Privacy Policy

1. About This Policy and Who It Covers

Fiable Technologies (“we”, “us”, “our”) provides Trizelo, a cloud-based workforce-management platform. This Policy explains how we handle personal information in connection with Trizelo.

It covers: individuals invited to use Trizelo by an employer or organization that subscribes to it (a “Customer”), including employees, managers and administrators; people who contact us for support or sales; and visitors to our website.

This Policy does not itself request your consent. Where the law requires consent for a specific activity — for example, promotional messages — we ask for it separately and you may withdraw it at any time. We do not treat your use of Trizelo as consent to everything described here, because your use of a workplace system chosen by your employer is not a free choice. Most of our handling of workforce information rests on the employment relationship between you and your Customer, and on our contract with that Customer, rather than on your consent.

2. Our Role: Employer-Controlled Data and Our Own Data

Our obligations depend on which information is involved. Read this section before Section 12, because it determines who answers your request.

An important point for Australian users: the employee records exemption in section 7B(3) of the Privacy Act 1988 (Cth) applies to acts done by an employer in relation to its own current or former employees’ records. It does not extend to us as a third-party provider. We comply with the Australian Privacy Principles in respect of workforce information we handle, whether or not your employer is required to.

3. Laws That Apply

Our grounds for handling information. We handle personal information because it is necessary to perform our contract with the Customer and to provide the Service; because we have a legitimate interest in securing the platform, preventing fraud and improving reliability, balanced against your rights; because a law obliges us to (tax, employment, lawful requests); or, for a narrow set of optional activities, because you have given consent that you may withdraw.

We currently serve Customers in Canada and Australia only. We do not serve the European Economic Area, the United Kingdom, or the United States (as a market — some of our own service providers are located there; see Section 7), and this Policy does not make representations under the GDPR, UK GDPR or CCPA/CPRA. If that changes, this Policy will be updated before any such user is onboarded.

4. Personal Information We Collect

5. Why We Use It

• To run the Service. Create and authenticate accounts, apply role-based permissions, build and publish schedules, record attendance, calculate leave balances and timesheet totals, route approvals, deliver notifications, and produce the reports your employer configures.
• To support you and your employer. Answer support requests, investigate faults, and restore data.
• To keep the platform secure. Detect and investigate unauthorized access, maintain audit records, enforce rate limits, and prevent fraud and abuse.
• To meet legal obligations. Retain records required by tax, employment-standards and record-keeping law, and respond to lawful requests from authorities.
• To improve the product. Analyse aggregated usage to prioritize work and fix defects. We use information that has been aggregated and stripped of identifiers for this purpose.
• To communicate. Send operational messages about your account and your work. We do not currently send product news or marketing messages; if we begin to, it will be only to people who have asked for it, and every such message will carry an unsubscribe link.

We do not train our own models on your information. Some of our delivery subprocessors (our SMS and email providers — see Section 7) may, under their own independent terms, use limited data passing through their systems for their own service-improvement or fraud/abuse-prevention purposes; this is governed by their own agreements, not ours, and does not involve us providing your data for the purpose of training a Trizelo model. We are reviewing our subprocessor agreements to tighten this further and will update this section if that changes.

6. Location Information

Location is the most sensitive category Trizelo handles, so it is described separately.

When it is captured. Only at the moment you clock in or clock out, and only if your employer has enabled location verification for your work location and your device grants permission. The Service does not track location in the background, between punches, or while the app is closed.

What is captured. Latitude and longitude at the punch, and whether those coordinates fall inside the geofence your employer configured for that work location.

What it is used for. To verify or flag that punch. Nothing else.

How long it is kept. Raw coordinates are retained as part of the attendance record today. We are implementing a defined deletion schedule for raw coordinates, after which only the pass/fail result will be kept with the punch record, and will update this section once that schedule is in place.

Its limits. Satellite and network positioning is imprecise, particularly indoors and in dense urban areas. A flagged punch is not evidence of misconduct. Your employer must review a flag before acting on it.

