Politique de confidentialité

GigJar est en version bêta ouverte en Ontario. Pendant la bêta, ce document est offert en anglais seulement. Une version française suivra.

GigJar Privacy Policy

Effective date: November 2, 2026

Last updated: November 2, 2026

The short version

• We collect the records you put in GigJar, and the earnings from any gig app you choose to link, so we can keep them and show you tax estimates.
• We never sell your data, and we never use it for ads.
• Some companies that help us run GigJar store data outside Canada, mostly in the United States. Rollee, which brings in gig app earnings, stores data in France.
• You can export or delete your data at any time, and ask us to fix it by email. To see and change your records in the app, you need an active trial or plan.
• Questions? Email support@gigjar.ca.

1. Who we are

GigJar (gigjar.ca) is run by Haruun Abduul, a sole proprietor in Ontario, Canada, operating as GigJar. In this policy, "GigJar", "we", "us" and "our" mean Haruun Abduul, operating as GigJar. "You" means the person using GigJar.

"Personal information" means details about you, like your name, your email or your earnings. In this policy, we also call it "your information" or "your data".

We follow Canada's federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and its ten fair information principles. These principles cover things like asking for your consent, collecting only what we need, keeping your data safe, and letting you see your data.

Haruun Abduul, Founder, is responsible for how GigJar protects your personal information. You can reach him using the details in section 20.

2. What this policy covers

This policy explains what we collect, why we collect it, who we share it with, how long we keep it, and the choices you have. It covers our website, the GigJar app, our emails and our support.

It does not cover other companies' websites or apps, even if we link to them. For example, Plaid and Stripe have their own privacy policies.

GigJar is in open beta. Right now, it is only open to people who live in Ontario.

3. What we collect

We collect only what we need to run GigJar for you. Most of it comes straight from you.

3.1 Your account

• Your name and email address.
• Your sign in details. Our sign in provider, Clerk, handles these. We never see your password.
• If you sign in with Google: the name, email address and profile picture Google shares with us. We use them the same way as a name and email you type in yourself. We never get access to your Gmail, contacts, calendar or files.
• Your language, city and province.
• The ways you earn money, such as rideshare driving or online selling.

3.2 Your work records

You type these in or import them:

• Shifts, with start and end times.
• Odometer readings.
• Trips, with distance, destination and purpose.
• Your vehicles.
• Earnings from each app you work with (like Uber, Lyft or DoorDash), plus fees and hours.
• Expenses, receipt photos and statements you import.
• Signals from your phone, if you set up Shift sense: the times you went online or offline in a gig app. We use them only to suggest draft shifts for you to check.

GigJar does not track your location. Trip details come only from what you type in, import, or bring in from a gig app you link.

3.3 Short term rental records

• Your listings.
• Stays, which we read from the Airbnb or Vrbo calendar link you give us.
• Cleaning turnovers, supplies, damage, payouts and costs.

Calendar links can include small guest details, like a link to the booking or the last four digits of a guest's phone number. We keep each stay's dates and its booking code, so we can match your payouts. We do not keep guest names, phone numbers or other guest details.

3.4 Freelance records

• Clients, projects, time entries, invoices and equipment.

3.5 Online selling records

• Items, inventory, orders, payouts and expenses.

3.6 Bank data (only if you connect a bank)

Connecting a bank is optional. It works through a company called Plaid. Before you connect, we show you a consent screen. Nothing is connected unless you agree.

• Plaid sends us transactions from the accounts you choose to share. It also sends the last few digits of each account number.
• We keep the transactions we bring in, encrypted, so we can suggest drafts for you to check. They are deleted when you disconnect your bank, purge your imported data, or delete your account.
• We never keep your account balances or full account numbers. Plaid may send a balance with your transactions, but we do not store it.
• The key that keeps your bank connected is encrypted.

You sign in to your bank through Plaid. We never see your online banking password.

3.7 Gig app data (only if you link a gig app)

Linking a gig app is optional. It works through a company called Rollee, based in France. Nothing is linked unless you sign in to the app on Rollee's screen and agree.

