Privacy Policy

This Privacy Policy explains how astracoretech corp., a corporation incorporated under the Canada Business Corporations Act with its office in Ontario, Canada ("astracoretech corp.", "we", "us", "our"), collects, uses, discloses and protects personal information. It applies to every product, website, app and service we offer, now or in the future, including The Audit Guy, UrTimeSheet, FinSculp and our website at astracoretech.com (each a "Product", together the "Services"). It pairs with our company-wide Terms of Service.

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy law, including Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), and Canada's Anti-Spam Legislation (CASL) for commercial electronic messages.

1. How this policy fits with product policies

• This policy applies to all Services.
• A Product may have its own privacy policy posted on its website or in its app. If a Product's privacy policy conflicts with this policy, the Product's privacy policy prevails for that Product only. This policy still applies to anything the Product policy does not cover.
• The product sections below (Section 5) add details for specific Products.

2. Person in charge of personal information

Our person in charge of the protection of personal information (as required under Quebec's Law 25) can be reached at:

3. What we collect (all Services)

Depending on the Product you use, we may collect:

• Contact and account information: name, email address, business name, login details and account settings.
• Purchase and billing information: what you bought, amounts, dates, invoice status, the payment processor's customer ID and the billing details the processor gives us for tax and accounting. Card numbers are handled by our payment processor (such as Stripe) and do not reach us.
• Content you submit: information, files and data you enter into a Product.
• Communications: messages you send us, support requests, and your marketing preferences and consent records.
• Device, log and usage information: IP address, device and browser type, request times, pages or screens used, and errors, collected through server logs and, where described below, analytics and crash-reporting tools.
• Cookies and similar technologies: used to keep you signed in, remember preferences, prevent fraud and, where enabled, measure use. You can control cookies through your browser; disabling some may affect how a Service works.

4. Why we use it

• To provide, operate and support the Services you use or buy.
• To process payments, manage subscriptions and keep tax and accounting records.
• To communicate with you about your account, orders, service changes and support.
• To keep the Services secure, prevent fraud and abuse, and fix problems.
• To understand how the Services are used and improve them.
• To send marketing messages, only with your consent (Section 8).
• To comply with law and enforce our terms.

We collect only what we need for these purposes, and we ask for your consent where the law requires it. We do not sell personal information.

5. Product-specific details

5.1 The Audit Guy

The Audit Guy is offered at astracoretech.com/auditguy. In summary:

• When you buy: your email address, confirmation that you are buying for a business purpose, the website URL you submit for the audit, and whether you ticked the optional, unticked-by-default box to receive marketing emails. Checkout and payments are run by Stripe, which may also use cookies and device information on its checkout page to detect fraud.
• Audits and reports: the reports we produce (one-time audit or recurring reports) and the order record linking them to your email.
• Public information only: audits look at publicly available information about the submitted website and the business's public online presence (such as public pages, listings, profiles and reviews). Public reviews may include other people's names or comments; we use that only as part of the business's scorecard, and we do not profile or contact those people.
• Free tools: if you use a free tool that checks a URL, we do not ask for your email; standard server logs still apply.

5.2 UrTimeSheet

UrTimeSheet is a time-tracking Product used by employers and their workers. Any privacy policy posted at urtimesheet.com or in the app prevails for UrTimeSheet.

• Accounts: employer (account owner) and worker accounts, including names, email addresses or other login details, roles and workplace settings.
• Time records: clock-in and clock-out times, breaks and related notes or edits.
• Location: when a worker clocks in, the app checks the device's location once, at clock-in. UrTimeSheet does not track location continuously.
• Crash reports: we use Sentry to receive crash and error reports (such as device type, app version and error details) so we can fix problems. Crash reports are kept for 90 days.
• Analytics: we use PostHog to understand how the app is used. Analytics data is kept for 12 months. For users in Quebec, analytics is off by default and is turned on only if the user chooses to enable it.
• Employer responsibility and our role: worker data in UrTimeSheet is controlled by the employer. For that data, we act as a service provider to the employer: we process it on the employer's behalf and according to its instructions and our terms, and not for our own purposes, except as needed to secure, support and improve the Service and to comply with law. The employer is responsible for its workers' data, for giving workers any required notices (such as an electronic monitoring policy) and for obtaining any required consents, including for location at clock-in. Workers who want to access, correct or delete their information should contact their employer first; we will help the employer respond as the law requires.

