Privacy Policy

Last updated: November 12, 2026.

Customakr is operated by Hillman Reid Premium Skin and Hair Care Inc. Customakr is the name under which the corporation offers the service; the registration of Customakr as a business name of the corporation is pending. In this policy, "Customakr", "we" and "us" mean Hillman Reid Premium Skin and Hair Care Inc. as the operator of Customakr. "Workshop" means a business account in Customakr. "You" means a person who uses Customakr or whose information a workshop keeps in it.

Service status: at the date above, customakr.com is an information website and the web app at app.customakr.com runs as a demo: what you enter is kept in your browser on your device and is not sent to us, and the demo sends no usage statistics. Accounts, cloud storage, card payments, emails and the other online features described in this policy apply once they are enabled. A feature described here may also be offered only on certain plans, platforms or countries.

1. Contact and Accountability

Our Privacy Officer, Ryan Reid, is responsible for how we handle personal information, and is also the person in charge of the protection of personal information for the purposes of Quebec law. For questions, requests or complaints, write to him:

Ryan Reid, Privacy Officer, Hillman Reid Premium Skin and Hair Care Inc. (Customakr), 2880 Queen Street East, Suite 210, Brampton ON L6S 6E8, Canada. Email: support@customakr.com, marked "Privacy".

2. Our Role and the Workshop's Role

• For your account, subscription, support requests, usage statistics and the security of the service, we decide how the data is used. Under the EU and UK GDPR we are the controller.
• For the business data a workshop keeps in Customakr (its customers, contacts, employees, suppliers, quotes, invoices, files and records), the workshop decides what is collected and why. We store and process it only to run the service for that workshop. Under the GDPR we act as its processor. Under California law we act as its service provider where the law's conditions, including the contract terms it requires, are met.
• If you are a customer, employee or contact of a workshop and want to see, correct or delete your information, please contact that workshop first. We will help the workshop answer you, and we answer directly where we have our own legal duty.

3. What We Collect

• Account: email address and password (stored as a hash by our authentication provider), your display name if you add one, and the workshops you belong to and your role in each. If someone invites you to a workshop, the invitation records your email address and the role offered.
• Business data a workshop enters: company details, rates, machines, materials (including the names of custom materials), suppliers, customers, quotes, work orders, invoices, payments and refunds recorded, credit notes, job costs, stock, schedules and approval records. A log records who changed what in the workshop, and when.
• Contacts a workshop imports or types: names, companies, roles and job titles, departments, account numbers, emails, phone numbers, postal addresses and notes for its customers, suppliers, employees and other contacts; for suppliers also several named people, how they prefer to be reached, payment terms, ordering details, opening hours and pickup and delivery instructions. They are stored for that workshop only and included in its data export.
• Employee planning (if a workshop uses it): for each employee the workshop adds, weekly hours, work days, departments, an optional hourly cost, and time off with any note.
• Files a workshop uploads: its logo, photos and files kept with a quote, and on the Team plan 3D models attached to a work order.
• A workshop's customers responding to a quote: when a customer opens an approval link we record the view. When they respond to a quote, drawing or change order, we record the name they type, their comment, the time, their browser description and a salted hash of their network address.
• Customers of a workshop's ordering page: the file they upload (a 3D model, or a drawing, CAD file or image), the name, email, company and notes they enter, and a salted hash of their network address. This goes to that workshop, which is responsible for how it uses it.
• Links sent to employees (Pro and Team): the employee's email, a copy of the work order or estimate the workshop chose to share, and whether and how often it was opened.
• Subscription status: plan, status, expiry, store and product, from Apple or Google through RevenueCat. RevenueCat links the purchase to an identifier for the workshop. We never receive card details.
• Card payments (if a workshop turns them on): the workshop connects its own Stripe account. To create it we send Stripe the owner's email address, the workshop's country and an identifier for the workshop. Stripe then collects identity and bank details, and customers' card details; we never see or store them. We record the invoice, the amount paid, our platform fee, Stripe's payment reference, refunds, and for a dispute its status, amount, reason and deadline.
• Tap to Pay (if a workshop turns it on): we send Stripe the address where the workshop takes payments. Stripe uses the phone's location while a payment is taken, to prevent fraud.
• Customer financing (Pro and Team, if a workshop turns it on): we ask Stripe to turn on Affirm for the workshop's Stripe account and, if the workshop chooses one, save its business category on that account. We record whether Affirm is active, the category and whether each quote offers financing. Customers who choose Affirm apply with Affirm under Affirm's own terms and privacy policy; we do not see their credit application, credit checks or loan details, only whether the payment succeeded.
• Support messages, bug reports and suggestions: your email and what you send us. A bug report also carries the technical details shown on the form before you send it (app version, platform, screen, language, country, plan and similar settings); no quotes, customers or prices are attached. Feature suggestions are linked to your workshop.
• Settings and location: the language, units, currency, country and region you choose. When you ask for an exchange rate, we request it from Stripe; no personal data is sent. The app does not use your device's location in this version, except as Stripe requires during a Tap to Pay payment.
• Usage statistics, network addresses, time clock and Access and Devices: described in sections 5 to 8.

