Privacy Policy

1. Who we are

ServiceStead ("we," "us") provides field-service management software for property maintenance businesses at servicestead.com. This policy explains what information we collect, how we use it, and the choices you have. It applies to the businesses that use ServiceStead ("Organizations") and their team members. Organizations are responsible for their own privacy obligations toward their customers whose information they enter into the Service.

2. Information we collect

• Account information — name, email address, and authentication data when you create an account or accept a team invitation.
• Business records you enter — customer and contact details, property addresses, leads, quotes, jobs, visit notes and photos, invoices, and payment records that your Organization creates in the Service.
• Integration data— if your Organization connects an accounting provider (QuickBooks Online or Xero), we exchange the data needed to operate the integration: customer names/emails, invoice line items and totals, payment amounts, and your provider's item, tax, and account reference lists. Access tokens for connected providers are stored encrypted at rest and are never exposed to the browser. We access only the data required to provide the integration, and we do not sell or use it for advertising. Disconnecting removes our stored links and tokens.
• Usage and log data — standard technical logs (IP address, browser type, pages requested) and application audit trails, used for security and troubleshooting.
• Cookies — we use cookies for sign-in sessions and core functionality only, not third-party advertising.

3. How we use information

To provide and operate the Service (scheduling, invoicing, communications, reporting, and integrations you enable); to secure it (authentication, audit logs, fraud prevention); to support you; to send transactional messages (invites, receipts, reminders your Organization configures); and to improve reliability through error monitoring. We do not sell personal information and we do not use your Organization's business records for advertising.

4. Service providers (subprocessors)

We use a small set of providers to run the Service:

• Vercel — application hosting
• Supabase (on AWS) — database, authentication, and file storage
• Stripe — payment processing (card data goes directly to Stripe; we never store card numbers)
• Resend — transactional email delivery
• Twilio — SMS delivery, where an Organization enables SMS
• Geoapify — address geocoding and drive-time routing
• Intuit (QuickBooks Online) / Xero — accounting sync, only when an Organization connects them
• Sentry — error monitoring (events are scrubbed of sensitive values)
• Cloudflare — bot protection on public forms

Each provider processes data only as needed to perform its function for us. We may disclose information if required by law or to protect the rights, safety, or property of ServiceStead or others.

5. Security

All traffic is encrypted in transit (TLS); data is encrypted at rest by our hosting providers. Access to Organization data is enforced with database row-level security so one Organization can never read another's records. Integration credentials (OAuth tokens) are restricted to server-side access only. No method of transmission or storage is 100% secure, but we work to protect your information and will notify affected users of a breach as required by law.

6. Data retention and deletion

We retain Organization data while the account is active. An Organization owner may request export or deletion of their Organization's data by contacting us; we will delete it within a reasonable period except where retention is required by law (for example, financial audit trails). Disconnecting an accounting integration deletes our stored provider tokens and record links immediately; records already in your accounting system are yours and remain there.

7. Your choices and rights

You can access and update your account information in the app. Depending on where you live, you may have rights to access, correct, delete, or port personal information — contact us and we will respond as required by applicable law. If your information was entered by a business using ServiceStead, we may direct your request to that business, which controls the record.

8. Children

The Service is for businesses and is not directed to children under 16; we do not knowingly collect their personal information.

9. Changes and contact

We may update this policy; material changes will be notified through the Service or by email, with the effective date above kept current. Questions or requests: support@servicestead.com. See also our Terms of Service.