Privacy Policy

Last updated: October 26, 2026

This policy explains what personal information SixLabs Inc. ("we") collects through WinCore and this website, why, who we share it with, and what you can ask us to do with it. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, provincial privacy laws such as Québec's Act respecting the protection of personal information in the private sector.

Two roles

• For information about our customers' businesses and users (who signs up, who signs in, who pays us), we decide how it's used, and this policy describes it.
• For information our customers put into WinCore about their own customers (homeowners' names, addresses, phone numbers, quotes, payments), the dealer decides how it's used and we handle it on their behalf, under our Data Processing Addendum. If you're a homeowner with a question about your information, please contact the dealer you worked with first; we'll help them answer you.

What we collect

• Your account: the names and email addresses of the people your company adds, their role, and their sign-in details. Passwords are handled by our sign-in service and never stored by us in readable form.
• Your business's data: what your team puts into WinCore, such as clients, leads, quotes, jobs, appointments, payments and files. It may include your customers' names, addresses and contact details.
• Billing: your company's name, billing email and subscription. Card details go straight to Stripe; we never see or store them.
• Online payments: when a dealer's customer pays through a WinCore payment link, Stripe collects their payment details. We receive the result: amount, method, status, and the name and email Stripe gives us. We never see full card or bank account numbers.
• Technical information: request and error logs (including IP addresses and browser type), kept to keep WinCore secure and working. We don't log the contents of what you type or search for.
• When you contact us: what you send us, so we can answer.

How we use it

To provide WinCore to your company, bill for it, send the emails WinCore sends (such as invitations, password resets, payment requests and receipts), give support, keep the service secure and prevent fraud, meet our legal obligations, and understand, in aggregate, how WinCore is used so we can improve it. We don't sell personal information, and we don't use it for advertising. We'll ask for your consent before using it for anything else.

Who we share it with

Only with the service providers that help us run WinCore, listed on our Subprocessors page, and only what each needs:

• Amazon Web Services hosts WinCore, its database and files, and provides our sign-in and email sending.
• Stripe processes subscription payments and dealers' online payments.
• OpenStreetMap: to place job sites on the map, the street addresses you enter are looked up with OpenStreetMap's address search, and map images are loaded from OpenStreetMap's servers by your browser.

We may also disclose information if the law requires it, to protect people's safety or our rights, or to a business that takes over WinCore, which would have to keep protecting it as this policy says.

Where it's stored

• WinCore runs on Amazon Web Services in its Canada (Central) region, in Montréal. Your data is stored there and encrypted, in transit and at rest.
• Some service providers handle information outside Canada: Stripe in the United States and elsewhere, and OpenStreetMap's address search in the United Kingdom and Europe. Information handled in another country is subject to that country's laws, and authorities there may be able to get access to it. We choose providers that protect it to a standard comparable to Canada's.
• Each company's data is kept separate from every other company's. Professional companies get a database of their own.

Who at SixLabs can see it

Only the people who need it to run and support WinCore. Our team doesn't sign in to your workspace as one of your users. When we need to look inside it to help you, we open a read-only support session that lasts an hour unless extended, shows a banner, and is recorded with who opened it and why.

Cookies and storage

The app keeps you signed in using your browser's storage, and remembers settings such as language and light or dark mode. This website and the app don't use advertising, analytics or tracking cookies. Stripe sets its own cookies on its checkout pages to prevent fraud. If you use the "Book a demo" link, you're taken to Calendly, whose own privacy policy applies.

How long we keep it

• Your company's data: for as long as your company has a WinCore account. After you cancel, it's kept so you can come back, until you ask us to delete it. When a company is deleted, its data can be restored for 30 days and is then removed for good.
• Database backups roll over and are gone within 35 days.
• Request and error logs: up to 90 days.
• Billing records: as long as tax law requires, usually six years.

How we protect it

Encryption in transit and at rest, separate data for each company, access limited to the people who need it, authenticator-protected sign-in for our own team, and records of administrative access. If a breach of security creates a real risk of significant harm to anyone, we'll tell the people affected, the dealers whose data is involved, and the Privacy Commissioner, as the law requires.

Your rights

You can ask to see the personal information we hold about you, have it corrected, have it deleted, or withdraw your consent to a use of it (which may mean we can't keep providing WinCore to you). If it's information your company entered, we'll work with your company's admin. We'll answer within 30 days. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or, in Québec, to the Commission d'accès à l'information, or to your province's privacy commissioner.

Children

WinCore is a business tool, not meant for children, and we don't knowingly collect information about them.

Changes

If we change this policy, we'll update the date above and, for meaningful changes, tell your admin by email.

Contact

Our Privacy Officer is responsible for how we handle personal information. Reach them at dan@sixlabs.ca, SixLabs Inc.