shimly
Privacy policy
Last updated: October 30, 2026
This policy explains what Shimly collects, why, who it is shared with, where it is stored and what control you have. We have kept it in plain language.
01Who we are
Shimly is construction management software made in Canada by Shadow Access Inc. (“Shadow Access”, “we”, “us”). It has a web app for the office and a mobile app for the field. This policy covers the Shimly apps and the service behind them. Section 13 covers this website, shimly.ca.
Shimly is for businesses. A company (a contractor, renovator or trade business) signs up, invites its team, and puts its own information into Shimly: its clients, jobs, quotes, invoices, photos and so on. In this policy, “your company” means the business that uses Shimly, and “you” means anyone who uses Shimly, whether you are an owner, office user, crew member, client or subcontractor.
Your company decides what information goes into Shimly and why. We handle that information to run Shimly for your company and to keep it safe. If you are a client, subcontractor or crew member of a company that uses Shimly, that company is the best place to start with questions about your information. You can also contact us.
Shimly is in early access, so this policy describes how Shimly is set up to work. If we change a service provider or start handling information in a new way, we will update this page.
02What we collect
We collect only what Shimly needs to work. It comes from you, from your company, and from your use of the apps.
Your account
Your name, email address and phone number, the password you choose, your role in your company (such as owner, project manager or field crew) and your language. Crew who sign in by text message give us their mobile number, and we text a one-time code to it. We also record sign-in activity, such as when you signed in or out, the IP address and the type of device or browser, and when you turn two-step sign-in on or off. We use this to keep accounts secure.
Your company's records
Everything your company puts in: company name and logo, price list, tax settings, jobs and job site addresses (including site notes such as a gate code), quotes, change orders, invoices, payments, costs and receipts, schedules, tasks, daily logs, time clock entries, files, and subcontractor details and certificates. If your company uses team training and licence tracking, that includes training records, licence numbers and expiry dates, and photos of tickets or certificates.
Information about clients and subcontractors
Your company may enter its clients’ and subcontractors’ names, email addresses, phone numbers, addresses and notes. When a client approves a quote or change order, we record what they approved, the name they typed, the time, and their IP address and device or browser type. When a change order is signed on a phone, we also keep the drawn signature and, if location is allowed on that phone, where it was signed. We record when a client opens a quote or project page link, so your company can see it.
Photos, files and voice recordings
Job photos (with captions and any marks drawn on them), receipts, certificates and other files your company uploads. If you use the AI daily log, we also handle the voice recording you make when you tap the microphone, up to three minutes at a time (see section 5).
Location
If you allow it, the mobile app records your phone’s location when you clock in or out, so your company can see whether you were at the job site. Where we have the job site’s coordinates, we also store how far away you were. Shimly asks for location only while the app is open and does not track you in the background. Photos and on-site signatures carry a location only if location is already allowed on that phone. Saying no to location never stops you from clocking in or taking photos.
Billing
When a company subscribes, Stripe collects the payment card and billing address on its own pages. We do not see or store the full card number. We keep the plan, billing period, status, number of extra office users and any discount. If your company takes online payments from its clients, those payments go through the company’s own Stripe account, and we record the amount, date and status of each payment against the invoice.
Messages and notifications
Shimly sends emails, texts and push notifications for your company and for your account: sign-in codes, invitations, quotes and invoice links, payment reminders, schedule changes, a morning email about jobs that need attention, and weekly client updates. We keep a record of which reminders and notices were sent. If you turn on push notifications, we keep a notification token for your phone.
When you contact us
Emails you send to hello@shimly.ca and, if you cancel a plan, the optional reason you choose.
03How we use it
We use information to:
- provide Shimly to your company: store its records, run quotes, jobs, schedules, invoices and the field app, and produce PDFs;
- sign you in and keep accounts and companies secure;
- send the emails, texts and push notifications described above;
- bill for subscriptions and take payments;
- run the AI features you use (section 5) and connect to accounting software when you ask;
- answer your questions and give support;
- meet our legal obligations and protect Shimly, our customers and others from fraud and abuse.
05AI features
Shimly has four AI features. Each one drafts something for your company, and none of them replaces your judgment. They send only the information listed here to our AI provider, and you can switch each feature off in Settings → Features.
- AI daily log. You tap the microphone and talk for up to three minutes. The recording is saved in Shimly’s Canadian storage and sent to Amazon Transcribe in Canada to turn it into text. The transcription copies are deleted once the text is read. The text and the job’s name then go to the AI provider, which sorts it into work done, issues and materials. The draft comes back to the phone with the note “Shimly wrote this. Check it over.” Crew and hours come from the time clock, not from the AI.
- Weekly client updates. The “work done” notes from that week’s daily logs and the job’s name go to the AI provider, which writes two to four plain sentences for the client. Your office can edit or skip each update. If nobody does, it is sent at the scheduled time.
- Quick estimate. The description of the job you type or speak, and the names of items in your own price list (not your prices or costs), go to the AI provider, which suggests which items to add to a quote. Nothing is sent to the client until you send the quote.
