Who we are and what this covers

OpSaber is operated by 2350516 Alberta Ltd. ("OpSaber", "we", "us"), a company incorporated in Alberta, Canada. This policy covers this website (opsaber.com), the OpSaber application that each customer reaches at its own address (yourcompany.opsaber.com), and any dealings you have with us.

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, Alberta's Personal Information Protection Act.

Two different roles

Information we are responsible for. If you visit this site, write to us or have a login to OpSaber, we decide how that information is used and we answer for it.
Information a business keeps in its workspace. A business that uses OpSaber stores its own records there: its customers, its staff, its jobs, quotes and invoices. That business decides what goes in and is responsible for it under privacy law. We store and process it only to provide the service to that business, under our agreement with it (our terms of service). If you are a customer or an employee of a business that uses OpSaber, please take questions about your information to that business first. We will help it answer you.

What we collect

When you visit opsaber.com

This site sets no cookies and uses no analytics or advertising trackers, and we do not keep logs of who visits it. Pages are delivered through Amazon CloudFront, which has to see your IP address and browser details to send you the page. The site and the application load the Sora typeface from Google Fonts, so your browser also connects to Google's servers, which see the same technical details.

When you write to us

The contact form asks for your name, company, email address and message. It is sent by email, through Amazon Simple Email Service, to our inbox at Google Workspace (Gmail), and is not stored on the website. It is also recorded in our own OpSaber workspace, where our customer records are hosted in AWS Canada (Central), so we can follow up on your inquiry. While it is sent, your IP address is held in memory for a few minutes to stop the form being abused; it is never saved.

To stop spam, the form also uses Cloudflare Turnstile, a bot check that runs in your browser in place of a puzzle. While the contact page is open, Cloudflare sees your IP address, browser details and other signals from your browser. When you send the form, our contact service passes Cloudflare the result of that check with your IP address to confirm it. Cloudflare handles this under its privacy policy. We do not send Cloudflare your message or contact details.

When you use OpSaber

Your login: your name, email address, role and the company you belong to. Your password is stored only as a one-way hash that cannot be turned back into the password. If you turn on two-factor sign-in, its secret is kept on the server and your recovery codes are stored only as hashes.
Security records: sign-in attempts are counted by account and by IP address to stop password guessing, and each password reset and invitation link is recorded (when it was issued and used, and from which IP address, never the link itself).
A record of changes: who created, changed or archived a record, and when. It holds a short label of what was touched, not the content.
Workspace content: whatever your company enters or uploads, such as customers and contacts, addresses, jobs, quotes, invoices, payment status, stock, equipment, inspection forms and signatures, staff records and certifications, time entries, documents, and email sent or received through OpSaber.
Staff location, only if your employer turns it on. It is off for every company until the company enables it. Staff are then shown the employer's notice and, by default, asked to consent. Location is taken only at a few moments (arriving at, leaving or completing a job, and clocking in or out), never continuously, and it is erased automatically after the period the employer sets.
If a business sends you a link: a business using OpSaber can send its customers a link to view, approve, sign or pay a quote or invoice. OpSaber records when the link is used and from which IP address and browser, and for a signature, the name and email address given. That record belongs to the business, as evidence of what was agreed.
On your device: the application keeps your sign-in, and the data the field app needs to work offline, in your browser's own storage on your device. OpSaber sets no tracking cookies.

Payments

Where a business takes payments through OpSaber, they run through Stripe under that business's own Stripe account. Card numbers go to Stripe and never reach OpSaber; we receive only the payment's status and reference.

Google user data

Connecting Google Calendar is optional. A user turns it on from Calendar settings in OpSaber and approves access on Google's own consent screen. Until then OpSaber has no access to that person's Google account. This section sets out exactly what OpSaber does with Google user data.

What OpSaber asks Google for, and why

Your Google account email address (Google's basic sign-in information), so Calendar settings can show which Google account is linked.
Calendars and events that OpSaber creates (the calendar.app.created permission). OpSaber creates one calendar named "OpSaber" in your Google account and adds, updates and removes your OpSaber appointments on that calendar only. It reads changes made to those events so that when you move an OpSaber appointment in Google Calendar, the new time can come back to OpSaber. This permission gives OpSaber no access to your other calendars or events.
Your free and busy times (the calendar.freebusy permission). OpSaber reads only when the busy periods on your primary Google calendar start and end, for the dates you are looking at, so your other commitments show as busy time and scheduling can warn you about a clash. It never reads the titles, descriptions, attendees or locations of those events.

What OpSaber sends to Google

For each appointment assigned to you: the job reference and title (or the appointment's own title), the customer's name, the start and end time, and a link back to the appointment in OpSaber. Job notes and addresses are never sent, because the copy lives in your personal Google account, outside your company's control.

