Draft for legal review. Fill in the hosting details in site/config.json and have a lawyer review this policy before launch, then remove this note.
The short version
- Employers put their staff’s payroll information into Smart Punch. The employer is responsible for that information, and we handle it only on their instructions.
- We don’t sell personal information, show ads, or use tracking or analytics tools.
- SINs and bank account numbers are encrypted. Time clock location checks keep only the result, never where someone was.
- Questions or requests: the form on our Contact page.
1. Who we are and what this covers
Kelnova Labs (“we”, “us”) makes the Smart Punch website and app. Our Privacy Officer is responsible for how we handle personal information and can be reached at the form on our Contact page or Kelowna, British Columbia.
This policy covers two situations:
- Information we are responsible for: people who visit our website or contact us, and the account details of owners, managers and staff who sign in to Smart Punch.
- Information we handle for employers: the employee and payroll information a business enters into Smart Punch. The business is the organization responsible for it under privacy law. We act as its service provider and follow our Data Processing Agreement. If you are an employee, please contact your employer first about your payroll information. We’ll help them respond.
2. What we collect
When you visit our website or contact us
- What you put in the demo or contact form: your name, business name, email, phone number, team size, pay schedule, current payroll tool and message, and whether you want to receive Smart Punch news.
- Your IP address, which our servers use to deliver pages, stop spam and keep the service secure.
The website does not use analytics, advertising or tracking cookies, and does not load anything from other companies.
When you use the Smart Punch app
- Account details: name, email address, role (owner, manager or staff) and a scrambled form of your password (we never store the password itself).
- Sign-in records: the time, the email used, whether it worked, and the IP address, to protect accounts and investigate problems.
- Employee information entered by employers: name, contact details, home address and province, date of birth, Social Insurance Number, job title and role, hire and end dates, pay rates, TD1 tax claims, bank account details for direct deposit, and year-to-date payroll figures.
- Work records: schedules, availability, clock-in and clock-out times, breaks, the role worked, time-off requests, tips, pay stubs, T4 slips and Records of Employment.
- Time clock checks: if an employer turns on “only at work”, the phone may share its location when someone clocks in. We use it once to work out the distance from the business, then discard it. We keep only how the clock-in was checked and the distance, for example “45 m from work”. If a phone is on the employer’s saved Wi-Fi, we compare the internet address the request came from with the saved network, and don’t ask for location at all.
- Assistant requests: if someone uses the optional Ask Smart Punch assistant (owners, managers and staff can), the requests they type, the answers, and any change it prepared for them to confirm, such as a time-off request or a message. Prepared changes that are never confirmed expire after 30 minutes and are deleted after 30 days.
3. How we use it
- To provide Smart Punch: scheduling, time tracking, payroll calculations, pay stubs, bank files and government forms.
- To keep accounts and data secure, including locking accounts after repeated wrong passwords and keeping audit records.
- To provide support, including helping with sign-in problems after confirming who we’re talking to.
- To reply to demo and quote requests. If you ticked the box, to send occasional news about Smart Punch. Every message has an unsubscribe link, as Canada’s anti-spam law requires.
- To meet legal obligations.
We do not sell personal information, use it for advertising, or use employee information for any purpose other than providing Smart Punch to the employer.
4. Consent
We collect information from website visitors and account holders with their consent, which you give by filling in a form or creating an account. Employers are responsible for giving their employees notice about collecting and using their information for employment and payroll, as PIPA allows. You can withdraw consent to optional uses, such as Smart Punch news, at any time.
5. Who we share it with
We share personal information only with service providers who help us run Smart Punch, under contracts that require them to protect it and use it only for us:
| Provider | What they do | Where |
|---|---|---|
| our hosting provider | Hosts the Smart Punch servers, database and backups | the region we confirm in writing on request |
| xAI LLC (Grok), only when the owner turns the optional assistant model on | Provides the AI model behind the optional assistant. It receives what people type into the assistant and the details needed to act on it (such as names, roles, hourly rates, availability, shifts, time off and pay totals — for staff, only their own), but never SINs, addresses, contact details or bank details | United States |
We may also disclose information when the law requires it, to protect the safety or security of people or the service, or as part of selling or reorganizing our business, in which case the buyer must protect it as this policy says.
Smart Punch creates files for your bank, the Canada Revenue Agency and Service Canada. We don’t send them anywhere. You download them and send them yourself.
6. Information stored outside Canada
Where a service provider is outside Canada, information may be accessible to the courts, law enforcement and national security authorities of that country. If you have questions about our providers outside Canada, contact our Privacy Officer.
7. How long we keep it
- Employer and employee data: while the employer’s account is open. After an account closes, the employer can export its data for 60 days. We then delete it within a further 30 days, and backups expire within 30 days after that. Employers must keep their own copies of payroll records for as long as the law requires.
- Sign-in records: up to 2 years.
- Demo and contact requests: up to 2 years after our last contact, unless you become a customer.
- News subscriptions: until you unsubscribe.
8. How we protect it
Our safeguards include encryption of SINs and bank account numbers with AES-256-GCM, HTTPS for all connections, passwords stored with bcrypt, account lockouts, separate accounts with two-step sign-in for our own support staff, access limited by role, audit logs, and daily backups. Our support staff can’t see payroll data in their console. See our Security page for more detail.
If a breach of security safeguards creates a real risk of significant harm, we will notify the affected employers promptly, and we will notify individuals and regulators where the law requires.
9. Your rights
You can ask to see the personal information we hold about you, ask how it has been used and disclosed, and ask us to correct it. Email the form on our Contact page. We’ll respond within 30 days, or tell you if we need more time and why, as the law allows. We may need to confirm your identity first.
If your request is about payroll information your employer entered, we’ll direct it to your employer and help them respond.
If you’re not satisfied with our response, you can contact the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).
10. Young workers
Smart Punch is a tool for employers and isn’t directed at children. Employers may enter information about employees who are under 19, as BC law allows them to employ young people. The employer is responsible for that information, and for any permissions the law requires.
11. Cookies
We use only the cookies needed to keep you signed in. See our Cookie Policy.
12. Changes to this policy
We’ll post any changes here and update the date at the top. For significant changes, we’ll also tell account owners by email or in the app before they take effect.
Contact our Privacy Officer
Kelnova Labs, Attention: Privacy Officer, Kelowna, British Columbia. Email the form on our Contact page.