Privacy Policy

LaviScanIQ (“LaviScanIQ,” “Company,” “we,” “our,” or “us”) operates a QR-code-based service identification, tracking, verification, recordkeeping, and documentation platform (collectively, the “Services”).

Our head office is located in Waterloo, Ontario, Canada. We are committed to protecting the privacy and personal information of all individuals who interact with our Services in accordance with applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

This Privacy Policy applies to personal information collected, used, disclosed, or otherwise processed by LaviScanIQ in connection with:

• Our website and web application;
• Our mobile applications;
• Our QR code services and associated scanning interfaces;
• Customer accounts and dashboards;
• Registered user (cleaner/worker) accounts;
• Guest and public-facing QR scan views;
• Communications with LaviScanIQ;
• Any other interactions with our Services.

This Policy does not apply to the privacy practices of third-party websites or services linked from our platform. We encourage you to review the privacy policies of those third parties directly.

We may collect the following categories of information:

Account Information

• Name;
• Email address;
• Password (stored in encrypted form);
• Role (e.g., company administrator, cleaner, building operator);
• Company or organization name;
• Billing and payment information (processed via Stripe).

Service Record Information

• QR code identifiers and associated space or location names;
• Service completion records (date, time, user);
• Cleaning and maintenance event logs;
• Notes or photographs uploaded by authorized users;
• Assignment and scheduling data.

Technical and Usage Information

• IP address;
• Browser type and version;
• Device type and operating system;
• Pages visited and features used;
• Timestamps of access;
• Referring URLs;
• Log files and diagnostic data.

Communications

• Messages and inquiries submitted to us;
• Email correspondence;
• Support requests;
• Feedback and survey responses.

We collect personal information through the following means:

• Directly from you — when you register for an account, complete onboarding, enter service records, invite users, or contact us;
• From your employer or company administrator — when you are invited to the platform as a registered user (e.g., a cleaner or building operator);
• Automatically — through cookies, server logs, and similar technologies when you use our Services;
• From third-party providers — such as Firebase (authentication and database), Stripe (payment processing), and Google (location autocomplete).

Where personal information is collected by a Customer on behalf of their organization and submitted to our Services, the Customer is responsible for ensuring they have the appropriate authority or consent to do so.

We use the information we collect for the following purposes:

• To create, authenticate, and manage user accounts;
• To provide, operate, and maintain the Services;
• To generate and manage QR codes and associated service records;
• To send invitation emails to new users on behalf of Customers;
• To send service and cleaning notification emails;
• To process subscription payments through Stripe;
• To respond to inquiries and provide customer support;
• To monitor and improve platform performance and security;
• To detect, prevent, and investigate fraud or misuse;
• To comply with legal obligations;
• To send transactional emails related to account activity, including onboarding completion, QR code assignments, and space notifications.

We do not use your personal information for advertising, behavioral profiling, or sale to third parties.

Where applicable law requires a legal basis for processing personal information, we rely on the following:

• Contractual necessity — processing required to provide the Services under our Terms and Conditions;
• Consent — where you have expressly agreed, such as accepting an invitation to join the platform;
• Legitimate interests — for security monitoring, fraud prevention, and platform improvement;
• Legal obligation — where processing is required by applicable law.

For Canadian residents, we collect personal information only for purposes that a reasonable person would consider appropriate in the circumstances, in accordance with PIPEDA.

We do not sell, rent, or trade your personal information. We may share your information in the following limited circumstances:

Within Your Organization

Information associated with a Customer account is accessible to authorized administrators of that account as configured by the Customer.

Service Providers

• Firebase (Google LLC) — authentication, database hosting, and cloud functions;
• Stripe, Inc. — payment processing and subscription management;
• Google APIs — location autocomplete services;
• Email delivery services used to send transactional notifications.

These providers are authorized to use your information only as necessary to provide services to us and are bound by confidentiality obligations.

Legal Requirements

We may disclose personal information if required to do so by law, court order, regulatory authority, or to protect the rights, property, or safety of LaviScanIQ, our users, or the public.

Our platform allows Customers to assign QR codes to physical spaces (e.g., washrooms, rooms, or facilities). When a QR code is scanned by a member of the public, certain information may be displayed publicly.

This may include:

• Last service date and time;
• General service status;
• Space or location name;
• Other information designated by the Customer.

The Customer is solely responsible for determining what information is publicly visible and for ensuring that such disclosure complies with applicable privacy laws, including obligations relating to worker privacy and employee data.

LaviScanIQ does not control what Customers choose to make publicly visible and is not responsible for Customer decisions regarding public information display.

We use cookies and similar technologies to operate and improve our Services. These may include:

• Essential cookies — required for authentication and core platform functionality;
• Performance cookies — to understand how users interact with the platform;
• Functional cookies — to remember preferences and session state.

You may control cookie settings through your browser. Disabling essential cookies may prevent certain features of the Services from functioning properly. We do not use cookies for advertising or cross-site behavioral tracking.

We retain personal information for as long as necessary to:

• Provide the Services and fulfill contractual obligations;
• Comply with applicable legal and regulatory requirements;
• Resolve disputes and enforce our agreements;
• Maintain accurate business and audit records.

When an account is terminated or a subscription expires, we may retain certain information for a reasonable period as permitted or required by law before deletion or anonymization.

Customers are responsible for maintaining their own independent backups of records. LaviScanIQ does not guarantee the availability or restoration of data following account termination.

We implement commercially reasonable technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• Encrypted data transmission (TLS/HTTPS);
• Firebase Authentication for secure identity management;
• Role-based access controls limiting data access by function;
• Firestore security rules restricting unauthorized data access;
• Stripe-managed payment processing with PCI DSS compliance.

However, no method of transmission or storage is completely secure. LaviScanIQ cannot guarantee absolute security and is not responsible for unauthorized access resulting from factors outside our reasonable control, including user credential misuse, phishing, or device compromise.

Subject to applicable law, you may have the following rights with respect to your personal information:

• Access — request a copy of the personal information we hold about you;
• Correction — request that inaccurate or incomplete information be corrected;
• Withdrawal of consent — where processing is based on consent, withdraw that consent at any time;
• Deletion — request deletion of your personal information, subject to legal retention requirements;
• Complaint — lodge a complaint with the applicable privacy authority (e.g., the Office of the Privacy Commissioner of Canada).

To exercise any of these rights, please contact us at the information provided in Section 16. We will respond within the timeframe required by applicable law.

The Services are not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from minors. If you believe that a minor has provided us with personal information without appropriate consent, please contact us and we will take steps to remove that information promptly.

Our Services rely on third-party infrastructure, including Firebase and Stripe, whose servers may be located outside of Canada (including in the United States). By using our Services, you acknowledge that your personal information may be transferred to, stored in, and processed in jurisdictions outside your country of residence.

We take reasonable steps to ensure that such transfers are conducted in accordance with applicable privacy laws and that appropriate protections are in place, including contractual safeguards with our service providers.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

Updated versions of this Policy will be posted to our website or platform with a revised effective date. Where changes are material, we will take reasonable steps to notify affected users.

Continued use of the Services following the posting of an updated Privacy Policy constitutes your acceptance of the revised Policy.