• When you link a driving or delivery app, Rollee brings in what that app pays you: your earnings, fees, tips, trips, kilometres and time online, from January 1, 2026.
• We keep a total for each day, or for each week when the app gives only weekly totals: earnings, fees, tips, any tax amount the app shows, kilometres and time online. We do not keep the places your trips started or ended.
• You sign in to the app on Rollee's own screen. We never see your password for that app.
• We give Rollee only an account number we make for you, never your name or email.
• You can disconnect an app at any time from Connected apps under More. New days then stop coming in, and we ask Rollee to end the connection. The days already in GigJar stay in your records unless you delete them.

3.8 Emails you forward to GigJar

You get your own GigJar inbox address. You can forward receipts, statements and reservation emails to it. We read these emails to create draft records. You check each draft before it is saved to your records.

3.9 Receipt photos and year end packs

We store receipt photos, and the year end packs you make, in Canada, with Amazon Web Services (AWS) in its Canada (Montréal) region. An AWS tool called Amazon Textract reads the text on your receipts, also in Canada. We use that text to fill in a draft for you to check.

3.10 Payments

Stripe handles payments. We never see or store your full card number. Our own systems keep only your subscription record: Stripe's ids for your customer and your subscription, your plan, its status, like "active" or "cancelled", and when it renews. Stripe may show us a few billing details, like your card type, the last four digits and the expiry date, so we can help with billing questions. If you use a promo code, Stripe records the code with your subscription.

3.11 Notifications

If you turn on browser notifications, we store a notification setting from your browser so we can send you reminders, like a reminder before a driving block you planned. Reminders are short. A receipt reminder may name the store, the amount and the time of a charge, so the receipt is easy to find. You can turn them off at any time in your browser or in GigJar.

3.12 Support and the waitlist

• Messages you send to our support team.
• Emails you send to support@gigjar.ca. They pass through ImprovMX, the service that forwards our @gigjar.ca email, and are kept in our support inbox at Google (Gmail).
• If you join our waitlist: your email, your province, your language and the way you earn money.

3.13 Technical and security records

• Error reports. When something breaks, we send a report to a company called Sentry so we can fix it. We set it up to leave out personal details.
• Security log. We record important account events, like connecting a bank, exporting data or deleting an account.
• Network addresses. To stop abuse, we turn network addresses (IP addresses) into a scrambled code. We keep that code for one day at most, except with the record of a message you send us through Message us, which keeps its code as long as the record.
• Visit counts. We count page visits and app events with Vercel Web Analytics. It does not use cookies and does not identify you.
• Bot check. When you sign up, our sign in provider uses Cloudflare Turnstile to check that you are a person.
• Cookies. See section 14.

3.14 What we do not collect

We do not ask for your Social Insurance Number (SIN) or your CRA sign in details. Please cover your SIN before you upload or forward a document that shows it.

4. How we use your information

We use your information only to run GigJar for you. This means we use it to:

• keep your records and show them to you;
• calculate estimates of the taxes you may owe;
• read your receipts, statements and forwarded emails, and turn them into drafts for you to check;
• bring in the bank transactions you choose to share;
• bring in the earnings from the gig apps you choose to link;
• remember a promo code from a link you opened, so it can be added at checkout;
• run your account, sign you in and keep your account safe;
• bill you for your plan;
• send you service emails and your weekly summary;
• answer your questions;
• find and fix problems;
• stop fraud and abuse;
• follow the law.

We do not:

• sell your personal information;
• use it for ads, or let anyone else use it for ads;
• use it to train artificial intelligence (AI) models;
• share it with the Canada Revenue Agency (CRA), unless the law makes us (see section 6).

4.1 Automated tools

GigJar uses automated tools to read receipts and emails, sort transactions and calculate estimates. These tools can make mistakes. You can check every draft before it is saved, and you can change any record.

5. Your consent

When you sign up, we ask you to agree to this policy. We then collect and use your information as this policy explains.

We ask for your clear, separate consent before we:

• connect your bank;
• link a gig app;
• send you browser notifications;
• send you news or offers by email.

You can take back your consent at any time. If you do, some features may stop working. For example, if you disconnect your bank, we can no longer bring in bank transactions. GigJar cannot work without your records. So if you take back your consent for those, we will need to close your account.

We will ask for your consent before we use your information for a new purpose.

6. Who we share it with

We share your information only in the cases below.

6.1 Companies that help us run GigJar

We use the service providers listed below. Each one gets only the information it needs for its job. Each one must protect your information under its agreement with us, and may use it only to provide its service to us.

