Privacy notice

Last updated October 29, 2026. Email [email protected] with any question.

What we collect

• Your list. For each person you ask us to check: name, trade or role, and the registration or licence number if you have it. If you give it, the site or crew they belong to. Nothing else about them.
• Your contact details. Your name, organization and email, so we can send records and answer questions.
• The results. What the public register said about each person on the day we checked: status, expiry date and any notation the register shows. That is the record we keep for you.

We do not collect dates of birth, home addresses, social insurance numbers or anything that is not on the list you send or on the public register. If your spreadsheet has extra columns, we keep only the fields above in your records; the original email is deleted within 30 days.

Why we collect it

To check the people on your list against the official public register once a month and give you a dated record. That is the only purpose. We do not use your list for marketing, research or anything else, and we never contact the people on it.

Where it is kept and who can see it

• Each customer's list and records live in their own private, access-controlled repository on GitHub, whose servers are in the United States. Only the person running GoodStanding, and the automation listed below, can access it. Deleting that repository deletes its history too.
• You send your list to us, and we send your records to you, by email through Google Workspace, so Google holds those messages the way any email provider does. We delete list emails from the mailbox within 30 days of filing the list. Send lists to [email protected] only. If one arrives at another address we use, it is moved to the business mailbox and deleted from the other within 30 days.
• The checks and the automation run on GitHub Actions and on Anthropic's Claude. We use GitHub on business terms that do not let it use your data for its own purposes, and Claude on an account whose settings do not allow your data to be used to train models.
• The website is served by Cloudflare, which keeps ordinary web server logs. Pages and records load fonts from Google Fonts, which sees the browser's address like any web request.
• Lookups are made one person at a time against the regulator's own public register, using its public search. We do not copy or republish any register.
• Your list is never sold, shared, or pooled with other customers. We process it only on your instructions, as your service provider.

How long we keep it

Monthly records are kept for 24 months so you have a history of checks. Your list is kept for as long as you are a customer. When you stop, we send you a full copy of your records within 5 business days and delete our copy, including the repository's history, within 30 days, unless you ask us in writing to keep them longer. Anything else is deleted within 30 days of you asking.

What you can ask for

• Ask to see what we hold about you or your people: we send it within 10 business days.
• Ask us to correct, delete or stop: reply to any email from us. We confirm when it is done.
• Add or remove people at any time by replying to any email.

The people on your list

You must have a right to have them checked, usually because you employ them and must verify their credential. You must also tell them it is checked each month. We use the register only for the purpose it exists for: confirming a credential. If a person on a list asks us what we hold about them, we tell them which employer sent their name, give them a copy of what we hold within 30 days, and tell the employer they asked.

If something goes wrong

If your list or records are exposed to anyone who should not have them, we tell you within 72 hours of learning of it, say what was exposed, and, where the law requires, report it to the Office of the Privacy Commissioner of Canada and notify the people affected.

Law

GoodStanding is run by Joshua Panko in Ontario, who is the person responsible for privacy, and follows Canada's federal private-sector privacy law (PIPEDA). If something here is not right, write to us first. You can also contact the Office of the Privacy Commissioner of Canada.

Changes

If this notice changes in a way that matters to you, you get an email before the change takes effect.