Privacy policy

Some details are being finalised. Last updated: November 11, 2026.

Customakr is operated by Solid Fix Home Services, a business name of Hillman Reid Premium Skin and Hair Care Inc. In this policy, "Customakr", "we" and "us" mean the operator of Customakr. "Workshop" means a business account in the app. "You" means a person who uses Customakr.

Contact and accountability

Our Privacy Officer is responsible for how we handle personal information. For questions, requests or complaints, write to:

Privacy Officer, Solid Fix Home Services, 2880 Queen Street East, Suite 210, Brampton ON L6S 6E8, Canada. Email: support@customakr.com.

The Privacy Officer is also the person in charge of the protection of personal information for the purposes of Quebec law.

Our role

• For your account, subscription, support requests and usage statistics, we decide how the data is used. Under the EU and UK GDPR we are the controller.
• For the business data a workshop keeps in Customakr (its customers, contacts, employees, quotes, invoices, files and records), the workshop decides what is collected and why. We store and process it only to run the service for that workshop. Under the GDPR we act as its processor; under California law, as its service provider.
• If you are a customer, employee or contact of a workshop and want to see, correct or delete your information, please contact that workshop first. We will help the workshop answer you.

What we collect

• Account: email address and password (stored as a hash by our authentication provider), your display name if you add one, and the workshops you belong to and your role in each.
• Account emails: we email you to confirm your address and reset your password. If someone invites you to a workshop, we email you the invitation, with their email address and the workshop's name.
• Business data you enter: company details, rates, machines, materials, suppliers, customers, quotes, work orders, invoices, payments recorded, job costs, stock, and approval records. A log records who changed what in the workshop, and when.
• Files you upload: logos, attachments, photos you take or choose to keep with a quote, and (Team plan) 3D models you attach to a work order. The app uses the camera and photo library only when you tap to add a photo.
• Contact lists you import or type: names (first, last and preferred), companies, roles and job titles, departments, account numbers, emails, phone numbers, postal addresses (street, unit, city, province or state, postal code and country) and notes for your customers, vendors, employees, machine service and facility maintenance contacts; for suppliers also payment terms, how you order, opening hours, and pickup and delivery instructions and contacts. A CSV file you choose is read on your device, and only the rows you confirm are saved, to your own workshop. They are stored for your workshop only, included in your data export, deleted with your workshop, and never used for analytics, marketing or advertising.
• Capacity planning (if a workshop uses it): for each employee the workshop adds, weekly hours, work days, departments, an optional hourly cost, and time off with any note. For machines: hours, status and maintenance records.
• Your customers' responses: when a customer opens an approval link we record the view. When they respond to a quote, drawing or change order, we record the name they type, their comment, the time, their browser description, and a salted hash of their network address.
• Customers of a shop's ordering page: the file they upload (a 3D model, or a drawing, CAD file or image), the name, email, company and notes they enter, and a salted hash of their network address. This goes to that shop, which is responsible for how it uses it.
• Subscription status: plan, status, expiry, store and product, from Apple or Google through RevenueCat. RevenueCat links the purchase to an identifier for your workshop. We never receive card details.
• Card payments (if you turn them on): your business connects its own Stripe account. To create it we send Stripe your email address, your country and an identifier for your workshop. Stripe then collects your identity and bank details, and your customers' card details; we never see or store them. We record the invoice, the amount paid, our platform fee and Stripe's payment reference.
• Tap to Pay (if you turn it on): we send Stripe the address where you take payments. Stripe uses your phone's location while a payment is taken, to prevent fraud. We record the same payment details as for card payments.
• Location: the country and region you choose at setup. The app does not use your device's location in this version, except as Stripe requires during a Tap to Pay payment.
• Notification emails: if you are a workshop owner or admin, we email you when a customer responds, pays or sends a request, and when a new device waits for your approval. Team members are emailed about quote approvals. You can turn these alerts off in Settings. We send nothing to your customers or to addresses typed into public forms, except payment reminders below.
• Payment reminders (only if a workshop turns them on): we email that workshop's customer at the email address the workshop saved for them, on the workshop's behalf, about a sent and unpaid invoice: up to three emails, 3 days before the due date, on it and 7 days after, and none more than 30 days after it. The email shows the workshop's name and contact details, the invoice number, description, amount and due date, and may include a card payment link. We record which reminders were sent and when. The workshop decides whether reminders are sent and can stop them for any invoice; it is responsible for having the right to email its customers. Customers who do not want reminders should contact the workshop.
• Usage statistics: which screens and features of the app are used and when, with the app version, device type, plan, language, country and units. They are tied to a random number made on your device, not to your account or workshop, and never include your customers or their contact details, the contents of quotes, invoices or work orders, prices, costs or sales figures. When you add a custom material, its name and category are counted so we can fill gaps in the standard library. You can switch usage statistics off in Settings, Account and Data.
• Bug reports: what you write, your email, and technical details shown on the form before you send it (app version, platform, screen, language, plan). No quotes, customers or prices are attached.
• Links you send to employees (Pro and Team): the employee's email and a copy of the work order or estimate you chose to share; whether and how often it was opened.
• Access and Devices (Team workshops whose owner turns it on): for each device a member uses: the name the app gives it (such as "iPhone" or "Chrome on Windows"), its platform, when it was registered, approved and last seen, the network address it last used, and a hash of a random key the app creates on that device (not a hardware or advertising identifier). The shop's network addresses the owner adds. Refused attempts and, on iPhone and iPad, screenshots the device noticed (who, when and which screen), with a keyed hash of the network address. Owners and admins of that workshop can see these records; we use them only to enforce the owner's rules. When screen protection is on, the person's email is shown faintly over the app's screens on their own device. Nothing is collected for this until an owner turns a rule on.
• Language and currency: the language, units and currency you choose. When you ask for an exchange rate, we request it from Stripe; no personal data is sent.
• Support messages and suggestions: your email and what you send us, including feature suggestions, which are linked to your workshop.
• Network address: our servers see the network (IP) address of each request. To limit abuse of public pages and forms, we keep a salted hash of it, never the address itself, for up to one day.