We do not use advertising identifiers, third-party advertising or cross-app tracking. The website and the web app do not use advertising or analytics cookies; they keep your sign-in session, language and app settings in your browser's storage.

4. Files Read on Your Device, Camera and Contacts

Read on your device, not uploaded: when you scan a power, gas or water bill to work out your shop rate, the photo, image or PDF is read on your device (in the web app, in your browser, with files served by Customakr itself). It is not uploaded to us and not kept: the app deletes its own copy once the text has been read, and photos in your library are left as they are. Only the figures you confirm and choose to use (your electricity rate and yearly utilities) are saved with your rates; the account number, name and address on the bill are never saved. On Android the text is read by Google's ML Kit through Google Play services, which may send Google technical information such as the device model, app version, performance and error data, but not the bill or its text. On iPhone and iPad the text is read by Apple's built-in Vision framework.

Slicer files, resin print files, G-code and other machine programs, DXF drawings and models you open to measure or view are also read on your device and are not uploaded. A spreadsheet of your materials, prices and machines is made on your device; an edited spreadsheet or a CSV contact list you choose is read on your device, and only the changes or rows you confirm are saved, to your own workshop.

Uploaded: a logo, a photo or file you keep with a quote, and on the Team plan a 3D model you attach to a work order are uploaded and stored privately for your workshop, so the people in your workshop can open them. In the app without an account, attached models stay on your device. A file a customer sends through an ordering page is uploaded to us and, for a 3D model, measured on our servers to give an estimate; it is not sliced or turned into production files.

Camera, photos and contacts: the app uses the camera and photo library only when you tap to add a photo or scan a bill. If you use Add from Phone Contacts, the app reads your address book on your device to show it to you (names, companies, job titles, emails, phone numbers and postal addresses; never notes, photos or birthdays). Only the contacts you choose are saved to your workshop; the rest of your address book is not sent to us or anyone else. You can turn off the app's access in your device's settings.

5. Time Clock

If a workshop uses the time clock, we record who worked (their account), on which job and operation, and when they started and stopped, taken from our server's clock, with any note they add. Corrections by an owner or admin keep the time before and after, who made the change and why. Everyone in the workshop can see the hours on its jobs; only owners and admins correct or remove entries. The hours are used to track work against quotes, each person's scheduled week and capacity and, on the Team plan, each job's live profit, which also uses the hourly cost the workshop entered for that person. This is the workshop's data: the workshop decides who uses the time clock and is responsible for telling its employees.

6. Access and Devices

Nothing is collected for this until the owner of a Team workshop turns a rule on. Then, for each device a member uses, we record the name the app gives it (such as "iPhone" or "Chrome on Windows"), its platform, when it was registered, approved and last seen, the network (IP) address it last used, and a hash of a random key the app creates on that device (not a hardware or advertising identifier). We also keep the shop's network addresses the owner adds, and a log of refused attempts and, on iPhone and iPad, screenshots the device noticed (who, when and which screen), with a keyed hash of the network address. Owners and admins of that workshop can see these records, so they can relate to individual employees; we use them only to enforce the owner's rules. When screen protection is on, the person's email is shown faintly over the app's screens on their own device. Screen protection cannot stop every way of copying a screen.

7. Network Addresses

Our servers and our hosting providers see the network (IP) address of each request. In our own database we keep a network address itself only for Access and Devices (the address a device last used, and the addresses an owner adds). To limit abuse of public pages and forms, we keep a salted hash of the address, not the address itself, for up to one day. A salted hash is also kept with a customer's response to a quote, with an ordering-page request and in the Access and Devices log, as part of those records. Our hosting and database providers may keep request logs that include network addresses for their own security and operations, for periods they set.

8. Usage Statistics

When the app is connected to our servers, it sends usage statistics: which screens and features are used and when, with the app version, platform, plan, language, country and units, and, when you add a custom material, its name and category so we can fill gaps in the standard library. They are tied to a random number made on your device and kept there, not to your account or workshop. Because that number stays the same on your device and a material name can be confidential, we treat these statistics as personal information and do not call them anonymous. They never include your customers or their contact details, the contents of quotes, invoices or work orders, prices, costs or sales figures. They are on by default; you can switch them off in Settings, Account and Data, which stops future statistics from that device.

