Privacy Policy

Concorso ("Concorso", "we", "us", or "our") provides job, client, and schedule management software for automotive reconditioning businesses ("Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to our website at concorso.ca and the Concorso web application (together, the "Site").

We are based in Toronto, Ontario, Canada, and this policy is written to meet our obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec's Law 25. We also describe rights available to residents of California and other U.S. states under laws such as the California Consumer Privacy Act (CCPA/CPRA).

Information We Collect

Account information. When you sign up, we (via our authentication provider, Clerk) collect your name, email address, password, and, if you sign in with Google, your Google profile name, email, and photo.

Business and job data. Information you enter to run your business — business name, operation type, service categories, client records, vehicle and job details, schedules, invoices, tax rates, and team member information you add.

Payment information. Billing is handled by Stripe. We never see or store your full card number — Stripe collects payment details directly and provides us only a customer ID, subscription status, and plan tier.

Usage and device information. Standard technical data such as IP address, browser type, device type, and pages visited, collected automatically to keep the Service secure and working correctly.

Team invitations. If you invite a team member, we collect the name and email address you provide for them, and send them an invitation email.

Cookies and Similar Technologies

Concorso currently uses only strictly necessary cookies — we do not use advertising, analytics, or cross-site tracking cookies. The cookies we use are:

• Authentication cookies (set by Clerk) — keep you signed in and secure your session.
• Checkout cookies (set by Stripe) — only present during a billing checkout flow.

Because these cookies are essential to the Service working at all, we don't request opt-in consent for them, consistent with PIPEDA and ePrivacy-style guidance on strictly necessary cookies. If we ever add analytics or marketing cookies, we will update this section and request consent where required before doing so.

How We Use Information

We use the information above to:

• Provide, maintain, and secure the Service;
• Process payments and manage subscriptions;
• Communicate with you about your account, invitations, and service updates;
• Diagnose problems and improve the Service; and
• Comply with legal obligations.

Our legal basis for processing is your consent (given at sign-up), the necessity of processing to perform our contract with you (delivering the Service you signed up for), and our legitimate interest in operating and securing our business.

How We Share Information

We do not sell your personal information. We share information only with service providers ("subprocessors") who help us run Concorso, under contracts that require them to protect your data:

• Clerk — authentication and account management
• Convex — application database and backend
• Stripe — payment processing and billing
• Vercel — application hosting

We may also disclose information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets, in which case we'll notify you.

Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. If you close your account, we delete or anonymize your personal information within a reasonable period, except where we must retain it to comply with legal, tax, or accounting obligations.

Data Security

We use industry-standard safeguards — encryption in transit, access controls, and secure third-party providers — to protect your information. No system is perfectly secure, and we cannot guarantee absolute security.

International Data Transfers

Our service providers (Clerk, Convex, Stripe, Vercel) may process and store data on servers located outside Canada, including in the United States. Where this happens, we require our providers to maintain protections consistent with Canadian privacy law.

Your Privacy Rights

Canada (PIPEDA / Quebec Law 25). You have the right to access the personal information we hold about you, request corrections, withdraw consent (which may limit your ability to use the Service), and request deletion of your account data. Quebec residents also have the right to data portability.

California and other U.S. states. If applicable state law grants you rights (such as the right to know, delete, correct, or opt out of the "sale" or "sharing" of personal information), you may exercise them by contacting us below. We do not sell personal information.

To exercise any of these rights, email us at hello.concorso@gmail.com. We will respond within the time required by applicable law.

Children's Privacy

Concorso is a business tool and is not directed at, or intended for use by, individuals under 18. We do not knowingly collect personal information from children.

Canadian Anti-Spam Law (CASL)

Team invitation emails and account notifications are sent as part of delivering the Service you've signed up for. Any marketing email we send will include a clear way to unsubscribe, in accordance with CASL and equivalent U.S. requirements (CAN-SPAM).

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by email or through the Service. The "Last updated" date above reflects the most recent revision.

Contact Us

Questions about this policy or your data? Email us at hello.concorso@gmail.com, or write to us at Concorso, Toronto, Ontario, Canada.