We do not use advertising identifiers, third-party advertising or cross-app tracking. The website and the web app do not use advertising or analytics cookies. They keep your sign-in session and app settings in your browser's storage.

Time clock

If a workshop uses the time clock, we record who worked (their account), on which job and operation, and when they started and stopped, taken from our server's clock, with any note they add. Corrections by an owner or admin keep the time before and after, who made the change and why. Everyone in the workshop can see the hours on its jobs; only owners and admins correct or remove entries. The hours are used to track work against quotes, each person's scheduled week and capacity and, on the Team plan, each job's live profit, which also uses the hourly cost the workshop entered for that person. This is the workshop's data: the workshop decides who uses the time clock and is responsible for telling its employees. Time entries are kept until an owner or admin removes them, the job is deleted, or the workshop is deleted; they stay when a person leaves the workshop, because the hours were worked on its jobs. They are included in the workshop's data export and are never used for analytics, marketing or advertising.

How we use it, and our legal bases

• To provide the service you or your workshop signed up for: storing your data, calculating quotes, producing PDFs, sending the emails described above, checking files sent through an ordering page, showing your plan, and taking card payments if you turn them on. Legal basis: performance of our contract with you or your workshop.
• To keep the service secure and prevent abuse, for example rate limits and the workshop owner's Access and Devices rules. Legal basis: our legitimate interest, and the workshop's, in protecting accounts and data.
• To answer support requests and bug reports. Legal basis: our contract with you and our legitimate interest in fixing problems.
• To improve the app using usage statistics, only in aggregate. Legal basis: our legitimate interest in improving the product. You can switch them off at any time.
• To meet legal obligations, such as tax records and answering lawful requests.

We do not sell personal information or share it for cross-context behavioural advertising. We do not show ads, and we do not use your data or your customers' data to market to them. We do not make decisions about people based solely on automated processing.

Consent

By creating an account you agree to the uses described here. Optional features (usage statistics, card payments, Tap to Pay, payment reminders, notification emails, Access and Devices) can be turned on or off in Settings. Access and Devices, which can identify a person's device and network, is off until a workshop owner turns it on. You can withdraw consent at any time, subject to legal or contractual limits; some features will then stop working.

Your models and quotes

Slicer files, resin print files, G-code and other machine programs, DXF drawings, and models you open to measure or view in the app are read on your device and are not uploaded. On the Team plan, a 3D model you attach to a work order is uploaded and stored privately for your workshop, so the people in your workshop can open it; it is kept until you remove it or delete the quote, and is not shared with anyone outside your workshop. In the app without an account, attached models stay on your device. Models uploaded through an ordering page are measured on our servers to give an estimate. They are not sliced or turned into production files, and are not shared with anyone without your explicit authorisation. Your quotes and costs are not shared with other businesses or added to any market data.