Declining. You can refuse device location permission. What happens to a punch recorded without location is your employer’s decision, and your employer must tell you what that is. If you believe location verification has been enabled without proper notice, raise it with your employer and, if unresolved, with the regulator named in Section 13.

7. Disclosure and Service Providers

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not currently use any payment processor or analytics vendor — the two subprocessors named above are the only ones in use today. This list is the authoritative current record; we will update it before engaging any new subprocessor that handles personal information.

8. Where Your Information Is Held and Cross-Border Transfers

Trizelo’s application and database are hosted in Canada. Our email and SMS delivery subprocessors, Resend and Twilio, are based in the United States. Personal information may therefore be stored or accessed outside the country where you work, and may be subject to lawful access requests by authorities in those countries.

For Australian users. Disclosing personal information to a recipient outside Australia is a cross-border disclosure under APP 8. We take reasonable steps to ensure each overseas recipient handles the information in accordance with the APPs, by written agreement. Under section 16C of the Privacy Act 1988 (Cth), we remain accountable to you for an act of an overseas recipient that would breach the APPs if we had done it. By using the Service you are not asked to consent to an uncontrolled overseas disclosure, and we do not rely on the APP 8.2(b) consent exception.

For Canadian users. PIPEDA permits transfers to a service provider abroad where comparable protection is maintained by contract. We tell Customers which countries are involved so they can give their employees the notice that transparency requires.

All transfers are protected by encryption in transit.

9. Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:

• encryption of traffic in transit between your device and the Service;
• role-based access controls applying the principle of least privilege, with tenant isolation between Customers;
• audit logging of certain access to and changes made to business-critical records, which we are actively expanding to cover more of the Service over time;
• production infrastructure access restricted to a single named administrator, with no shared credentials; and
• automatic alerting on repeated failed sign-in attempts and repeated failed kiosk PIN attempts.

No system is perfectly secure. We cannot guarantee that the Service will never be compromised, and this section describes the controls we operate rather than a warranty of outcome. We do not currently encrypt data at rest at the database or disk level, and we do not currently operate a 24/7 security-monitoring function or a formally documented incident-response plan; closing these specific gaps is tracked as active work (see our Vulnerability Disclosure Policy for how to report a concern in the meantime).

Your part. Keep your credentials private, sign out of shared devices, and report anything suspicious to security@trizelo.app.

10. Security Incidents and Breach Notification

If we become aware of a security incident affecting personal information we hold:

Where we hold it on a Customer’s behalf, we notify that Customer without undue delay, give them the information they need to assess the incident, and support their notification obligations. The Customer, as the accountable organization, decides on and makes the notification to individuals and regulators. Where both of us have a duty to notify in Australia, we coordinate so that only one notification is made, as the Notifiable Data Breaches scheme permits.

Where we are the accountable organization, we notify affected individuals and the relevant regulator as the law requires:

• Canada. Under PIPEDA, we report a breach of security safeguards to the Privacy Commissioner of Canada and notify affected individuals as soon as feasible where the breach creates a real risk of significant harm. We keep records of all breaches for 24 months.
• Australia. Under the Notifiable Data Breaches scheme, we assess a suspected eligible data breach within 30 days and, where notification is required, notify the OAIC and affected individuals as soon as practicable.

11. How Long We Keep It

Retention of workforce information is set by your employer’s instructions and by the record-keeping law that applies to it. We delete or de-identify information when it is no longer needed for the purpose it was collected for and no legal obligation requires us to keep it.

After a Customer leaves. When a Customer’s subscription ends, we return or delete its data in accordance with its subscription agreement, subject to any retention the law requires. The specific period and automated mechanism for this are being finalized and will be published here once in place.

12. Your Rights and How to Exercise Them

Start with your employer for workforce information. Your employer holds and controls your employment record. If you ask us for access to or correction of that record, we will refer your request to your employer within 5 business days, tell you we have done so, and help them respond. We will not disclose or change an employee record on our own authority, because doing so would cut across your employer’s obligations and could disclose information to the wrong person.

