Pragmatic Safety Services Ltd. ("Strawboss"), a British Columbia company at 8927 117 Avenue, Fort St. John, BC V1J 6A5, operates strawboss.ai and the Strawboss dashboard, the browser field app and the Strawboss app for Android and iOS. This policy explains what personal information we collect, why, who we share it with, and your rights. We comply with British Columbia's Personal Information Protection Act, the federal Personal Information Protection and Electronic Documents Act, and, where they apply, other provincial and foreign privacy laws, including Quebec's Act respecting the protection of personal information in the private sector and applicable US state privacy laws.
Two kinds of information
Information about our customers and website visitors. When an organization signs up, we collect the owner's name, email, phone (optional), company name, address and billing details, plus a record of the Terms version accepted, when, and from which network address. We are responsible for this information.
Information our customers put into the Service. Employers use Strawboss to keep safety records about their workers and worksites. That information belongs to the employer, who decides what to collect and why. We process it on their instructions. If you are a worker, your employer is the organization to ask about that information; our Worker Privacy Notice explains what the app does with it.
What we collect and why
| Information | Why |
|---|---|
| Account details (name, email, phone, role) | To create and secure your account and contact you about the Service |
| Billing details, handled by Stripe | To charge subscriptions; we store identifiers, not card numbers |
| Usage and device data (browser, IP address, pages used, device tokens) | To run, secure and improve the Service and to send push notifications you enable |
| Support requests and feedback | To answer you and fix problems |
| Terms acceptance records | To prove agreement to the Terms |
| Cookies and local storage | To keep you signed in and remember preferences; no advertising cookies |
Sharing
We share personal information only with service providers who process it for us under contract (hosting, database, payments, email, push notifications, error monitoring and AI providers), listed at strawboss.ai/subprocessors; with authorities when the law requires; and with a successor if the business is sold. We do not sell personal information and we do not use customer data to train AI models that serve other customers.
AI features
When you use an AI feature, the text or files you ask about are sent to our AI providers to generate the response. We use those providers under their commercial API terms, which exclude training on customer content, and we enable zero-data-retention where a provider offers it.
Where information is stored
Our database and backups are in Canada. Our application servers and our service providers are in the United States, so your information may be accessed there and be subject to United States law.
Retention
We keep account information while the account is active and for 90 days after the workspace is closed, unless the owner requests earlier permanent deletion or asks us in writing to hold the records for a legal reason. Customer safety records are retained as the employer directs; see the Data Processing Addendum. Support tickets are deleted 24 months after resolution. Backups expire on a fixed schedule.
Security
We use encryption in transit and at rest, tenant isolation, hashed tokens, scanning of our code and dependencies, and monitoring with personal information scrubbed. No system is perfectly secure; if a breach creates a real risk of significant harm we will notify affected people and the Privacy Commissioner as the law requires.
Your rights
You may ask us for access to, correction of, or deletion of personal information we hold about you, and withdraw consent where consent is the basis for processing. Email [email protected]. A dashboard user who is not the workspace owner can also delete their own login from My profile; we confirm by email and remove the login, name, email, profile photo and AI memory after a 14-day grace period. Records you filed for your employer stay with your employer with your name unlinked. If the information was entered by your employer we will refer your request to them and help them respond. A field worker can delete their own Strawboss app account, and their employer can also remove it; see "Your account, access and deletion" in the app section below. You may complain to the Office of the Information and Privacy Commissioner for British Columbia or the Privacy Commissioner of Canada.
Children
The Service is for workplaces and is not directed at anyone under 16.
Changes
We will post changes here with a new version date and email account owners about material changes at least 30 days in advance.
Contact
Privacy Officer: David Dunham, [email protected]. Pragmatic Safety Services Ltd., 8927 117 Avenue, Fort St. John, BC V1J 6A5, Canada.
The Strawboss app for Android and iOS
Updated October 18, 2026. The policy above also applies to the Strawboss app, the phone app for field workers that Pragmatic Safety Services Ltd. publishes on Google Play and the Apple App Store. This section explains what the app does with information on your phone and through its device features. "Desktop app" below means the Strawboss dashboard at app.strawboss.ai that your employer uses.
Who the app is for and how an account is created.
The app is for workers whose employer uses Strawboss. Your employer's administrator creates your worker record in the desktop app and pays for your seat. You cannot create an account on your own, and nothing is sold inside the app: there are no purchases, subscriptions or advertisements. To start, you enter the email address your employer recorded. We send a six-digit code to that address to confirm it is yours, and you then choose your own password. You can change your password in the app at any time. A forgotten password is reset through the same email code.
Sign-in and session information.
To register you, sign you in and keep your account secure, we process your email address, a hashed copy of your password that we cannot read, short-lived hashed verification codes, a session token for this phone, a device identifier used to allow one active phone at a time, and a log of sign-in events such as failed attempts, locks and resets. Your employer's administrator can see which phone is signed in and can sign it out from the desktop app.
Information on your phone.
The app saves assigned content, drafts, submitted-work queues, attachments, training progress, preferences and your profile so you can work with poor connectivity. The local database is encrypted; sign-in credentials use the device's secure storage. Selected media is also kept in the app's private storage until it is no longer needed for the workflow. Unsent work may remain on the phone after sign-out to avoid losing your records. Uninstalling the app or clearing its data can remove work that has not reached your employer. Signing out and deleting a Sofia conversation are different actions, and neither one deletes your account.
Your profile and My Files.
Your profile picture and the files you upload in My Files are stored in your employer's workspace, not only on your phone. Files you upload are visible to you and to your employer's administrators under the access rules they set. Files an administrator shares with you appear in My Files for as long as the share lasts. You can delete your own uploads from the app; shared files are controlled by the administrator. The app uploads only the files you choose. It does not scan, index or upload other content on your phone.
