Privacy notice.

Accountability

DataMCP LLC is responsible for personal information under its control, including information processed by contracted service providers. Privacy questions, access or correction requests, consent withdrawals, and deletion requests may be sent to [email protected]. Business correspondence: 30 N Gould St Ste R, Sheridan, WY 82801, United States.

What we collect

Customer records may include account and verification data, repair descriptions, equipment information, service location, contact information, messages, request history, consent records, payment status, photos, audio, transcripts, and call metadata. Provider records may include business identity, owner or representative contact information, service coverage, repair scope, phone verification, licences, certificates, municipal permissions, insurance, WorkSafeBC status, supporting documents, review decisions, and acceptance records. We do not ask providers to upload a SIN, banking credentials, customer files, or unrelated identity documents.

Purposes

We use information to create and secure accounts; organize and verify repair requests; assess provider eligibility; confirm business, insurance, municipal, worker-safety, and regulated-trade records; match requests; process payments; provide private communications; prevent fraud and abuse; resolve disputes; maintain audit evidence; comply with law; and measure service performance. We limit collection, use, and disclosure to identified purposes a reasonable person would consider appropriate.

Provider-document verification

Immediately before upload, providers are told what is collected, why, who may receive it, and how long it is retained. Required checkboxes record accuracy, authorization to verify with the issuer or relevant registry, and acknowledgement of this notice. These choices are not preselected. Identity verification should use a verification provider where available so Local Fix Match can retain the result rather than a government-ID image.

Sharing and processing locations

Authorized Local Fix Match reviewers and contracted payment, authentication, email, telephony, mapping, AI, analytics, security, and private-storage providers receive only information needed for their function. An approved provider receives customer information only when authorized for the specific request. Information may be processed outside Canada, including in the United States. DataMCP LLC remains accountable and uses contractual, technical, and organizational safeguards. Public authorities may lawfully access information under the laws of the processing jurisdiction.

Photos, documents, calls, and analytics

Customer photos are optional and are resized, converted, and stripped of embedded metadata before private storage. Provider compliance documents are stored privately without public URLs and are not sent to PostHog. Calls are recorded only after applicable notice and consent. Retell may process intake and confirmation calls, recordings, transcripts, analyses, and call metadata. Twilio may process proxy-call resources, recordings, and call metadata. Optional PostHog analytics remain disabled until allowed; autocapture and session replay are disabled, and repair text, documents, photos, audio, addresses, names, email, phone, and postal codes are excluded.

Retention

Unsubmitted photo uploads are removed after 24 hours. Eligible account and request data is deleted or anonymized when an account is deleted. Account deletion does not delete Retell call data, recordings, transcripts, or analyses, or Twilio call and recording resources. We retain those call records for request verification, service coordination, safety, fraud prevention, dispute handling, and audit purposes for up to 12 months from the call, then schedule the corresponding Retell and Twilio resources for deletion. Related customer and request details are minimized or detached where they are no longer required. Rejected or abandoned provider documents are scheduled for deletion 90 days after the review or appeal period. Raw identity images, if exceptionally collected, are scheduled for deletion within 30 days after verification. Verified business, licence, and insurance evidence is kept while the provider relationship is active and normally up to two years afterward, unless a shorter expiry or longer legal requirement applies.

Safeguards and incidents

Safeguards include role-based access, private object storage, encryption in transit and at rest, short-lived access paths, file-type and size validation, audit logs, environment separation, restricted credentials, and deletion procedures. No system is risk-free. We investigate incidents, retain required breach records, and notify affected people and regulators where applicable law requires it.

Your choices and rights

You may request access to or correction of personal information, ask how it has been used or disclosed, withdraw consent subject to legal and contractual limits, and request deletion. We may need to retain limited information for fraud prevention, payment, tax, dispute, audit, safety, or legal obligations. Operational messages necessary to provide or secure the service are separate from marketing consent.

Changes and complaints

Material changes will be dated and, where necessary, presented for renewed consent. Complaints should first be sent to the privacy officer. Depending on the circumstances, you may also contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.