Who processes data for us

These service providers process personal information on our behalf, only to provide their service to us:

• Supabase: database, sign-in, file storage and server functions.
• Amazon Web Services: hosting of the website and web app (Amazon S3 and CloudFront), domain name service (Route 53), and email we send (Amazon SES), in the US East (N. Virginia) region.
• Stripe: card payments, Tap to Pay and exchange rates. For card payments, each workshop also has its own agreement with Stripe.
• RevenueCat: subscription status from the app stores.
• Apple and Google: app distribution and subscription billing, under their own privacy policies.
• ImprovMX: forwards email sent to @customakr.com addresses, including support@customakr.com, to our mailbox, which is hosted by Google (Gmail).

Where data is stored

Our main database and files are stored by Supabase in [Supabase region to be confirmed]. Website hosting and our email service are in the United States. Our providers may process data in other countries where they or their sub-processors operate, including the United States. Data stored outside Canada, or outside your country, may be accessible to the courts and authorities of that country. Where the EU or UK GDPR applies, transfers rely on an adequacy decision or on our providers' data processing terms, including standard contractual clauses.

How long we keep it

• Account and workshop data: until you delete it or delete your account. If you are the only member of a workshop, the workshop is deleted with your account.
• Models uploaded in the app for measuring: deleted 90 days after upload, or sooner when you delete them.
• Models attached to work orders (Team): kept until you remove the model or delete the quote; the file is then deleted by the next daily clean-up.
• Ordering-page uploads: deleted after 24 hours if the request is never sent. Files sent with a request are deleted 90 days after it is sent. The request itself (name, email, company, notes) stays with the workshop until the workshop deletes it or is deleted.
• Usage statistics: 13 months, then deleted.
• Employee links: a link stops working when it expires (30 days by default) or is revoked. The link record and its copy of the work order or estimate are kept with the quote until you delete the quote or the workshop.
• Access and Devices: a person's devices and permissions are deleted when they leave the workshop. Networks, devices and the activity log are deleted with the workshop.
• Hashed network addresses for abuse limits: up to one day.
• Support messages and bug reports: [retention period to be decided].
• Account deletion requests: when a deletion completes, the email address and account identifier are removed from our record of the request.
• Backups: [N] days. Deleted data can remain in backups until they roll off.

Your choices and rights

• Export: Settings, Account and Data, Export My Data, gives your workshop's records as a file.
• Correct: you can change most information directly in the app.
• Delete: in the app (Settings, Account and Data, Delete My Account), or at customakr.com/delete-account. If others share your workshop, the workshop stays and you are removed from it; if you were its owner, the longest-standing member becomes owner. Store purchase records stay with Apple or Google, and a Stripe account stays with Stripe under its terms. Deleting your account does not cancel a store subscription: cancel it in your Apple or Google account.
• Usage statistics: switch them off in Settings, Account and Data. Because they are not linked to you, we cannot find or delete past statistics for one person; they are deleted after 13 months.
• Notification emails: turn them off in Settings, Account and Data.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict some uses, to withdraw consent, and to have a decision reviewed. This includes rights under Canada's PIPEDA, Quebec's Act respecting the protection of personal information in the private sector, the EU and UK GDPR, and California's CCPA as amended by the CPRA. To make a request, email support@customakr.com. We may need to confirm your identity. We answer within 30 days, or sooner where the law requires. We will not treat you differently for using your rights. You may use an authorised agent where the law allows.

California: in the last 12 months we collected the categories listed above: identifiers (such as email and network address hashes), customer records, commercial information (subscriptions and payments recorded), internet activity (usage statistics), and professional information a workshop enters. We collect them for the purposes above, disclose them only to the service providers listed, and do not sell or share them.

Complaints

If you are not satisfied with our answer, you can complain to a regulator: in Canada, the Office of the Privacy Commissioner of Canada (priv.gc.ca); in Quebec, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca); in the EU, your local data protection authority; in the UK, the Information Commissioner's Office (ico.org.uk). We would like the chance to fix the problem first.

Security

Data is separated per workshop with database row-level security, encrypted in transit, and stored with Supabase's encryption at rest. Approval, employee and invitation links use random tokens stored only as hashes. Access within our company is limited to people who need it to run the service.

If a security incident affects personal information, we assess it promptly, keep a record of it, and take steps to reduce harm. Where there is a real risk of significant harm, we notify the people affected and the Office of the Privacy Commissioner of Canada and, for Quebec residents, the Commission d'accès à l'information. Where the GDPR applies and we are the controller, we notify the supervisory authority within 72 hours where required. Where we process data for a workshop, we tell the workshop without undue delay.

Children

Customakr is a business app. It is not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

Changes

We will post changes here and update the date above. If a change is significant, we will tell you in the app or by email before it takes effect.