Camera, photo library and location.
Camera access is used only when you choose to take a photo. The system picker lets you choose an existing image. Save to library is optional and off by default; enabling it allows newly captured photos to be copied to the device photo library. Copies there are governed by your device and any photo-backup service you use, and are not removed by deleting a report in Strawboss.
Date/time stamps and coordinate stamps are optional. Coordinate stamps request location permission and read your location while you take a photo; this feature does not track you continuously or in the background. A stamped image may disclose the location and time to anyone you share it with. Turning off a stamp affects future captures, not images already created or shared. Device settings let you withdraw camera, location and photo permissions.
Voice, Sofia and AI consent.
Microphone and speech recognition access is requested only for voice features, and only after you start one. Depending on the selected feature and device, speech may be processed by the operating system or sent to our transcription and AI providers. Voice Fill streams your speech to our service while you fill a form; the speech is transcribed by Deepgram (or, where enabled, Groq) and the words are turned into form answers by Google Gemini. Sofia uses Anthropic. The audio is not kept once the words have been transcribed. Our Data Processing Addendum lists these providers and where they process data. Captured voice files can be held locally while a draft or upload is pending. Before your first cloud AI request, the app asks whether you allow Strawboss to send your content to its AI providers and links to the provider list. You can decline or change your choice under AI features in Settings; manual forms, tasks and training still work with AI off. Sofia sends a question or selected attachment only when you press Send and AI is allowed. There is no separate first-use attachment notice.
When you chat with Sofia, the messages and recent conversation context needed to answer are sent to our service and its AI providers. The assistant may retrieve employer records that your administrator has permitted you to access. Do not include passwords or codes. Conversation history is stored for your account on this phone until you delete it or sign out. You can resume or delete it from Messages. Removing local history does not delete employer records, submitted reports, support tickets, or limited security and provider records kept under the policies above. Sofia is an AI assistant; answers can be incomplete or incorrect.
Files you send to Sofia.
When you attach a photo or document and press Send, Strawboss sends that file's contents and the relevant conversation to Anthropic to generate an answer. Images and PDFs are processed visually; text, Word and Excel content may be extracted on our server before being sent. Choosing a file alone does not send it. You can pick a file from your phone or from My Files; either way nothing is sent until you press Send.
Attached files stay with the conversation in the app's encrypted local history. The most recent attachment group may be sent again when you retry or continue that conversation so Sofia can answer follow-up questions. Delete the conversation in Messages or sign out to remove its local history and attachments. This does not delete copies held by the provider under its applicable retention terms, previously submitted workplace records, or copies in your photo library. This chat flow does not add the files to your employer's file cabinet. Only send files you are authorized to share and avoid unnecessary personal or confidential information. Provider processing is subject to the AI and sharing sections above and our subprocessor information.
Dictating a message to Sofia.
Speak uses your device's speech-recognition service to display text in the composer as you talk. Depending on your device, language model and connection, that service may process speech on your phone or through its speech provider. Recognition starts when you press Speak. Stop ends dictation and keeps the displayed text for review or editing. Strawboss does not create or upload a Sofia voice-note file in this flow. Only pressing Send submits the composed text to Sofia. Sent text is retained with the conversation until it is deleted.
Notifications, diagnostics and security.
If you enable push notifications, a device registration token and platform information are used for delivery through Firebase Cloud Messaging and, on Apple devices, Apple Push Notification service. Your operating system controls permission and lock-screen previews. Assignments, shared files and other items remain available in the app when push alerts are disabled. The app uses no advertising identifier and contains no advertising or analytics SDK. The app does not offer SMS delivery.
Running diagnostics checks network reachability, the Strawboss service and pending-work counts. Shared diagnostic summaries contain version, check time, connection results and counts; they exclude report contents, tokens and media. Sharing opens the device share menu and occurs only when you choose a recipient.
The app offers an optional app lock in Settings: a PIN you choose, with biometric unlock (Face ID or Touch ID on iPhone, fingerprint or face on Android) available where your device supports it. The lock protects access to the app on this phone and does not change your Strawboss account password. A salted hash of the PIN is kept in the device's secure storage; the PIN itself is not stored. Neither the PIN nor its hash is sent to Strawboss or copied to the cloud. Your phone's own lock screen and operating-system access controls protect access to the device. App credentials remain in secure storage and local work remains encrypted. A signed-in session is required to synchronize data.
Your account, access and deletion.
Your account is created and paid for by your employer. You can delete your own account in the app, under Settings, Account & Legal, Delete my account. That removes your name, email, profile picture and other personal details and signs you out on every phone. Your employer's administrator can also sign your phone out, deactivate your account or remove you from the crew in the desktop app, and you can ask your administrator to delete your account.
If you no longer have a contact at that organization, email [email protected] from the email address on your account. We verify the request with you and with the organization and act on it within 30 days. The full process is published at https://strawboss.ai/account-deletion/.
When an account is removed, your name, contact details, login, device sessions, push registration and profile picture are deleted or de-identified. Safety and training records you filed stay with your employer, as the law and its safety program require. Removing your account does not erase historical safety evidence: retained records may still include your name, signatures and other details recorded when you submitted them. Files you uploaded to My Files stay in the employer's workspace unless you deleted them first or the administrator removes them. On your phone, signing out or uninstalling the app clears your local copy; unsent work may remain after sign-out so that it is not lost. We explain any data that must be kept for legal, safety, fraud-prevention or audit reasons when we answer your request.
Your employer manages your work identity and safety records. Request a correction from your workspace administrator. You can contact our Privacy Officer at [email protected] to request access, correction or deletion. Relevant rights, complaint routes and contact details remain as described in the policy above.