Privacy Policy
For businesses that use Gettled, their teams, and their clients.
Last updated October 24, 2026
1. Who we are
Gettled is operated by Gettled ("Gettled", "we", "us"), Toronto, Ontario, Canada. This policy explains how we handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial laws, and US state laws including the California Consumer Privacy Act as amended (CCPA).
Our Privacy Officer can be reached at contact@gettled.com.
2. Two kinds of information
- Account information: about the businesses that use Gettled and their team members (for example, your name, email and business details). Gettled decides how this is used and is responsible for it.
- Client information: about a business's own clients (for example, a homeowner's name, address and invoices). The business decides how this is used; Gettled processes it on the business's behalf, as its service provider. If you're a business's client, contact that business first about your information. We'll help them respond.
3. What we collect
- Account and profile: name, email address, password or Google sign-in, role, signature (if you save one), and your preferences.
- Business details: business name, address, phone, email, logo, tax numbers, currency and settings.
- Billing: your plan and subscription history. Card details are collected and stored by Stripe, not by Gettled; we keep only the card brand and last four digits.
- Client records that businesses add: names, company names, emails, phone numbers, service addresses, notes, and the quotes, agreements, jobs, visits, photos, invoices and payments related to them.
- E-signatures: when a client approves a quote, the name they enter, their drawn, typed or uploaded signature, their email if given, the date and time, their IP address and browser type, and a fingerprint (hash) of the document they signed.
- Work records: visit schedules, checklists, job photos, time clock entries, materials used and client sign-offs.
- Payments: amounts, dates and methods of payments, and for saved cards, the card brand and last four digits. Full card and bank details stay with Stripe.
- Usage and device information: pages viewed and features used (through PostHog), error reports (through Sentry), and basic technical data such as IP address, browser and device type.
4. How we use it
- To provide Gettled: sign-in, storing and showing your data, sending the emails you ask us to send (quotes, invoices, reminders, receipts), and processing payments through Stripe.
- To bill for Gettled subscriptions.
- To keep Gettled secure, prevent fraud and abuse, and fix problems.
- To understand how Gettled is used and improve it. We use product analytics for this, not to sell or advertise.
- To contact you about your account, service changes and, if you agree, news about Gettled. You can opt out of marketing emails at any time.
- To meet legal obligations, such as tax records.
We don't sell personal information, and we don't share it for cross-context behavioural advertising.
5. Consent
By creating an account, you consent to us handling your information as described here. Businesses are responsible for getting any consent needed from their own clients and team members before adding their information. You can withdraw consent at any time, subject to legal or contractual limits, though it may mean we can't provide the Service.
7. Where it's stored
Gettled's database and files are stored in Canada (Supabase, on Amazon Web Services in Montréal). Some of our service providers, listed above, process information in the United States and other countries. When information is outside Canada, it may be accessible to the courts, law enforcement and national security authorities of those countries.
8. How long we keep it
We keep account and client information while the account is active. When a business asks us to delete its account, we delete its data within 30 days, except where we must keep records longer by law (for example, billing records for tax purposes). Backups are kept for up to one year and then deleted on a rolling basis.
Businesses can delete individual client records in the app at any time. A business may need to keep invoices and payment records for its own tax obligations.
9. How we protect it
- Each business's data is kept separate in our database, and access is checked on every request.
- Information is encrypted in transit (HTTPS) and at rest.
- Photos and documents are stored privately and shown through short-lived links.
- Links to quotes, invoices and client portals are long, random and private; businesses can reset portal links.
- Access by our team is limited to what's needed to run and support Gettled.
No system is perfectly secure. If a breach creates a real risk of significant harm, we'll notify the people affected and the relevant regulators as the law requires.
10. Your rights
Depending on where you live, you can ask to access, correct or delete your personal information, ask what we've shared and with whom, or withdraw consent. California residents can also ask to know the categories of information collected and their sources, and can't be discriminated against for exercising these rights. You can use an authorized agent.
To make a request, email contact@gettled.com. We'll confirm your identity and respond within 30 days (45 days where the CCPA applies). If you're a client of a business that uses Gettled, we may pass your request to that business.
If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada or your local privacy regulator.
12. Children
Gettled is for businesses and isn't meant for anyone under 18. We don't knowingly collect information from children.
13. Changes and contact
We'll post any changes here and, if they're significant, tell account owners by email. Questions or requests: contact@gettled.com, or Gettled, Attn: Privacy Officer, Toronto, Ontario, Canada.