Privacy Policy
Last updated: October 17, 2026
- GPS location is captured only at the moment of a punch, never continuously.
- Photos are private: only your employer’s managers can see them.
- We never sell or rent personal information.
- You can access, correct or delete your information at any time.
1. Who we are
Punch it is a mobile timesheet service operated by Snipe Recrutement Inc., based in Montreal. This policy explains how we collect, use, disclose, retain and protect personal information, in accordance with Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25) and, where it applies, Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
2. Our roles
Clients (employers and staffing agencies): for information about their employees and workers, the client is the organization responsible. Punch it acts as a service provider, processes that information only on the client’s instructions and to deliver the service, and uses it for no other purpose.
Managers and website visitors: for information about the client account and its managers, Snipe Recrutement Inc. is the organization responsible.
3. Information we collect
| Who | Information | Why |
|---|---|---|
| Managers | Name, email, password (encrypted), company name | Create and secure the account, contact you, billing |
| Employees / workers | Name, email, PIN (encrypted), schedule, assigned sites | Allow punching and calculate hours |
| On each punch | Date and time, GPS location, approximate address, distance from site, photo | Confirm presence at the workplace and the identity of the person punching |
| Technical | Essential session cookies, security logs (IP address, date) | Keep you signed in, prevent fraud and unauthorized access |
Photos are not used for facial recognition or to build a biometric database: they are simply shown to the manager for verification.
4. Location and camera
Location and camera are used only when the employee taps “Punch in” or “Punch out”, after the browser asks for permission. No location tracking happens between punches or outside working hours. The employee may refuse access; their employer will then see that the punch could not be verified.
5. Consent
We collect information with the consent of the person concerned or as permitted by law. The employer or agency must inform its employees about the use of Punch it and its purposes before their first punch. Anyone may withdraw consent at any time by contacting their employer or us; some features may then no longer be available.
6. Who has access
- Authorized managers of the client company, for their own employees only.
- Our authorized staff, only when needed for technical support or security.
- Our technical providers, bound by contract and confidentiality: database and photo hosting (Supabase), website hosting (Netlify), email delivery, conversion of GPS coordinates into addresses (OpenStreetMap or equivalent) and, where applicable, payment processing.
- Authorities, when required by law.
7. Transfers outside Quebec
Some providers may process or store information outside Quebec, including elsewhere in Canada and in the United States. Before any such transfer, we carry out a privacy impact assessment and ensure by contract that the information receives adequate protection.
8. Retention and destruction
- Punch photos and locations: 12 months, then destroyed.
- Hours worked and timesheets: while the account is active, and as required by the employer’s legal payroll record obligations.
- Closed account: deleted or anonymized within 90 days, unless the law requires otherwise.
9. Security
- Encrypted connections (HTTPS) and encryption at rest.
- Encrypted passwords and PINs; lockout after 5 failed attempts.
- Each company sees only its own data (access rules enforced in the database).
- Photos stored privately, viewable through a temporary 5-minute link.
10. Your rights
Anyone may, free of charge:
- access their personal information and get a copy;
- have it corrected if it is inaccurate or incomplete;
- withdraw consent and request deletion of their information;
- receive their information in a structured, commonly used technological format (portability);
- be informed of the use of location technology and how to turn it off.
Employees may contact their employer or reach us directly. We respond within 30 days and may need to verify your identity.
11. Confidentiality incidents
If an incident presents a risk of serious injury, we promptly notify the Commission d’accès à l’information, the client concerned and the affected individuals, and we keep an incident register.
12. Person in charge of the protection of personal information
Guillaume Barry, President
Snipe Recrutement Inc.
1208, rue Beaubien Est, bureau 123, Montréal (Québec) H2S 1T7
info@sniperecrutement.com · 438-862-1117
You may also file a complaint with the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada.
13. Changes
We may update this policy. The date of the latest update appears at the top of this page. If we make a significant change, we will notify clients by email.