Last updated: October 18, 2026 · This policy is part of our Terms of Service. See also the Payments, Cancellations & Refunds Policy.
1. Who we are and what this covers
CheckedOut ("CheckedOut", "we", "us") operates trycheckedout.com — a platform where short-term-rental hosts and property managers ("Hosts") find, hire, schedule and pay cleaning and maintenance professionals ("Pros"), and manage their own teams. This policy explains what personal information we collect, why, who sees it, how long we keep it, and the choices you have. It applies to the website, the web app, and every communication we send. It does not apply to third-party sites we link to.
We are based in Ontario, Canada, and comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). We honour equivalent access, correction and deletion requests from users in any region, including under U.S. state privacy laws for our American users.
2. Two roles: platform and workspace processor
For your own account (profile, login, marketplace activity) we decide how data is handled and this policy governs directly. Inside a Host's workspace — team rosters, schedules, time-clock entries, wage settings — the Host controls that data and what it's used for; we process it on the Host's behalf to provide the tools. If you are an employee or worker whose employer uses CheckedOut, your employer is responsible for how it uses your work records, and questions about pay, hours or employment records should go to them first. We still apply every safeguard in this policy to that data.
3. What we collect
Account data — name, email address, phone number, password (stored only as a salted bcrypt hash — we cannot read it), avatar if you upload one, language preference, and business details you choose to add (company name, address, tax registration numbers).
Profile data (Pros) — headline, skills, service area, hourly rate and its currency, and anything you choose to publish on a public profile page. Ratings and review counts are computed from real reviews left on completed jobs.
Work data — listings and property details, job postings, bids and offers, jobs and their statuses, schedules, checklists and form submissions, messages sent through the platform, reviews, time-clock entries, invoices and payment records. This is the product: if you use CheckedOut to run work, the record of that work lives here.
Evidence data — photos uploaded on jobs, each with a server-recorded timestamp, and the device's location coordinates when granted (see section 4). This record is deliberate: it is what protects both sides when there is a dispute, a damage claim, or an insurance question.
Identity verification — to post jobs, hire on the marketplace or be listed as a Pro, you verify a government ID. The ID images you upload are seen only by our review staff and are deleted once the review is done (or the check runs with Stripe Identity, which holds the images under its own policy). From the ID we keep your legal name and date of birth only long enough to turn them into a one-way key: a keyed hash that cannot be turned back into your name or birthday, used for one thing — making sure each person has only one CheckedOut account. We also keep a key made from your phone number for the same reason. If you lose the phone you sign in with, we may ask you to confirm it’s you before a new number is added — through Stripe Identity, matched against the key above, or with a photo of your ID and a selfie holding it. Those photos are seen only by our review staff and are deleted once we decide, or after 7 days if the reset isn’t finished.
Credential documents (Pros) — insurance certificates, trade licences and background-check results you send for the Vetted mark. They are visible only to you and our review staff.
Property access codes — door codes, lockbox codes and similar notes a Host saves on a listing are stored encrypted, and shown only to the Host side and to the Pro booked on a job there, from shortly before the job until the work is submitted.
Payment data — processed and held by Stripe, Inc. Full card numbers and bank credentials never touch our servers. We store only what we need to show you your own records: card brand and last four digits, invoice amounts, fee breakdowns, payout amounts and statuses.
Technical and security data — IP address, browser type, device type, pages visited and actions taken, and server logs. Each sign-in records the IP address and device (browser) it came from; we use these to detect account takeover attempts and duplicate accounts, and for debugging. To spot one person running a second account (for example to get around a ban or a block), we also keep a one-way fingerprint (a hash, never the id itself) of the device you sign in from: a random first-party device cookie, and in the phone app its notification token. Two accounts on one device are only looked at by staff when something else already links them; a household sharing a tablet is never flagged for that alone, and nothing is decided automatically.