9. How We Use Information, and Our Legal Bases

• To provide the service you or your workshop signed up for: storing your data, calculating quotes, producing PDFs and credit notes, sending the emails described in section 10, checking files sent through an ordering page, showing your plan, and taking and refunding card payments if a workshop turns them on. Legal basis: performance of our contract with you or your workshop.
• To keep the service secure and prevent abuse, for example rate limits and the workshop owner's Access and Devices rules. Legal basis: our legitimate interest, and the workshop's, in protecting accounts and data.
• To answer support requests and bug reports. Legal basis: our contract with you and our legitimate interest in fixing problems.
• To improve the app using usage statistics, only in aggregate. Legal basis: our legitimate interest in improving the product, or your consent where the law requires it. You can switch them off at any time.
• To meet legal obligations, such as tax and accounting records and answering lawful requests.

We do not sell personal information or share it for cross-context behavioural advertising. We do not show ads, and we do not use a workshop's data or its customers' data for our own marketing or to build profiles of businesses. We do not make decisions about people based solely on automated processing.

10. Emails, Consent and Your Choices

Emails we send: account emails (address confirmation and password reset) and workshop invitations; work orders and estimates a workshop shares with an employee; alerts to owners and admins when a customer responds, pays or sends a request, when a new device waits for approval, when a refund fails and when a payment is disputed; alerts to team members about quote approvals; a refund notice to a workshop's customer when the workshop refunds them through Customakr; and, only if a workshop turns them on, payment reminders. Reminders go to the email address the workshop saved for its customer, about a sent and unpaid invoice: up to three emails, 3 days before the due date, on it and 7 days after, and none more than 30 days after it. They show the workshop's name, contact details, the invoice number, description, amount and due date, and may include a card payment link. We record which reminders were sent and when. Customers who do not want reminders or other messages from a workshop should contact that workshop. We send no marketing emails.

Consent: by creating an account you agree to the uses described here. Optional features (usage statistics, card payments, Tap to Pay, payment reminders, notification emails, Access and Devices) can be turned on or off in Settings. Access and Devices, which can identify a person's device and network, is off until a workshop owner turns it on. You can withdraw consent at any time, subject to legal or contractual limits; some features will then stop working. Device permissions can be withdrawn in your device's settings.

11. Who Processes Data for Us

These service providers process personal information for us, to provide their service:

• Supabase: database, sign-in and account emails, file storage and server functions.
• Amazon Web Services: hosting of the website and web app (Amazon S3 and CloudFront), domain name service (Route 53) and, once enabled, the emails we send (Amazon SES), in the US East (N. Virginia) region.
• Stripe: card payments, refunds, disputes, Tap to Pay and exchange rates. For card payments, each workshop also has its own agreement with Stripe, and Stripe acts under its own privacy policy.
• Affirm: for customers who choose to pay a workshop over time. Affirm is the lender (through its lending partners) and handles customers' applications under its own terms and privacy policy; Customakr sends Affirm nothing directly.
• RevenueCat: subscription status from the app stores, once the iPhone and Android apps are released.
• Apple and Google: app distribution and subscription billing, under their own privacy policies. On Android, Google Play services also provides the on-device text recognition used to scan utility bills (section 4).
• ImprovMX: forwards email sent to @customakr.com addresses, including support@customakr.com, to our mailbox, which is hosted by Google (Gmail).

We do not share one workshop's content with another workshop, except where the workshop shares it through a feature it uses or the law requires it. A list of our service providers and where they process data is available from our Privacy Officer.

12. Where Data Is Stored

Our production database and file storage, provided by Supabase, have not yet been set up. Before accounts are opened, this policy will be updated to name the region where they are stored. Website hosting and our email service are in the United States. Our providers may process data in other countries where they or their sub-processors operate, including the United States. Data stored outside Canada, or outside your country, may be accessible to the courts and authorities of that country. Where Quebec law requires an assessment before personal information is communicated outside Quebec, we carry it out before that communication. Where the EU or UK GDPR applies, transfers rely on an adequacy decision or on our providers' data processing terms, including standard contractual clauses.

13. How Long We Keep It

• Account and workshop data: until you delete it or delete your account. If you are the only member of a workshop, the workshop is deleted with your account. If others share it, see section 14.
• Photos and files kept with a quote, and logos: kept with the workshop's records until the workshop is deleted.
• Models attached to work orders (Team): kept until the model is removed or the quote is deleted; the file is then deleted by the next daily clean-up.
• Ordering-page uploads: deleted by the daily clean-up after 24 hours if the request is never sent. Files sent with a request are deleted 90 days after it is sent. The request itself (name, email, company, notes) stays with the workshop until the workshop deletes it or is deleted.
• Usage statistics: 13 months, then deleted.
• Employee links: a link stops working when it expires (30 days by default) or is revoked. The link record and its copy of the work order or estimate are kept with the quote until the quote or the workshop is deleted.
• Customer responses, time entries and the change log: kept with the workshop's records until the workshop deletes them or is deleted. Time entries stay when a person leaves the workshop, because the hours were worked on its jobs.
• Access and Devices: a person's devices and access settings are deleted when they leave the workshop. Networks, devices and the activity log are deleted with the workshop.
• Hashed network addresses for abuse limits: up to one day.
• Payment, refund and subscription records: kept with the workshop's records; Stripe, Apple and Google keep their own records under their own policies and the law.
• Support messages and bug reports: kept for 120 days (4 months, the usual period in which a card payment can be disputed) from when we receive them, then deleted by the daily clean-up, together with the email address and account identifier kept with them. We delete them sooner on request, unless we need them to resolve an open issue or meet a legal obligation.
• Account deletion requests: when a deletion completes, the email address and account identifier are removed from our record of the request.
• Backups: the backup schedule of the production database will be stated here when it is set up. Deleted data can remain in backups until they expire, and is not restored to normal use except to recover from an incident.