• Clerk: sign in and account security. United States.
• Cloudflare, through Clerk: checks that sign ups come from a person. United States.
• Vercel: hosts our website and app, and counts visits. United States.
• Neon: our main database, where your records are kept. United States.
• Amazon Web Services (AWS): stores receipt photos and year end packs, and reads receipt text with Amazon Textract. Canada.
• Stripe: payments and billing. United States.
• Resend: sends our emails. United States.
• Resend: receives the emails you forward to your GigJar inbox address. United States.
• Plaid, only if you connect a bank: connects your bank account. United States.
• Rollee, only if you link a gig app: brings in your gig app earnings. France.
• Google: signs you in, only if you choose Sign in with Google, and holds our support inbox (Gmail). United States.
• ImprovMX: forwards email sent to our @gigjar.ca addresses to our support inbox. United States.
• Sentry: error reports. United States.
• Your browser's push service, only if you turn on notifications: Apple, Google, Microsoft or Mozilla deliver notifications to your browser. Mostly the United States.

Push messages are encrypted. The companies that deliver them cannot read what they say.

6.2 Plaid, Stripe and Rollee

Plaid and Stripe also have their own relationship with you. They follow their own privacy policies, not only ours. When you connect a bank, Plaid's End User Privacy Policy applies. You can read it at plaid.com/legal. Stripe's privacy policy is at stripe.com/privacy.

Rollee handles your gig app data for us, under its agreement with us. You can read how Rollee protects data at getrollee.com/privacy-policy.

6.3 When the law requires it

We may share information when the law requires it. Examples include a court order, a search warrant, or a legal demand from a government body like the CRA. We will share only what we must. Where the law allows, we will tell you first.

6.4 To prevent harm

We may share information when the law allows it and we believe it is needed to stop fraud, protect someone's safety, or protect GigJar's legal rights.

6.5 If GigJar is sold

If GigJar is sold, merges with another business or sells most of what it owns, your information may go to the new owner. The new owner must protect it as this policy says. We will tell you before your information moves.

7. Data stored outside Canada

Some of our service providers store data outside Canada, mostly in the United States. Rollee stores gig app data in France, in the European Union. Canadian law allows us to use them. We stay responsible for your information while they handle it. We protect it with contracts and other safeguards.

While your information is in another country, the laws of that country apply to it. Courts, police and national security agencies in that country may be able to get it under those laws.

Your receipt photos and year end packs are stored in Canada. Some of our United States providers handle them briefly on the way, for example when a pack is made or a receipt arrives by email. If you have questions about where your data is kept, contact us.

8. How long we keep it

• Your account and records: while your account is open.
• Gig app data: the daily totals stay in your records until you delete them or your account. When you disconnect an app, new days stop and we ask Rollee to end the connection.
• Year end packs: until you delete your account.
• The promo code cookie: up to 30 days, or until you start a trial or plan.
• Your bank connection: until you disconnect it. If you stop paying, we remove it 30 days after your paid time ends.
• Bank transactions and drafts you did not confirm: deleted when you disconnect your bank or purge your imported data.
• Everything, after you delete your account: a 30 day hold, then deleted, the security log included. Backup copies expire within 30 more days.
• Security log: 2 years, or until your account is deleted.
• Scrambled network address codes: 1 day at most, or as long as the record of a Message us message.
• Error reports: up to 90 days.
• Copies of emails at our email provider: up to 30 days.
• Support messages, including emails to support@gigjar.ca: while your account is open. Without an account, up to 1 year.
• Waitlist details: until you join GigJar or ask us to remove you, and no more than 12 months.
• Billing records (what you paid): Stripe keeps these as tax law requires, usually 6 years. GigJar keeps no copy after your account is deleted.

9. Deleting your account

You can delete your account in the app at any time.

• Deleting your account starts a 30 day hold. During the hold, you can change your mind and keep your account.
• After 30 days, we delete your records, receipt photos, year end packs, bank connection, security log and sign in account.
• Deleting your account ends your gig app links through Rollee at once.
• Copies in our database backups expire within 30 more days.
• After that, GigJar keeps nothing about you, except the support emails you sent us, which we delete within 1 year. Stripe keeps the billing records that tax law requires.
• Deleting your account also cancels your plan.

Before you delete: The CRA expects you to keep your tax records for six years from the end of the last tax year they relate to. Export your records before you delete your account. Once your account is deleted, we cannot get your records back.