Come to us directly for information where we are the accountable organization — your account and authentication records, your correspondence with our support team, and your marketing preferences.

How to make a request. Email privacy@trizelo.app with enough detail to identify the information you want. This is currently the only way to make a request — there is no separate in-app request form. We may ask you to verify your identity, and we will not use that verification information for anything else.

Timing. We acknowledge requests within 5 business days and respond within 30 calendar days. Where a request is complex, we may extend that period as the applicable law permits, and we will tell you why before the original deadline passes.

Cost. We do not charge for a reasonable request.

If we refuse. We will tell you why in writing, identify the provision we rely on, and tell you how to complain.

13. Complaints and Regulators

Contact our Privacy Officer first at privacy@trizelo.app. We will acknowledge your complaint within 5 business days and respond within 30 days.

If you are not satisfied with our response, you may complain to the regulator for your jurisdiction:

• Canada (federal and most provinces): Office of the Privacy Commissioner of Canada — priv.gc.ca
• Alberta, British Columbia: the provincial privacy commissioner
• Australia: Office of the Australian Information Commissioner — oaic.gov.au

You do not have to complain to us first in every jurisdiction, and nothing here limits your right to go directly to a regulator or a court. Workplace matters — wages, hours, discipline, record-keeping by your employer — are for your employer and, where applicable, the employment-standards regulator or the Fair Work Ombudsman in Australia.

14. Cookies and Similar Technologies

We do not use advertising or cross-site tracking cookies.

15. Automated Processing

The Service generates schedules, compliance flags, overtime estimates, leave accruals, coverage-risk ratings and reports from rules your employer configures. Most of these are inputs to a human decision: an overtime-risk warning, a tardiness-pattern flag, a missing-pay-rate warning, and a leave coverage-risk rating are each shown to a manager (or, for coverage risk, to the employee submitting a request) for review, and do not themselves change a schedule, a pay rate, or anyone’s access.

Two features act without a manager’s review at the moment they act: the Service blocks a shift assignment that would violate a hard compliance rule (unless the sole conflict is with the employee’s own approved leave, which a manager may override), and it approves a shift-swap claim automatically when it produces no compliance warning, routing a claim that does produce a warning to a manager instead.

No feature of Trizelo scores, ranks or profiles an employee for a decision about their employment — hiring, discipline, promotion, pay, or termination. For Australian users, this section is provided in satisfaction of new Australian Privacy Principle 1.7 (effective 10 December 2026), which requires disclosure of the kinds of decisions a computer program makes that could significantly affect an individual’s rights or interests; it is a transparency obligation only.

16. Children, Young Workers, and Quebec

Trizelo is a workplace system and is not directed to the general public or to children. We do not knowingly collect personal information from anyone who is not an authorized user of a Customer’s account.

Young workers may lawfully be employed, and a Customer may therefore invite a worker under 18 to use the Service. Where that happens, the Customer is responsible for complying with the employment, consent and privacy requirements that apply to minors in its jurisdiction, including any requirement for parental or guardian consent, and for configuring features such as location verification accordingly.

If you believe a person has been given an account who should not have one, contact privacy@trizelo.app and we will work with the Customer to remove it.

Quebec. The Service is not offered to individuals resident in, or accessing from, the Province of Quebec, and this Policy does not apply to them. This reflects Quebec’s distinct legal regime (including the Charter of the French Language, which would otherwise require a French-language version of this Policy) rather than any assessment of our actual data-handling practices. If you believe you have been given access in error while located in Quebec, contact privacy@trizelo.app immediately.

17. Changes to This Policy

We may update this Policy to reflect changes in law, technology or our practices.

Every version carries a version number, an effective date, and a short summary of what changed. We keep prior versions available.

For changes that affect your rights or introduce a new purpose for using personal information, we give advance notice by email and in-app announcement before the change takes effect. Where a new purpose requires consent under applicable law, we ask for that consent separately rather than relying on continued use.