14. Your Choices and Rights

• Export: Settings, Account and Data, Export My Data, gives, as a file, your account details and the main records of each workshop you own; for a workshop you only work for, it includes only the records about you. It does not yet include uploaded files or some records (such as the change log, employee links and Access and Devices records); ask us and we will provide them. On Pro and Team, the owner can also download all of the workshop's tables as CSV files.
• Correct: you can change most information directly in the app.
• Delete: in the app (Settings, Account and Data, Delete My Account) or at customakr.com/delete-account, without reinstalling the app. If you are the only member of a workshop, the workshop and its files are deleted with your account. If others share your workshop, the workshop and its records stay and you are removed from it. If you are its only owner, first make another member the owner in Settings, Team, Transfer Ownership (you then become an admin), or remove the other members: until you do, deletion is refused and nothing is deleted. Nobody is made owner automatically. If you cannot do this in the app, contact us and we will hand the workshop to the member you name, once we have confirmed that the request comes from you. Store purchase records stay with Apple or Google, and a Stripe account stays with Stripe under its terms. Deleting your account does not cancel a store subscription: cancel it in your Apple or Google account.
• Usage statistics: switch them off in Settings, Account and Data. Because they are not linked to your account, we cannot find past statistics for one person unless you give us the random number from your device; otherwise they are deleted after 13 months.
• Notification emails: a workshop's alerts can be turned off in Settings, Account and Data.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, including, in Quebec, computerized information in a structured, commonly used technological format; to object to or restrict some uses; to withdraw consent; and to have a decision reviewed. This includes rights under Canada's PIPEDA, Quebec's Act respecting the protection of personal information in the private sector, the EU and UK GDPR, and California's CCPA as amended by the CPRA. To make a request, email support@customakr.com. We may need to confirm your identity. We answer within 30 days, or sooner where the law requires, and explain any refusal. We will not treat you differently for using your rights. You may use an authorised agent where the law allows.

15. California

Where California privacy law applies, in the last 12 months we collected the categories listed in section 3: identifiers (such as email addresses, the random usage number and network address hashes), customer records, commercial information (subscriptions, payments and refunds recorded), internet activity (usage statistics), professional and employment information a workshop enters, and any sensitive information a workshop chooses to put in its files or notes. We collect them from you, from workshops and their members, from customers using public pages, from your device and from our payment and subscription providers, for the purposes in section 9, and keep them as described in section 13. We disclose them only to the service providers in section 11 and as the law requires, and we do not sell or share them or use sensitive information to infer characteristics.

16. Security and Incidents

Data is separated per workshop with database row-level security, encrypted in transit, and stored with our providers' encryption at rest. Approval, employee and invitation links use random tokens stored only as hashes. Access within our company is limited to people who need it to run the service. No system is perfectly secure.

If a security incident affects personal information, we assess it promptly, keep a record of it, and take steps to reduce harm. Where there is a real risk of significant harm, we notify the people affected and the Office of the Privacy Commissioner of Canada and, where Quebec law applies and there is a risk of serious injury, the Commission d'accès à l'information. Where the GDPR applies and we are the controller, we notify the supervisory authority within 72 hours where required. Where we process data for a workshop, we tell the workshop without undue delay and help it meet its own obligations.

17. Children

Customakr is a business app. It is not directed at children under 16, and we do not knowingly collect their personal information. A workshop should not enter information about children unless it has a lawful reason. If you believe a child has given us personal information, contact us and we will delete it.

18. Changes and Complaints

We will post changes here and update the date above. If a change is significant, we will tell you in the app or by email before it takes effect, and ask for your consent where the law requires it.

If you are not satisfied with our answer, you can complain to a regulator: in Canada, the Office of the Privacy Commissioner of Canada (priv.gc.ca); in Quebec, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca); in California, the California Privacy Protection Agency; in the EU, your local data protection authority; in the UK, the Information Commissioner's Office (ico.org.uk). We would like the chance to fix the problem first.