Privacy Policy
At Kirkup Inc ("Kirkup", "we", "us", or "our"), we are committed to protecting your privacy and personal information. We provide Clara Day, a field-service operations platform, and Clara Field, the login-walled mobile application used by a Customer's crews (together, the "Services"). This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you visit our website and use the Services. Where capitalized terms are not defined here, they have the meanings in the Terms of Use.
Personal information includes any data that can be used to identify an individual, including name, home or work contact information, identification numbers, user IDs, and passwords.
This policy describes collecting, using, sharing, and maintaining personal information.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website with a new effective date.
1. Information We Collect
Accounts are admin-provisioned by your organization. We do not operate self-serve registration. A Customer's administrator supplies the identity information needed to open an Authorized User account, typically a name and email address. Clara Field users sign in with credentials their administrator sets; the administrator resets them when needed.
We collect personal information in the following ways:
As part of using the Services
Authorized Users (office and field staff)
- Name, email address, role, and credentials
- For Clara Field: device label, platform, push-notification token, when the device last connected, and the app version it reports
- Notes, completion status, and job-site photos captured in Clara Field. Photos are taken with the device's system camera. Clara Field does not request the device's location services or the device's contacts. Clara Field re-encodes each photo on the device before upload, which removes embedded camera metadata such as capture time and coordinates, so we do not receive them from the app. For photos uploaded through a web browser (the office website or the field-staff web view), we read any capture time and coordinates the camera embedded, store them on the job record, and remove that metadata from the stored image file. Job addresses shown in the app were entered by the Customer's office.
Customer records about jobs and clients
The Customer enters, or imports, information about its own clients and jobs: client name, address, phone number, appointment times, and notes. Field staff see that information only for jobs they are assigned.
Billing
If we bill the Customer, we may collect billing contact details. We do not collect payment-card information from field staff.
We may review Content posted through the Services to ensure use is appropriate, lawful, and in accordance with the Terms of Use.
Each Authorized User is responsible for respecting personal information of people they interact with through the Services, including the Customer's clients.
Automatically
The Services collect usage statistics and technical information such as IP address, operating system, browser or app version, requested page, date/time, and, on the office website, a session cookie (which is required to stay signed in to the office site). We use this to understand usage and to keep the Services secure.
You contact us directly
When you contact us by telephone, email, or through our website, we collect the information you choose to send so we can respond.
You respond to communications from us
We may ask for feedback or support information. Your response may include personal information and opinions.
Information relating to minors
The Services are designed for adults. We do not knowingly collect personally identifiable information from children under 18. The Services are not directed at children under 18.
SMS messaging and phone numbers
Clara Day uses phone numbers the Customer already holds for its own clients to send transactional appointment messages and to place related voice calls, through Twilio. This is not a marketing program, and it is not sent to Clara Field users as a promotion.
We do not sell, rent, trade, or share mobile phone numbers or SMS consent records with third parties for their own marketing purposes. Phone numbers may be processed by Twilio solely to deliver the messages the Customer has requested, under contractual obligations described in Section 5.2.
A recipient may reply STOP to an appointment text to unsubscribe from further texts to that number, or HELP for program information. Full SMS terms are in Section 18 of the Terms of Use.
2. How We Use Your Information
2.1 General principles
We deal with personal information under these principles:
- Lawfulness, fairness and transparency: We will let you know why we need information we request and process it securely and in accordance with applicable laws. If you have questions, ask us.
- Limitations of purpose: We limit use of personal information to what is necessary to provide the Services, with the exceptions set out in this policy.
- Minimization of data: We only collect personal information we need, and that you or the Customer choose to give us.
- Accuracy: We make reasonable efforts to keep personal information accurate based on what we are given; if you notify us of changes, we will update our systems in a timely manner.
- Limitation of data retention: We delete personal information when it is no longer required, subject to Section 4.
- Integrity and confidentiality: We use technical and organizational measures designed to protect personal information against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
2.2 Use of your data
Access to personal information is restricted to people who need it (including Authorized Users of that Customer, according to their role). We process information to provide the Services the Customer has requested, to follow the Customer's lawful instructions, to improve the Services, to meet legal requirements, and to manage our internal operations.
2.3 Anonymized and aggregated data
We may create anonymized and aggregated data by removing identifying information. We may use it to analyze usage, conduct research, create statistical reports, and develop features. That data cannot be used to identify you.
2.4 Use of AI
Clara Day uses Anthropic Claude to classify inbound appointment texts (for example as a confirmation, a reschedule request, or a cancellation) and may draft the reply that is sent. That can update the job and send the reply without a person reviewing the message first. Office staff can still change the job afterwards. This processing is not part of Clara Field.
3. How We Share Your Information
We will not sell, rent, or trade your personal information. We provide information to third parties only as described here, and we require those parties to keep it confidential.
We may disclose information without prior consent if required by law, or if we believe in good faith that disclosure is necessary to:
- Comply with law or legal process
- Protect and defend our rights and property, or those of a third party
- Protect against misuse of the Services
- Protect the personal safety of any person
- Allow for a change of ownership of Kirkup Inc, with the same protection under this policy
We will try to give prior notice; that may not always be possible.
Routine processors, used only as needed to provide the Services, include:
- Railway, for application hosting and the primary database
- Cloudflare, including R2, for job-site photo storage (embedded camera metadata is removed from the stored image file)
- Twilio, for SMS and voice to the Customer's clients
- Anthropic, for classifying inbound appointment texts and drafting replies, as described in Section 2.4
- Google, for address geocoding and, where enabled, push notifications (FCM)
Job-site photos stay on that Customer's jobs. They are not added to a shared library for other customers.
