Summary
- We collect what we need to run ProjectSystem for you, and nothing for advertising.
- We don't sell personal information, and this website has no analytics or tracking scripts.
- Data is stored with Google Cloud in the United States (us-east1).
- You can ask to see, correct or delete your personal information at any time.
1. Who we are
ProjectSystem is provided by Project Systems, a business based in Alberta, Canada ("we", "us"). This policy covers this website and the ProjectSystem application. We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).
The owner of Project Systems is our privacy officer and is responsible for our compliance with this policy and with these laws. You can reach them at privacy@projectsystem.ca.
2. Your data and your customers' data
Companies that use ProjectSystem (our customers) put information about their own staff and customers into their workspace: names, contact details, addresses, timesheets, pay and billing rates, job notes and photos. For that information, the company decides what is collected and why, and is responsible for having the authority or consent to collect it. We process it on the company's behalf, only to provide the Service.
If you're an employee or customer of a company that uses ProjectSystem and have a question about your information, please contact that company first. We'll help them respond.
3. What we collect
When you sign up or are given an account
Company and workspace name, your name, username, email address, and optionally phone numbers, team, role and pay and billing rates entered by your admin. Your password is stored only as an Argon2id hash; we can't see it.
What you put into the Service
Projects, customers, inventory, timesheets, job logs, documents, photos and notes. Photos are re-encoded when uploaded, which strips location (GPS) and camera metadata.
Billing
When you subscribe, Stripe collects your card details directly. We receive and keep only what we need to manage the subscription: the billing contact, the card brand and its last four digits, and payment and invoice records. We never receive or store full card numbers.
When you contact us
Your name, email address, and whatever else you put in the contact form or email: company, phone number, team size and your message. We also record the IP address the message came from, to prevent abuse.
Technical and security information
When you use the Service, our servers record technical details of each request: the time, the IP address, the browser's user agent, the page or action requested, the result and, when you're signed in, your user and workspace IDs. Sign-ins and changes are written to your workspace's audit log, including the IP address. We count failed sign-in attempts to protect accounts from password guessing. We don't log the content of your requests or your passwords.
4. How we use it
- To provide the Service: running your workspace, showing your data to the users you've given access, sending sign-up, password-reset and other service emails.
- To keep it secure: preventing fraud, abuse and unauthorized access, investigating problems, and keeping an audit trail.
- We only send emails needed to run your account (sign-up, password reset, billing and important notices). We won't send marketing email unless you've asked for it, and every such email will include a way to unsubscribe.
- To bill you and keep the records the law requires.
- To answer your questions and support requests.
- To tell admins about important changes, such as to these policies, prices or the Service.
We don't use your information for advertising, we don't sell or rent it, and we don't build marketing profiles.
5. Consent
By creating an account or sending us a message, you consent to the collection and use described here. You can withdraw your consent at any time by closing your account or asking us to delete your information, subject to legal or contractual requirements; without some of this information (an email address, for example) we can't provide the Service.
6. Who we share it with
We share personal information only with the service providers that help us run ProjectSystem, under contracts that require them to protect it and use it only for the services they provide to us:
| Provider | What they do for us | Where |
|---|---|---|
| Google Cloud | Hosts the application, database, uploaded files and backups, and the mail server that holds messages sent to our contact addresses | us-east1 region, United States |
| Stripe | Processes card payments and subscriptions, and emails receipts | United States and other countries |
| Twilio SendGrid | Delivers our emails (sign-up confirmation, password reset, notices, contact-form messages to us) | United States |
| Cloudflare | Runs the Turnstile CAPTCHA on sign-up, password reset, risky sign-ins and the contact form, which processes your IP address and browser details to tell people from bots | Global network |
Within our own team, access to account and billing data across workspaces is limited to the owner of Project Systems and one additional operator who helps us run the Service. Both sign in with a password and a second factor, and use that access only to run and support the Service.
We'll update this list before we start using a new provider that handles personal information. We may also disclose information when the law requires it, to protect the rights and safety of our users or the public, or as part of a sale or reorganization of our business, in which case the information stays protected by this policy.
7. Storage outside Canada
Our servers are in the United States, and our service providers may process information in other countries. While it's there, personal information is subject to the laws of those countries and may be accessed by their courts, law enforcement and national security authorities. We choose providers with strong security and privacy commitments.
Our privacy officer (privacy@projectsystem.ca) can answer questions about how our service providers outside Canada collect, use, store and disclose personal information on our behalf.
8. How long we keep it
- Workspace data: for as long as the workspace exists. After a trial ends, a payment isn't received or a subscription ends, the workspace becomes read-only; if it stays read-only for 30 days we may delete it, as set out in the terms of service, or sooner if an admin asks.
- Backups: removed as they expire, within about six months.
- Unfinished sign-ups: deleted after 24 hours if the email address isn't confirmed.
- Contact-form messages: kept as long as we need them to follow up, and no longer than two years.
- Server logs: rotated automatically, usually within a few weeks. The audit log is part of your workspace data.
- Billing records: as long as tax and accounting law requires (generally six years in Canada).
9. Cookies
This website sets no cookies of its own and loads no analytics or advertising scripts.
The ProjectSystem app sets one essential cookie, ps_rt, which keeps you signed in. It is HttpOnly (scripts can't read it), sent only over HTTPS to the sign-in service, and lasts no longer than your session (at most 30 days). Because it's essential for the Service to work, it can't be turned off. Cloudflare Turnstile may use similar technical data to do its job; it isn't used for advertising.
10. Security and breaches
We protect personal information with safeguards appropriate to its sensitivity, including encryption in transit, database-level isolation between workspaces, Argon2id password hashing, role-based access, audit logging and nightly backups. Our security page has the details.
If we become aware of unauthorized access to information in a customer's workspace, we'll notify that customer's admins without unreasonable delay so they can meet their own obligations. If a breach of security safeguards creates a real risk of significant harm to individuals, we'll also notify the affected people and the Office of the Privacy Commissioner of Canada as soon as feasible, and the Office of the Information and Privacy Commissioner of Alberta where PIPA requires it. We keep a record of every breach as the law requires.
11. Your rights
You can ask us:
- whether we hold personal information about you, what it is, how we've used it and who we've shared it with;
- to correct information that's inaccurate or incomplete;
- to delete your information or close your account, where we don't need to keep it for legal reasons.
Email privacy@projectsystem.ca. We may need to confirm your identity first, and we'll respond within 30 days. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.
12. Children
ProjectSystem is a business tool. You must be 18 (or the age of majority where you live) to create a workspace or accept the terms of service. A company may give accounts to employees under 18, such as apprentices; that company is responsible for having the authority to do so, and we handle their information the same way as anyone else's. We don't knowingly collect information from children outside a workspace.
13. Changes
We'll post any changes here with a new date. For material changes, we'll email workspace admins before they take effect.
14. Contact
Privacy questions and requests: privacy@projectsystem.ca.