How it is stored and protected

The access tokens Google issues are encrypted (AES-256-GCM) before they are stored in our database in AWS Canada (Central). We also store your Google email address, the ID of the "OpSaber" calendar, the Google ID of each event OpSaber created and the state of the sync. Busy times are held only briefly to draw your calendar and are never saved as records.

Who it is shared with

No one. Google user data is used only to provide the calendar features you can see in OpSaber. We do not sell it, use it for advertising, use it to judge creditworthiness, or transfer it to anyone, except where that is needed for security (for example, investigating abuse), to comply with the law, or as part of a merger, acquisition or sale of assets. People at OpSaber do not read it unless you ask us to help with a problem and agree to it, unless it is needed for security, or unless the law requires it. We do not use Google user data to develop, improve or train AI or machine learning models.

OpSaber's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deletion

You can disconnect at any time from Calendar settings. OpSaber then revokes its access at Google, erases the stored tokens and stops syncing. The "OpSaber" calendar stays in your Google account for you to keep or delete. You can also remove OpSaber's access from your Google account at myaccount.google.com/permissions.

After you disconnect, we keep only a record that the connection existed (the Google address, the calendar ID and the event IDs, with no means of access) as part of your company's workspace history. To have that erased as well, contact us. It is also deleted with the rest of your company's data when your company leaves OpSaber.

How we use information

To provide, secure and support OpSaber, including backups and fixing problems you raise with us.
To answer messages and arrange demos.
To bill our customers and keep the business records the law requires.
To tell account holders about changes to the service, security issues or this policy.

We do not sell personal information, we do not use it for advertising, and we do not use the content of customer workspaces to train AI models. Our access to a customer workspace is limited to a logged break-glass path, used only to resolve something the customer has raised with us.

Who helps us run the service

We use a small number of providers. Each one gets only what it needs to do its job, under contract terms that protect the information.

Amazon Web Services: hosts the application, the database, stored files and backups, and sends and receives the email OpSaber handles (Amazon SES). Where: AWS Canada (Central). This website is delivered through CloudFront's worldwide network.
Google: Google Workspace (Gmail), our own email, where contact form messages and support email arrive; Google Calendar, only for users who connect it; and Google Fonts, which delivers the typeface. Where: United States and worldwide.
Cloudflare: Turnstile, the bot check on the opsaber.com contact form, as described under What we collect. Where: United States and worldwide.
Stripe: online payments, only for businesses that turn them on, under their own Stripe account. Where: United States.
Intuit QuickBooks Online: accounting sync, only for businesses that connect it (customers, invoices and payments). Where: United States.

OpSaber does not currently send workspace data to any AI provider. If we add a feature that does, we will name the provider here and update this policy before it processes any data, and we will not allow that provider to train its models on it.

Information outside Canada

OpSaber itself runs in Canada. Where a provider above works outside Canada, mostly in the United States, the information it handles is subject to the laws of that country and can be accessed by its courts and authorities.

How long we keep it

Workspace data: for as long as the company uses OpSaber. How long documents are kept is a policy each company sets, and business records are archived rather than deleted so history stays auditable. A company can export its data at any time, and when it leaves we return its data and delete it on a schedule agreed in writing.
Backups and file versions: database backups are kept for 14 days. When a stored file is replaced or deleted, the earlier version is kept for up to a year so it can be recovered, then removed.
Application logs: 90 days.
Incoming email: the raw copy of an email received through OpSaber is removed after 30 days; the message itself stays in the workspace.
Staff location: erased automatically after the period the employer sets.
Google Calendar: as described under Google user data.
Messages to us: for as long as we need them to reply and to keep a record of our dealings, then deleted.
Billing records: as long as Canadian tax law requires, generally six years.

How we protect it

Encryption in transit and at rest, a separate workspace for each company enforced on every query, two-factor sign-in, access by role, daily backups and a record of every change. The details are on our security page. If a breach of security creates a real risk of significant harm to anyone, we will tell the people affected and report it to the Privacy Commissioner, as the law requires.

Your choices and rights

You can ask us to:

tell you what personal information we hold about you and give you a copy;
correct information that is wrong;
stop using information you consented to, for example by disconnecting Google Calendar or asking us to stop writing to you (some records, such as billing records, the law requires us to keep);
delete information we no longer need.

We answer within 30 days. If your information is in a company's workspace, we pass your request to that company and help it respond. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Alberta, the Office of the Information and Privacy Commissioner of Alberta.

Children

OpSaber is a service for businesses. It is not meant for children, and we do not knowingly collect information from them.

Changes to this policy

When this policy changes, we update the date at the top. If a change is significant, we tell account holders by email or in the application before it takes effect.

Contact

Our Privacy Officer is accountable for how we handle personal information. To reach them, or to make any of the requests above, use our contact form and start your message with "Privacy". A person reads every message and acknowledges it within one business day.

2350516 Alberta Ltd., operating OpSaber. Alberta, Canada.

Privacy policy