5.3 FinSculp

FinSculp is a personal finance app. Any privacy policy posted on FinSculp's website or in the app prevails for FinSculp and describes in more detail what the app collects. Generally, we process the account information and the information you choose to enter or connect in FinSculp to provide the app's features to you, along with the device, log and usage information described in Section 3. We do not sell this information.

5.4 astracoretech.com

When you visit astracoretech.com or contact us through it, we may collect the information you send us (such as your name, email and message) and standard device and log information. We use Vercel Web Analytics to understand how our website is used. It does not use cookies and does not build a profile of you. It records aggregated information about visits, such as the pages viewed, the referring website, your country, and your device and browser type. We use this information only to measure and improve the website. Vercel processes it for us as a service provider and may process it outside Canada, including in the United States (see section 7).

5.5 Future products

This policy applies automatically to new Products we launch. Where a new Product collects information in a way not described here, we will describe it in that Product's privacy policy or in an update to this policy.

6. Who we share it with

We share personal information with service providers that process it on our behalf, under contract, only as needed to run the Services. By category, these include:

• Payment processing (for example, Stripe);
• Hosting and infrastructure (for example, cloud and website hosting providers);
• Email and communications (for example, email and productivity providers that send receipts, reports and messages);
• Analytics (for example, PostHog and Vercel Web Analytics);
• Crash and error reporting (for example, Sentry);
• AI and data tools (for example, tools that help collect public web data, analyze information or prepare reports and content);
• Storage and productivity tools used to keep business records.

The specific providers may change over time. We take reasonable steps to choose providers that protect personal information appropriately. We also disclose information when the law requires it, to protect the rights, property or safety of our users, the public or us, or as part of a sale, merger or reorganization of all or part of our business, in which case the information remains subject to this policy.

7. Where your information is stored (cross-border transfers)

Some of our service providers store or process personal information outside Canada and outside Quebec, including in the United States. Before such a transfer, we assess whether the information will receive adequate protection, and we use contracts that limit providers to processing it for us. While your information is outside Canada, it may be accessible to courts, law enforcement and national security authorities under the laws of that country. By using the Services, you acknowledge that your information may be transferred, stored and processed in this way.

8. Marketing emails (CASL)

• We send commercial electronic messages only with your consent or where CASL otherwise allows it.
• Any marketing opt-in is optional and not a condition of buying.
• Every marketing message identifies us, includes our contact information and has a working unsubscribe link. We act on unsubscribe requests within 10 business days.
• We keep a record of when and how you consented.
• You can withdraw consent at any time using the unsubscribe link or by writing to info@astracoretech.com.
• Transactional messages (such as receipts, order delivery, billing, security and service notices) are not marketing and may still be sent while you use the Services.

9. How long we keep it

We keep personal information only as long as needed for the purposes described here or as required by law, then delete or anonymize it:

• Orders and reports (including submitted URLs and audit reports): 24 months after your last purchase or the end of your subscription, whichever is later.
• Billing and tax records: 6 years after the end of the tax year they relate to (longer if a tax audit or dispute is under way).
• Proof of marketing consent: as long as you are subscribed to marketing messages and 3 years after you unsubscribe or your consent ends.
• Server logs: 30 days.
• UrTimeSheet: crash reports 90 days; analytics 12 months; accounts and time records until the employer deletes them or the account is closed, subject to any period required by law.
• Other account data: for as long as your account is active, then deleted within a reasonable period, unless a Product's privacy policy says otherwise or the law requires us to keep it longer.

10. Your rights and choices

Subject to legal and contractual limits, you can ask to:

• access the personal information we hold about you;
• correct inaccurate or incomplete information;
• have your information deleted, except records we must keep by law;
• withdraw your consent (which may mean we cannot continue to provide a Service);
• where Quebec law applies, receive computerized personal information you provided in a structured, commonly used technological format, and be informed about decisions based exclusively on automated processing, if any.

To make a request, email info@astracoretech.com. We may need to verify your identity. We aim to answer within 30 days. If you are an UrTimeSheet worker, please also see Section 5.2. You may also contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information du Québec.

11. Security

We use reasonable administrative, technical and physical safeguards suited to the sensitivity of the information, such as encryption in transit (HTTPS) and limiting access to people who need it. Card data is handled by our payment processor. No system is perfectly secure. If a privacy incident creates a real risk of significant harm (or, in Quebec, a risk of serious injury), we will notify affected individuals and regulators and keep records as the law requires.

12. Children

The Services are intended for adults and businesses and are not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will post the new version with a new "Last updated" date and, for material changes, tell active customers by email or in the Product before the change takes effect.

14. Contact