10. How we protect your information

• Every connection to GigJar is encrypted using TLS 1.2 or higher.
• Our database is encrypted on disk. Bank connection keys and bank transaction text get an extra layer of encryption.
• Only our founder can access the systems that hold your data. Every one of those systems needs two step sign in.
• We limit repeated attempts to sign in or guess information, to block attacks.
• Our service providers must protect your information too. Some of their staff may need to access it to provide their service.

No system is perfectly secure, so we cannot promise your information will always be safe. You can help: use a strong password, keep your sign in details private, and turn on two step sign in if we offer it.

11. If there is a data breach

If a breach of our security could put you at real risk of significant harm, we will tell you as soon as we can. We will also tell the Office of the Privacy Commissioner of Canada. Significant harm includes things like identity theft, money loss or damage to your reputation. We will explain what happened and what you can do to protect yourself. We keep a record of every breach for at least two years, as the law requires.

12. Your rights and choices

You can:

• See your data. Ask us what personal information we have about you.
• Fix it. You can change most records in the app while you have a trial or plan, or email support@gigjar.ca and we will fix it for you.
• Export it. Download a copy of your records from the app at any time.
• Delete your account. See section 9.
• Disconnect your bank. Do this in the app at any time. It removes the connection at Plaid. It also deletes the bank transactions and drafts you had not confirmed.
• Disconnect a gig app. Do this in the app at any time, from Connected apps under More.
• Turn off notifications. Do this in your browser or in GigJar.
• Unsubscribe from emails. See section 13.
• Take back your consent. See section 5.
• Complain. Contact us first. If you are not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada. See section 20.

To make a request, email support@gigjar.ca with "Privacy request" in the subject line. We may need to confirm who you are first. Requests are free. We will answer within 30 days. If we need more time, we will tell you why and when to expect an answer, as the law allows. In a few cases, the law lets us hold back some information, like details about other people. If we do, we will tell you why.

13. Emails we send you

• Service emails. These are emails you need, like sign in codes, payment receipts, security alerts and notices about your account or our policies.
• Weekly summary. Every Sunday, we send a summary of your week. Each one has an unsubscribe link. You can also turn it off in your settings.
• News and offers. We send these only if you say yes. Each one has an unsubscribe link.

When you unsubscribe, we will stop within 10 business days. Every email shows who sent it and how to reach us, as Canada's anti spam law (CASL) requires.

14. Cookies

We use only the cookies we need to run GigJar: cookies that keep you signed in and keep your account secure, one that remembers your language, one that remembers your light or dark theme, and one that remembers a promo code from a link you opened, for up to 30 days, so it can be added at checkout. We do not use advertising cookies or analytics cookies. Our visit counts are cookie free. We do not track you across other websites. Stripe may use its own cookies on payment pages to prevent fraud. If you sign in with Google, Google may use its own cookies on its sign in pages.

15. Information about other people

Your records may include details about other people, like a client's name on an invoice or a store's name on a receipt. Only add details you have the right to use for your business. We use these details only to keep your records. We do not contact these people.

16. Children

GigJar is for adults. You must be 18 or older to use it. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.

17. Coming soon

We are working on new features. None of them are live yet. Before each one starts, we will update this policy and ask for your consent. You will not be signed up for any of them automatically.

• A GigJar iPhone app. Before it opens, we will update this policy to cover Sign in with Apple, App Store purchases and iPhone notifications.
• Reading your car's odometer through a company called Smartcar. This would read the odometer only, never your car's location.
• A referral and partner program.

18. Quebec

GigJar is not available in Quebec yet. Quebec has its own privacy law, often called Law 25. Before we open in Quebec, we will take the extra steps that law requires and update this policy.

19. Changes to this policy

We may update this policy. If we make a big change, we will tell you by email or in the app at least 30 days before it takes effect. If a change means using your information in a new way, we will ask for your consent first. The date at the top shows when this policy last changed.

20. Contact us

Privacy contact: Haruun Abduul, Founder

Business: Haruun Abduul, operating as GigJar

Email: support@gigjar.ca (please put "Privacy" in the subject line)

Phone: 647 964 2719

If you need this policy in another format, such as large print, contact us.

Office of the Privacy Commissioner of Canada

Website: priv.gc.ca

Toll free: 1 800 282 1376

Mail: 30 Victoria Street, Gatineau, Quebec K1A 1H3