Privacy Policy

Last updated 2026-05-20.

What this covers

This policy describes how ServiceFlow IQ ("we") collects, processes, and protects personal information. We act as a data processor for our customers (trade contractors) and as a data controller for our own customers (the operators who sign up for the platform).

What we collect

• Operator accounts: name, email, password hash (via Supabase Auth), tenant membership.
• Customer records: information operators enter about their end customers — names, addresses, contacts, service history, payment records.
• Usage data: log events, error reports (via Sentry, with PII redaction), feature usage analytics.
• Voice / image data: when operators enable AI features that process voice calls, photos, or signatures, that content flows to our AI processors.
• Geolocation: GPS coordinates from the field-tech mobile app when the operator enables location features.

How we use it

• To provide the Service: dispatch, scheduling, invoicing, payments, communications.
• To improve the Service: aggregate analytics, never on identified individual data.
• To meet legal obligations: tax reporting, fraud prevention.
• We do not sell personal information.
• We do not train foundation models on customer data.

Sub-processors

The full list lives in our developer docs. Notable processors:

• Vercel — hosting + edge runtime (SOC 2 Type II)
• Supabase — managed Postgres, Auth, Storage (SOC 2)
• Stripe — payment processing (PCI DSS Level 1)
• Twilio — SMS + voice (SOC 2)
• Resend — transactional email (SOC 2)
• Anthropic — Claude AI inference (SOC 2). Data is not retained for model training.
• Sentry — error tracking (SOC 2). PII redacted at the source.
• Upstash — rate-limit Redis (SOC 2)

Data retention

We retain customer data for as long as the operator's account is active. Upon termination, operators have 30 days to export. After that, data is purged from primary systems within 14 days and from backups within 90 days.

Audit log entries (the activity_log table) are retained for 7 years to meet financial-records-retention obligations.

Your rights (GDPR / CCPA)

Operators may at any time:

• Access: export all workspace data via GET /api/tenant/export.
• Correct: edit any record directly in the product.
• Delete: cascade-delete the entire workspace via POST /api/tenant/delete with a confirmation phrase.
• Portability: the export endpoint returns JSON with stable schemas.
• Object: opt out of any AI feature in Settings → AI.

Security

We follow the practices documented in our SOC 2 controls mapping: tenant-scoped row-level security on every multi-tenant table, TLS 1.2+ for all transport, HSTS preload, CSP headers, rate limiting, PII redaction in logs, signed customer-portal tokens (HMAC-SHA-256), API key hashing (SHA-256 HMAC).

Children

The Service is not directed at children under 16. We do not knowingly collect personal information from children.

Changes

We will notify operators of material changes to this policy at least 30 days before they take effect.

Contact

Privacy questions or data-subject requests: privacy@serviceflowiq.com.