Privacy Policy

1. Who we are

AfterHours is operated by Canada Horizon, 2921 Peter Street, Windsor, ON, Canada ("we", "us"). We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and its fair information principles. Our privacy officer, Jalaluddin Helal, is accountable for our compliance and can be reached at support@getafterhours.ca or (226) 787-7351.

AfterHours serves two groups. Business owners (trades and service shops) hold accounts. Customers of those businesses contact them through a missed call, a text or a public request form. For customer information, the business is the organization in control of it, and we process it on the business's behalf to provide the service. We are responsible for owner account information.

2. What we collect

From business owners: name, email address, password (stored only as a one-way hash), business name, trade, phone and forwarding numbers, business hours, timezone, closed days, team members and technician details, settings, and billing and payment records (invoices and payment status; card details are handled by the payment processor, not stored by us).

From customers of a business: name, phone number, optional email, service type, the description of the problem, preferred contact method, call and text history with the business (including the content of texts and, where a caller leaves one, voicemail or call details), job, invoice and payment records, and a consent record (the time, the exact consent wording shown, the source, and the IP address).

Automatically: IP address, browser type, and request logs used for security, rate limiting and troubleshooting, and a sign-in session cookie.

3. Why we collect it, and consent

We use personal information only to: run the after-hours answering service (capture a request, reply to the customer, alert the owner or on-call technician, and support follow-up, jobs, invoices and payments); keep accounts secure and prevent spam and abuse; keep records that the law requires, such as consent records under Canada's Anti-Spam Legislation (CASL); and provide support. We do not sell personal information and do not use it for third-party advertising.

We rely on consent. Owners consent when they create an account. Customers give express consent by checking the consent box on a business's public request form, and implied consent when they call or text a business and receive a reply to their own inquiry. You may withdraw consent at any time (see "Texts and STOP"), subject to legal or contractual limits; withdrawing may mean the business cannot respond to you by text.

4. Service providers (processors)

We share personal information only with providers that help us run AfterHours, under contracts that limit their use of it to providing services to us and require appropriate safeguards:

Hosting and database (application hosting and a managed PostgreSQL database), which stores all account, lead and message records. Twilio, which carries text messages and phone calls. Resend (or an equivalent email provider), which delivers email alerts, password resets and notices. A payment processor, when a business takes card payments through AfterHours.

We may also disclose information when the law requires it, or to protect the safety of a person.

5. Where your data is stored, and cross-border transfers

Our application is hosted by Render and our database is hosted by Neon (Postgres) in the AWS us-east-2 region in Ohio, United States. Our texting and calling provider (Twilio), email provider (Resend) and AI provider (xAI) are also based in the United States and may process data there or in other countries, for example to route a text or deliver an email. Information processed outside Canada is subject to the laws of that country and may be accessed by its courts, law enforcement and national security authorities. We will list current providers and their locations on request.

6. Retention and deletion

We keep owner account information while the account is open. After an account is closed, we delete or anonymize its data, including its customers' leads and messages, within 90 days, except where we must keep it longer: consent and unsubscribe records (kept for as long as needed to show compliance with CASL, which can be several years), invoices and financial records (kept as tax law requires, generally six years in Canada), and our database provider's point-in-time recovery history (which expires automatically on the provider's rolling schedule, currently a matter of days). Business owners can delete individual leads at any time and should do so when a customer asks.

7. Access, correction and complaints

You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it. Email support@getafterhours.ca with "Privacy request" in the subject. We will verify your identity and reply within 30 days. If you are a customer of a business that uses AfterHours, you can also ask the business directly; we will help it respond.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

8. Security and breach notification

We protect information with encryption in transit (HTTPS), encryption at rest by our database provider, hashed passwords, encrypted stored credentials, access limited by business account, rate limiting, and audit logging. No system is perfectly secure.

If a breach of security safeguards creates a real risk of significant harm to anyone, we will report it to the Office of the Privacy Commissioner of Canada and notify affected people and businesses as soon as feasible, as PIPEDA requires. We keep a record of every breach for at least 24 months.

9. Cookies

We use only the cookies needed to run the service: a secure sign-in session cookie, and short-lived cookies for security and spam protection (for example, a Cloudflare Turnstile check on public forms, if enabled). We do not use advertising or cross-site tracking cookies. Blocking cookies will prevent sign-in.

10. Texts and STOP

Every text AfterHours sends identifies the business and includes "Reply STOP to unsubscribe." Replying STOP, STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT opts your number out right away; CASL requires this within 10 business days, and we do it immediately. Reply START to opt back in. Carrier message and data rates may apply. See our texting rules.

11. Children

AfterHours is a business service and is not directed to children under 16.

12. Changes to this policy

We may update this policy. We will post the new version here with a new date and, for significant changes, notify account owners by email before the changes take effect.