québec before they happen.

10. Retention, cancellation and deletion

We keep personal information only as long as needed for the purposes in this Policy or as required by law:

• Active accounts: for the life of the subscription, unless an authorized user deletes it.
• After a trial ends without purchase: read-only for 90 days, then deleted.
• After cancellation or termination: read-only for 30 days for export, then deleted from active systems within 90 days and from backups within a further 30 days.
• Removed users: access ends; records they created stay with the project, because other participants rely on them.
• Invoices and billing records: 7 years, as Canadian tax law requires.
• Security and audit logs: up to 1 year.

Cancelling a subscription does not on its own delete project data; an authorized administrator can request deletion at privacy@siteaxis.app. Records shared with other organizations on a project, or under a legal hold, may need to be kept for them. Details are in Retention and exit.

11. Privacy rights

Depending on jurisdiction and role, individuals may request access, correction, deletion, information about processing, withdrawal of consent, objection/restriction, portability or information about automated decisions. Submit requests to privacy@siteaxis.app with your name, account email and what you are asking for. We respond within 30 days. We may verify identity and direct project-content requests to the appropriate customer organization. Any limitation or refusal of a request must be permitted by applicable law. Contractual preferences alone do not override statutory privacy rights. Where permitted or required, we will explain the grounds for a limitation and available complaint or appeal channels. Regulators and appeal channels are identified in Section 15 of this Policy.

12. Cookies, preferences and analytics

Necessary authentication and security technologies support service operation. Optional analytics, marketing and non-essential preferences are off by default and are subject to applicable user choices. The Cookie Policy describes these categories and how to change a choice. The Cookie Policy lists the cookies we use.

13. Marketing and service communications

Product-security, access verification, contractual, support and workflow messages may be required to operate the service. Optional promotional communications should use separate consent/rights and a functioning unsubscribe method where applicable. Identification and electronic-message requirements, including CASL where applicable, are reviewed before campaigns begin.

14. Children and high-risk use

SiteAxis is intended for professional/organizational project operations, not use by children as consumer subscribers. Worksite records may incidentally identify minors, injured workers or other persons; upload and share only when lawful, necessary and suitably protected. Clinical patient records, special regulated identifiers and unrelated high-risk datasets are outside ordinary scope without written agreement and verified controls.

15. Policy changes and contact

We will review and update this Policy when material processing practices, activated vendors or applicable laws change; where required we will give notice or seek renewed consent. Historical versions and acceptance records will be preserved according to approved policy. Questions or requests: privacy@siteaxis.app, postal address Ontario, Canada (mailing address available on request from legal@siteaxis.app), privacy officer the SiteAxis Privacy Officer (privacy@siteaxis.app). Where applicable, local representative not applicable (SiteAxis does not currently appoint EU or UK representatives) and supervisory authority the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for Québec residents, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).