Background checks through Certn (optional, Pros) — if you start an automatic background check from Settings → Verification, you agree to it on a consent screen and enter your details and ID on the website of our partner Certn, not on CheckedOut. Certn sends us only the status, the result and a link to its report, which CheckedOut staff can open to review a result that isn't clear. We keep the date and wording of your consent with the check.
Automatic checks on messages — until a Host and a Pro have finished a first job together through CheckedOut, our systems automatically scan messages, job notes, quotes and applications between them and hide phone numbers, email addresses and similar contact details. The check runs by machine; nobody reads your messages to do it.
Communications — support emails, and the content of messages you exchange with other users through the platform (which both participants can see, by design).
Translation, when you ask for it — if you choose a language other than English in Settings → Profile and press Translate on a message (or switch on “Always translate” for a chat), or open a job page in that language, the text of that message or of the job’s checklist, forms, guides and notes is sent to an AI service (Anthropic) to translate it, with contact details removed first. Access codes, addresses and names are not sent. We keep the translation so the same text isn’t sent twice, and it isn’t used to train AI models.
Gmail, if you connect it (optional, Hosts) — to follow up an Airbnb damage claim from an issue, a Host can connect their Google account. We then read only the emails that match the reservation number (or, with no number, the guest’s name) of the issue being looked at, and send only the emails the Host writes and sends from that issue. We store the message ids, subjects, senders, dates and short previews of those emails with the claim; the email bodies are read from Gmail when opened and not kept. To show the Host what Airbnb decided to pay, we read the amount out of Airbnb’s claim emails and keep that amount and the sentence it came from on the issue, visible to the Host’s side only; where an AI service (Anthropic) helps read it, only the text of Airbnb’s claim emails is sent, with contact details removed, and it isn’t used to train AI models. Google’s access tokens are stored encrypted, are never shared, and are deleted (and revoked at Google) when you disconnect, leave the workspace or delete your account. CheckedOut’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
QuickBooks Online or Xero, if you connect them (optional, Hosts) — a Host can connect their workspace’s books so CheckedOut records what the workspace paid through us there: job receipts, pro invoices, plan charges, late-cancellation fees, tips, receipts the Host’s side recorded (with the receipt file), and refunds. For each one we send the amounts as they appear on the CheckedOut document, its date and number, the pro’s or store’s name as the payee, and the listing’s class or tracking option when the Host picked one. We read only what the connection needs to do that (the names of the books, their currency, accounts, classes or tracking categories) and keep, for each document, the id the books gave it, so nothing is sent twice. We don’t read your other transactions. The access tokens are stored encrypted, are never shared, and are revoked at QuickBooks or Xero when the Host disconnects; what was already recorded stays in the Host’s books, which are theirs to keep.
4. Location data — exactly when and what
We collect device location only at specific work moments, and only when the device grants permission:
· Clock in / clock out — a single coordinate captured at the moment of punching, so a Host can verify on-site attendance. Not continuous tracking: we never record location between punches, off shift, or in the background.
· Job photo capture — coordinates attached to evidence photos where granted, so the photo can prove where it was taken.
Location records are visible to you and to the workspace (Host, admins and managers) the work was performed for. Declining location permission never blocks you from working; punches and photos are simply recorded without coordinates, and the workspace can see that they were.
5. How we use information
To provide the service — matching postings with Pros, scheduling, messaging, notifications about your work, generating invoices, computing wages from time-clock data where a Host uses that feature, processing payments through Stripe, and producing evidence exports. To keep the platform safe — fraud prevention, enforcement of the Terms, and defending legal claims. To improve the product — aggregate, de-identified usage analysis. To communicate — transactional emails about jobs, payments and account security, and (separately, with unsubscribe) product updates.
We do not sell personal information. We do not rent it. We do not use your photos, messages or work records for advertising, and we do not train advertising systems on them.
