Privacy Policy
Last updated: 8 September 2026
Veloktify builds and operates RPM Field, and provides software and automation services. This policy explains what personal information we handle, why, and what choices you have. We are based in Ontario, Canada, and handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA).
1. Who this covers, and one important distinction
This policy covers visitors to veloktify.com, RPM Field account holders (operators and the owners, crew, subcontractors and dispatchers they invite), and people whose information appears in RPM Field without holding an account — for example someone who texts an operator’s business number, or a prospective customer recorded as a lead.
The distinction that matters
When an operator uses RPM Field to run their business, the operator decides what information goes into the system and why. They are responsible for it. We hold and process it on their behalf, as their service provider.
So if you are a property owner, a crew member, or someone recorded as a lead, your relationship is with that operator, not with us. To have your information corrected or removed, contact them first. We will help them action your request, and you can contact us if they don’t respond.
We are directly responsible for operators’ own account information — subscription, billing and support — and for visitors to our website.
2. What we collect
2.1 Website visitors
Anything you type into a contact form, plus standard server logs kept by our host. We do not use advertising trackers or session recording on veloktify.com.
2.2 Operators
Name, email, password (stored only as a secure hash), phone. Business name, address, logo, tax registration number, e-Transfer address, payment settings. Subscription and billing records. Support messages.
Card details are handled by Stripe and never reach our systems.
2.3 Information operators put into RPM Field
Owners and clients: name, email, phone, billing address
Properties: address, GPS coordinates, access notes and gate codes, photographs
Crew and subcontractors: name, contact details, pay rates, insurance and WSIB expiry
Visits: GPS position and time at check-in and check-out, completion photographs, notes, reported issues
Money: quotes, agreements, invoices, expenses, receipts, payment records
Messages: content of texts sent to and from the operator’s business number
Leads: name, phone, address and email of prospective customers
2.4 Location
RPM Field records a GPS position only at the moment a crew member taps check in or check out, to confirm a visit happened where it should have. There is no background or continuous tracking. Crew can decline the permission; the visit is then recorded without location verification.
Operators using this to monitor workers may have their own obligations under Ontario employment law, including written electronic monitoring policies. That is the operator’s responsibility.
2.5 Photographs
Photographs may show properties and occasionally people present at the time. Operators are responsible for how they use images of private property and for any consent required.
2.6 Text messages
Where an operator connects a business number, we store messages sent and received through it. Reply STOP to opt out at any time — we record the opt-out and send nothing further to that number.
2.7 Security records
Failed login attempts and short-lived request records including IP addresses, used to detect and block abuse. Deleted automatically.
3. What we do not do
We do not sell personal information. Not to advertisers, lead brokers, home services contractors, or anyone else.
We do not share one operator’s data with another operator. Each operator’s data is isolated; no one at another business can see it.
We do not record your screen or your sessions.
We do not use your business data to advertise to you or your customers.
We access your data only when you ask us to help with a support issue, or where legally required.
4. Who we share with, and where your data is
We use a small number of service providers. Each receives only what it needs and may not use it for their own purposes.
Provider
Handles
Location
Emergent Labs Inc.
Application hosting, database, email delivery, object storage, AI processing
United States and India
Stripe
Card payments and subscription billing
Canada / United States
Twilio
Text messaging, where an operator connects a number
United States
OpenStreetMap / Nominatim
Address-to-coordinate lookup, map tiles
European Union
Your data is stored outside Canada
Our production database runs in the United States (Iowa), and our platform provider also processes data in India. Photographs and files are held in encrypted object storage operated by the same provider.
This means your information is subject to the laws of those countries, and may be accessible to their courts, governments and law enforcement under legal processes that differ from Canada’s. We tell you this because Canadian privacy law expects us to, and because you should know it before you put your customers’ information into our system.
Our hosting provider, Emergent Labs Inc., holds ISO certification and SOC 2 Type I attestation, processes personal data on our behalf under a Data Processing Agreement incorporated into our agreement with them, and publishes its own subprocessor list and trust documentation.
We may also disclose information where required by law, or to protect our rights or someone’s safety. If we are acquired or merge, information may transfer as part of that transaction; any acquirer would be bound by this policy until you are notified of a change.
5. How long we keep information, and what deletion means
While your account is active we keep your business records so the product works — you need last season’s invoices and visit history.
Short-lived technical records — password reset tokens, rate-limiting entries — are deleted automatically within hours.
When an operator deletes a property, its visits, invoices, agreements, quotes, jobs and issue reports are deleted with it.
When a subscription is cancelled, we keep your data for 90 days so you can export it or reactivate. During that window you retain read access and can download your data at any time. After 90 days we permanently delete your account and all associated records, including stored photographs and receipts.
Tax records are the exception. Canadian tax law requires business records to be kept for six years, so invoices and payment records are archived rather than deleted at 90 days, removed from normal use, and permanently deleted six years from the invoice date.
What deletion means, honestly
When we delete your data it is removed from our live systems immediately and permanently.
Backup copies take longer to disappear. Our database is backed up on a fixed schedule and individual records cannot be removed from a backup once written. Deleted data therefore remains inside expiring backup copies for up to twelve months, after which it is gone. Backups are encrypted, access-controlled, and used only to restore the service after a failure — never for normal operations.
We describe this plainly because a policy claiming instant and total erasure would not be true of any system that keeps backups.
6. Artificial intelligence
RPM Field uses AI in two specific places:
Turning a crew member’s rough note and photo into a clear description of a property issue
Asking follow-up questions when an owner requests extra work, so the operator can quote accurately
In both cases the text and images involved are sent to a third-party AI provider through our platform provider, processed to produce that result, and returned to you. We do not send your data to AI providers for any other purpose, and we do not use it to build or improve our own models.
AI output is always a draft for a person to review. It is never used to make a decision about anyone automatically.
7. Your rights
You can ask what we hold about you and get a copy; correct anything wrong; ask us to delete it, subject to legal retention; export your data at any time (operators can download invoices as PDFs and billing data as CSV without asking us, and every account can download its own data from Settings → Privacy & data); withdraw consent, though some withdrawals mean we can no longer provide the service; and complain to us and then to the Office of the Privacy Commissioner of Canada.
If you are a property owner, crew member or recorded lead, contact the operator you deal with first. Tell us if they don’t respond and we will help.
We respond within 30 days.
8. Security
All traffic encrypted in transit (TLS)
Passwords stored as secure hashes, never readable by us
Databases and stored files encrypted at rest
Payment and messaging credentials you provide are encrypted before storage
Each operator’s data isolated from every other operator’s
Links emailed for approving quotes, paying invoices or viewing photographs expire automatically and stop working once used
Repeated failed logins locked out; card details never reach our servers
No system is perfectly secure. If a breach occurs creating a real risk of significant harm, we will notify affected people and the Office of the Privacy Commissioner of Canada as required by law.
9. Children
RPM Field is business software, not intended for anyone under 18. We do not knowingly collect information from children.
10. Cookies
RPM Field uses only the storage needed to keep you signed in. We use no advertising or tracking cookies, and we do not record sessions.
11. Changes
Posted here with an updated date. Significant changes are emailed to account holders before taking effect.
12. Contact
Matthew Robinson, Privacy Officer
Veloktify — Ontario, Canada
contact@veloktify.com
If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.