4. Your Rights and Choices
Access: You may request access to the personal information we hold about you.
Correction, update or change: You may request that we correct inaccurate or incomplete information.
Deletion: You may request that we delete personal information; we may be obligated to retain an archival copy to comply with law or legal process, or because it is the Customer's business record. We will tell you when that applies.
Opt-out: You may opt out of marketing communications from us. Clara Day's appointment texts to a Customer's clients are transactional; STOP still applies as described in Section 1.
Withdraw consent: Where we rely on consent, you may withdraw it. We will proceed accordingly, which may include deletion of information we no longer have consent to process.
Retention: While a Customer account is active, we retain personal information needed to provide the Services. When an Authorized User's access is deactivated, that person's login ends; job records they created (photos, notes, completions) remain the Customer's records. When a Customer account is closed, personal data is removed subject to a short recovery window and then deleted, except where law requires longer retention (for example billing or audit records).
How to exercise these rights: Contact the Privacy Officer at privacy@claraday.ai. We respond within 30 days of receipt as required by PIPEDA, and will say if we need more time or information to verify your identity. Field-staff deletion is typically handled by the Customer's administrator; we will still honour a direct request.
5. Data Security and Storage
We implement appropriate technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. No method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
5.1 Safeguards
We use access controls, encryption in transit, and least-privilege access for staff and processors. Clara Field stores a local cache of assigned jobs on the device so crews can work without a network; that cache stays on the device after sign-out, and is cleared when a different account signs in on that device. A Customer that retires a device should remove the app or clear its data.
5.2 Third-party processing
Where we engage processors, we enter into agreements that require them to handle personal information in accordance with applicable privacy laws, implement appropriate safeguards, limit use to the purposes we specify, and notify us of a privacy breach.
We share only the minimum personal information needed for each processor's function, and we bind them contractually to protect it.
5.3 Breach notification
If a privacy breach affects your personal information, we will notify you and we will notify the Office of the Privacy Commissioner of Canada (OPC) under PIPEDA's mandatory breach reporting (s. 10.1) where the breach poses a real risk of significant harm.
You may also contact the OPC directly to file a complaint.
6. Compliance with Laws
We are committed to complying with applicable privacy laws, including:
- The Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada
- State privacy laws in the United States, including the California Consumer Privacy Act (CCPA) where applicable
- Other privacy regulations that apply to Kirkup Inc as a Canadian company because of the nature of the Services
We are not responsible for privacy laws that apply only to you unless they also apply to Kirkup Inc.
6.1 PIPEDA
As a Canadian corporation, we comply with PIPEDA for the collection, use, and disclosure of personal information in the course of commercial activities. That includes obtaining meaningful consent where required, limiting collection to necessary purposes, ensuring accuracy, implementing safeguards, and providing access upon request.
7. Changes to This Privacy Policy
We may update this policy to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy with a new effective date. Review it periodically.
8. Accessibility
We are committed to making our privacy practices accessible. If you need this Privacy Policy in an alternative format, please contact us.
9. Contact
If you have questions about this Privacy Policy or our privacy practices, contact our Privacy Officer:
Mike Kirkup
Kirkup Inc
Waterloo, Ontario, Canada
Email: privacy@claraday.ai
General inquiries: hello@claraday.ai
10. Additional Provisions for European Data
"Controller" means the natural or legal person which, alone or jointly with others, determines the purposes and means of the Processing of personal information.
"European Data" means personal information that is subject to the protection of European Data Protection Laws.
"European Data Protection Laws" means data protection laws applicable in Europe, including: (i) Regulation 2016/679 (General Data Protection Regulation) ("GDPR"); (ii) Directive 2002/58/EC; (iii) applicable national implementations of (i) and (ii); or, in respect of the United Kingdom, any applicable national legislation that replaces or converts in domestic law the GDPR or any other law relating to data and privacy as a consequence of the United Kingdom leaving the European Union; and (iv) Swiss Federal Act on Data Protection of 25 September 2020 and its Ordinance; in each case as may be amended, superseded or replaced.
"Processing" means any operation performed on personal information, encompassing collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, restriction, or erasure. "Process", "Processes" and "Processed" will be construed accordingly.
"Processor" means a natural or legal person which Processes personal information on behalf of the Controller.
"Standard Contractual Clauses" means the standard contractual clauses for Processors approved pursuant to the European Commission's decision (C(2010)593) of 5 February 2010, as may be amended, superseded or replaced.
This section applies only with respect to European Data.
When Processing European Data for the Services or in accordance with your instructions, the parties acknowledge that you (the Customer) are the Controller of European Data relating to your clients and jobs, and Kirkup Inc is the Processor. Kirkup Inc is the Controller of account and billing records it maintains about the Customer and Authorized Users for its own operations.
Kirkup Inc agrees to abide by and process European Data in compliance with the Standard Contractual Clauses. For the descriptions in those clauses, Kirkup Inc will be deemed the "data importer" and you the "data exporter" (notwithstanding that you may be located outside Europe). If the Standard Contractual Clauses conflict with this Privacy Policy, the Standard Contractual Clauses prevail to the extent of the conflict.
11. Additional Provisions for California Personal Information
This section applies only with respect to personal information subject to California law.
When processing California personal information for the Services and/or in accordance with your instructions, Kirkup Inc is a Service Provider for the purposes of the CCPA. Kirkup Inc will Process California personal information as a Service Provider strictly for performing the Services under your agreement with Kirkup Inc (including the Terms of Use) or as otherwise permitted by the CCPA.