6. Who sees what
People on the same job — a Host sees the Pro's submitted photos, checklists, times and messages for that job; a Pro sees the property information needed to do the work (address, access notes, checklists). Within a workspace — owners, admins and managers see their team's work data, schedules, time-clock entries and (where configured) wage information; access can be narrowed with groups and per-resource permissions. Public profiles — show only what a Pro chooses to publish, plus earned ratings. Service providers — companies that process data under contract with us, currently: Stripe (payments and payouts), Vercel (application hosting), our managed database provider, and our transactional email provider. Each receives only what its function requires. Legal — we disclose information when a law, court order or government demand requires it, or when necessary to protect someone's safety; where lawful, we tell you first. Business transfer — if CheckedOut is acquired or merges, data transfers with the business under this same policy.
7. Cookies
We use a small number of first-party cookies: co_session (signed login session — essential), co_dev (a random device id set at sign-in and kept two years, used only for account security — see section 3) and short-lived cookies that make forms and redirects work. We do not use third-party advertising cookies or cross-site trackers. Blocking essential cookies will prevent login from working.
8. Retention
Financial records (invoices, payment records, fee breakdowns) — kept at least seven years, as Canadian tax and accounting rules require. Job evidence (photos, timestamps, location points, checklist runs) — kept for the life of the account plus any period needed for open disputes, claims or limitation periods, because its whole purpose is to be available when a question arises later. Messages and work data — kept while the account is active. Server logs — rotated within 90 days. Sign-in records (IP address and device) — kept 90 days. Device fingerprints (hashes, section 3) — deleted two years after the device was last seen. Government ID images (including the ID and selfie sent to reset a sign-in phone) — deleted as soon as the review is done. Credential documents — kept while the credential is on your profile and as its review history. Access codes — kept (encrypted) until the Host removes them or the listing is deleted. When you delete your account, personal data outside those legal-hold categories is deleted or irreversibly anonymized within 30 days; records a Host workspace controls (e.g. your employer's payroll exports) follow the workspace's retention.
What we keep after you delete your account, and why — the one-way identity key made from your ID and the key made from your phone number stay after deletion, together with the account's strikes, no-show findings and blocks. They hold no readable name, birthday or number, and they are used only to stop someone who was banned or struck from simply deleting the account and signing up again. If you believe one is stopping you unfairly, contact us (section 14).
9. Security
All traffic is encrypted in transit (TLS). Passwords are hashed with bcrypt. Sessions are signed server-side tokens. Payment credentials live exclusively with Stripe, a PCI-DSS Level 1 certified processor. Production data access is limited to people who need it to operate the service, and is logged. No system is perfectly secure; if a breach ever creates a real risk of significant harm, we will notify affected users and the Privacy Commissioner as PIPEDA requires, without unreasonable delay.
10. Your rights and choices
You can access what we hold about you, correct anything inaccurate, export your data in a portable format, delete your account, and withdraw consent for optional collections (like location) at any time going forward. Marketing emails always contain an unsubscribe link; transactional emails about your jobs and payments are part of the service. To exercise any right, email support@trycheckedout.com from your account address — we verify identity, answer within 30 days, and never charge for it. If you are unsatisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your local authority.
11. Where data lives
Our infrastructure providers store and process data in Canada and the United States. Wherever it is processed, the same contractual safeguards and this policy apply. By using CheckedOut you consent to this cross-border processing; note that data stored in a country is subject to that country's lawful-access rules.
12. Children
CheckedOut is for adults conducting business. You must be at least 18 (or the age of majority where you live) to hold an account. We do not knowingly collect information from minors; if you believe a minor has an account, contact us and we will remove it.
13. Changes
When this policy changes, the new version is posted here with a new date. If a change meaningfully reduces your rights or expands what we collect, we notify account emails before it takes effect. Continued use after the effective date means the updated policy applies.
14. Contact
Privacy questions and requests: support@trycheckedout.com · legal notices: legal@trycheckedout.com. CheckedOut, Inc., 510 6th Avenue SE, Calgary, Alberta T2G 1L7, Canada.