Privacy Policy

This distinction runs through the whole policy, so it comes first. DoneWell holds two very different kinds of personal information, and our responsibility is not the same for both.

• Account information — the people who sign in to DoneWell: business owners and their staff. We decide what we collect here and why, and we answer to you for it directly.
• Business records — everything a business enters about its own clients: names, addresses, phone numbers, job history, photos, invoices. We hold this on behalf of that business. They decide what to collect, how long to keep it and who may see it. We act on their instructions and do not use it for our own purposes.

If you are a client of a business that uses DoneWell and you want your records changed or deleted, contact that business — they control those records. If they ask us to act, we do.

When you create an account: your name, email address, password (stored only as a cryptographic hash — we never see or store the password itself), and optionally a phone number and profile photo.

About your business: company name, address, contact details, tax and pricing settings, and the team members you invite.

Records you enter: your clients and their properties, quotes, jobs, visits, invoices, payments, expenses, photos and files you upload, and messages sent or received through the service.

Automatically, when you use the service: your IP address, browser type, and the times of your requests. We use these to keep the service running, apply rate limits, and investigate abuse.

Staff location, only on shift and only if the business turns it on: a business can enable location tracking for its field staff in the DoneWell mobile app. When it does, the app sends a staff member’s position, speed, heading, motion type and battery level to us only between the first visit they start and the last visit they complete on a day. Outside that window the app does not collect location and our servers refuse it. The staff member is told before the first shift, sees a permanent indicator while it runs, and can withdraw the permission in their phone’s settings at any time. We do not collect location from the web app.

We do not run advertising or third-party analytics. There are no tracking pixels, no advertising cookies, and no behavioural profiling in DoneWell. We do not sell personal information, and we never have.

We use a small number of cookies, all of them necessary for the service to work:

• A sign-in session cookie, so you stay logged in.
• A client-portal session cookie, scoped to the portal, when a client opens a link you sent them.
• A referral cookie, set only if you arrive through a referral link, so the code can be applied at signup.
• A theme preference, so the interface stays in light or dark mode.

None of these are used for advertising or shared with advertisers. Blocking them will stop you from signing in.

• To provide the service: showing your schedule, sending quotes and invoices, collecting payments, and keeping your data available to the people you authorised.
• To communicate with you about your account: security notices, billing, and changes to the service.
• To keep the service secure: detecting abuse, enforcing rate limits, and investigating incidents.
• To meet legal and tax obligations, including keeping payment records.
• To improve the product, based on aggregate usage — not by reading your business records.
• Dispatch and arrival on visits — on-shift staff location is shown to the dispatchers and managers of that staff member’s own business and used to mark a visit as “arrived” when the phone enters the visit’s address area. We do not derive productivity, speed or ranking metrics from it, and the product has no feature that does.

We do not use your business records to train machine-learning models, and we do not share them with anyone except the service providers listed in section 6.

Under Canadian privacy law we rely on your consent to collect and use personal information, and you may withdraw it at any time by closing your account or contacting us. Some information we must keep even after you withdraw consent — payment records, for example, carry legal retention requirements.

Staff location is a business record. The business that employs or engages the staff member decides whether to turn tracking on, and it — not DoneWell — is responsible under Canadian privacy law for telling its staff before it does, for using the data only for the purposes it told them about, and for any workplace rule attached to it. We hold the data on that business’s instructions, as with every other business record (section 1). What we add on our own account: tracking cannot run outside a shift, points are deleted after 30 days, and a staff member can ask us directly for a copy of their points (section 10).

DoneWell lets businesses send email campaigns and automated reminders to their own clients. Two things follow from that, and they are the responsibility of the business sending them, not ours:

• Consent to receive those messages must be obtained by the business, in line with anti-spam law. DoneWell records a consent flag per client and honours it: automated reminders and campaigns are not sent to a client who has opted out.
• Text messages sent from DoneWell go through the sending business’s own telecom account, under their own agreement with that provider.

Documents a client explicitly asked for — an invoice, a quote, a receipt, a portal link — are sent regardless of marketing preferences, because they are the transaction itself rather than outreach.

We use the service providers below to operate DoneWell. They may process personal information only to provide their service to us, and are bound to keep it confidential.

Card numbers are entered directly into Stripe’s payment fields and never reach our servers; we store only the outcome of a payment and the last digits Stripe returns to us.

We will also disclose information if we are legally required to — a court order, for example — or to protect the safety of people or the integrity of the service. We do not sell personal information and do not disclose it for advertising.

If you choose to connect a Google account so that your scheduled work appears in Google Calendar, we request access only to your calendar events. We use it for exactly one thing: writing, updating and removing the visits assigned to you. We do not read your personal events, and connecting a calendar is entirely optional — the service works without it.

DoneWell’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect at any time from your schedule settings in DoneWell, or by revoking access in your Google account. Disconnecting removes the stored access credentials from our systems.

Business records stay for as long as the business keeps them — that is their decision, not ours. The periods we enforce ourselves are:

When an account is closed we delete its data, except records we must keep for legal or accounting reasons — payment history in particular. Ask us and we will tell you what would remain in your specific case.

What we do:

• All traffic is encrypted in transit with TLS.
• Passwords are stored as bcrypt hashes, never in a recoverable form.
• Credentials for connected services (payment, messaging and calendar integrations) are encrypted at rest with authenticated encryption, and are never sent back to the browser once saved.
• Access inside a company is controlled by roles and permissions that the account owner sets; each company’s data is isolated from every other company’s.
• Sign-in sessions can be revoked, and changing a password signs out other devices.

No system is perfectly secure, and we will not claim otherwise. If we discover a breach affecting your information, we will tell you and the relevant authorities as required by law.

You may ask us to:

• Tell you what personal information we hold about you and how it has been used.
• Correct information that is wrong or incomplete.
• Delete your account and the personal information tied to it.
• Export your data in a machine-readable form.
• Withdraw your consent to our use of your information.

Write to mail@donewellapp.com. We will respond within the time required by applicable law — under Canadian federal privacy law that is thirty days — and we will not charge you for a reasonable request. If you are unhappy with our answer you may complain to the Office of the Privacy Commissioner of Canada.

If your request concerns records held by a business that uses DoneWell rather than your own account with us, we will point you to that business, who can act on them directly.

DoneWell is operated from Canada and our servers are located in Canada. Some of the providers listed in section 6 operate internationally, which means information may be processed outside Canada and may be accessible to courts and authorities in those countries. We choose providers that commit to protecting it, but we cannot exempt them from the laws they operate under. For businesses in Quebec: our servers are in Canada but outside Quebec, which under the province’s private-sector privacy Act is a communication of personal information outside Quebec. Section 9 describes the protections that apply; we provide the details a business needs for its own assessment on request.

DoneWell is a tool for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child’s information has reached us, write to mail@donewellapp.com and we will delete it.

We update this policy when the service changes. The effective date at the top always reflects the current version. If a change materially affects your rights, we will tell account holders by email before it takes effect rather than relying on you to notice the date.

Privacy questions and requests: mail@donewellapp.com
Everything else: support@donewellapp.com

Person in charge of the protection of personal information: Roman Vynnychenko, Director — mail@donewellapp.com

Amazing Canada Inc. is the organization responsible for the personal information described in this policy — the data controller for account information, and the service provider holding business records on behalf of the businesses that use DoneWell.

Amazing Canada Inc.
3-635 Marsh Rd NE, Calgary, AB T2E 5B4, Canada

See also our Terms of Service.