- Receipts. The receipt photo or PDF you pick, or one a crew member snaps on the phone, goes to the AI provider, which reads the vendor, date, amounts and category into a form. Your office checks it and saves it.
We do not send your client lists, prices, invoices or other records to the AI provider.
06Where your data is stored
Your data is stored in Canada. Shimly’s database and files are on Microsoft Azure in Toronto.
By “stored” we mean our database and files. Some of the services in section 4 handle information elsewhere, or along the way: the AI provider’s processing region is still being confirmed, so it may be outside Canada, Expo is in the United States, email and text messages travel across networks and carriers, and Stripe, QuickBooks and Xero operate under their own arrangements. If you or your clients use Shimly from outside Canada, the information you open is of course sent to you there.
07How long we keep it
- While your company is open, we keep its records. Cancelling a plan or moving to the Free plan does not delete anything.
- If the owner closes the company, everyone loses access except the owner, who has 30 days to sign in, export the data or reopen the company. After that, the company and all its data and files are permanently deleted. We email the owner when the company is closed, and again 7 days and 1 day before deletion.
- Voice recordings are deleted from Shimly after 30 days. The text of the recording stays with the daily log.
- Exports you prepare are available to download for 7 days.
- Quotes, invoices, payments and signed approvals are business and legal records. Shimly voids or corrects them rather than deleting them, so your history stays complete. Canadian tax law generally requires businesses to keep sales records for six years, and that is your company’s responsibility.
- Links we email to your clients and subcontractors expire, and your company can turn them off at any time.
- Sign-in and activity records (who signed in, and who changed what in a company) are kept for as long as we need them to keep accounts secure and to show an accurate history.
08Export and deletion
Your data is yours. Owners and admins can:
- Export everything from Settings → Your plan and data, in one ZIP: a spreadsheet (CSV) for every kind of record, a PDF of every quote, change order and invoice that was sent, and every photo and receipt. We email you when it is ready. You can also download a single job from its page.
- Remove a client’s personal information on request from the client’s page. This removes their contact details, notes and links. Where a client has a sent invoice or an approved quote or change order, their name and the site address stay on those records because tax law requires the records to be kept, and signed approvals are not touched.
- Close the company from the same page (owner only). See section 7.
If you are not an owner or admin and want information about you removed, email us (section 12).
09How we protect it
These are the safeguards we have built into Shimly:
- Each company’s records are kept apart from every other company’s. The database itself enforces this, not just the app.
- Permissions are checked on our servers, not only hidden on the screen. Costs, margins and pay rates are removed on the server before anything is sent to crew, clients or subcontractors.
- Passwords must be at least 10 characters. Owners are required to turn on two-step sign-in once the company sends its first quote, or 7 days after signing up, whichever comes first, and it is available to everyone. Repeated sign-in and code attempts are limited.
- Text sign-in codes are sent only to phone numbers that a company has invited. Crew can lock the app with a PIN that is stored only on their phone; five wrong tries sign them out.
- Files are stored privately and opened only through Shimly by people who are allowed to see them, never by public link.
- Links we email to clients and subcontractors are long and random. We store only a scrambled version of each, so they cannot be recovered from our database, and an expired or switched-off link shows the same “not found” page as a wrong one.
- Signed approvals, payments, time clock entries and sent invoices cannot be quietly changed. A correction is added as a new entry, and an activity log shows who changed what and when.
- Card numbers never pass through Shimly, and the connection tokens for QuickBooks and Xero are stored encrypted.
No system is perfectly secure. If a breach puts your information at real risk of serious harm, we will report and notify as the law requires.
11Children
Shimly is a business tool. It is not meant for children, and we do not knowingly collect information from them.
12Your rights and how to reach us
Under Canadian privacy law you can ask us for access to the personal information we hold about you, ask us to correct it, withdraw your consent (subject to legal and contractual limits), and ask how we handle your information. To make a request or ask a question, email hello@shimly.ca with “Privacy” in the subject. We will reply within 30 days.
If the information was entered by a company that uses Shimly, such as a client’s contact details, tell us which company. That company decides what it holds, so we may need to pass your request to it, and we will help with it.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or to your provincial privacy regulator.
13Visitors to shimly.ca
This section is about this website, which is separate from the Shimly apps.
- There are no accounts and no tracking or advertising cookies, and we do not run analytics on this site.
- The site loads its fonts from Google Fonts. Your browser asks Google’s servers for them, so Google receives your IP address and browser details.
- The site is delivered by Cloudflare, which, like any web host, handles standard connection details such as your IP address to serve the pages.
- The early access form does not send anything to us from this site. It opens your email app with a message addressed to us, and nothing is stored by the website. If you press send, we receive the email at hello@shimly.ca, which is forwarded to the Shadow Access team, and we use it to reply to you.
14Changes to this policy
When we change this policy we will post the new version here with a new date at the top. If a change is significant, we will also let account owners know.
15Contact
Questions about this policy or your information: hello@shimly.ca. Your message goes to the Shadow Access team, and we usually reply within one business day.