Privacy Policy

1. Who we are

Jobflo (a sole proprietorship operated by Nick Watkins, Reno, Nevada; “Jobflo,” “we,” “us”) provides scheduling, dispatch, invoicing, and payments software for service businesses. This policy covers our website, web app, and any Jobflo-branded mobile apps (together, the “Service”).

2. The data we collect

Account information

When you sign up we collect your name, email address, business name, phone number, and a scrambled (hashed) version of your password. If you turn on Face ID or a passkey, we store a public key for that device. We never see your face, your fingerprint, or your device PIN. Those stay on your phone.

Customer and job data you upload

You upload customer records, job notes, photos, invoices, and similar operational data into Jobflo to run your business. You own this data. We process it on your behalf to provide the Service.

Payment information

Subscription payments are handled by Stripe. We don't store full card numbers on our servers. Stripe sends us a token, the last four digits of the card, the brand, and the expiry date so you can manage your billing.

Usage and device data

We collect basic technical information when you use the Service: browser type, operating system, IP address, pages viewed, actions taken, and timestamps. We use this to keep the Service secure, debug problems, and understand which features are useful.

If you turn on notifications, your browser hands us an address to send them to. That address belongs to Apple, Google, or Mozilla, depending on the browser, and they pass the message along to your device.

Location

Jobflo does not use your phone’s location. The app never asks for location permission and there is no map dot that follows you or your crew around.

What we do have is the addresses you type in. When you save a job address, our server sends that address to Mapbox and gets back a point on a map, so we can drop a pin and put your stops in a sensible order. That point is the address you typed. It is not where your phone is.

Voice

When you speak a job or an invoice, your phone or browser turns your speech into text on the device. Only the text is sent to us. We never record, store, or upload audio.

Communications

If you contact support, we keep a record of the conversation so we can help you and improve our help materials.

3. How we use your data

• Provide, operate, and maintain the Service
• Authenticate you and keep your account secure
• Process subscription payments and send billing receipts
• Respond to support requests
• Send transactional emails (account changes, invoices, alerts)
• Send occasional product updates. You can opt out of marketing email at any time
• Improve the Service: diagnose bugs, measure performance, and prioritize new features
• Comply with legal obligations and enforce our Terms of Service

We do not sell your personal information. We don't use your customer or job data to train machine-learning models.

4. Who we share data with

We use a small group of outside companies to run Jobflo. Each one gets only the data it needs to do its one job, and each one’s own privacy terms cover what we send it. The full list, with what each company receives and why, lives at /subprocessors. That page is the authoritative one and we update it whenever a vendor is added or removed.

The ones every account touches are Vercel (hosting), Supabase (database and login), Cloudflare R2 (file storage), Stripe (your subscription, plus the card payments your customers make to you), Resend (email in and out), Mapbox (maps, and turning a typed address into a map point), Anthropic (the AI that reads invoice photos, voice notes, and new leads), PostHog (counting visits to our public website), Telegram (a phone alert to the owner of Jobflo when somebody signs up or pays), Have I Been Pwned (a breached-password check at signup), and ImprovMX (forwarding mail you send to our support address).

A few more only come into play if you switch on a feature, such as the AI phone assistant or the QuickBooks connection. Those are listed on the subprocessors page too.

We may also disclose data when required by law, to protect our rights, or to investigate fraud or abuse. If Jobflo is acquired or merged, your data may transfer to the new owner subject to this policy.

5. Your rights and choices

You have rights over your personal data. Depending on where you live, these may include:

• Access, request a copy of the personal data we hold about you
• Correction, ask us to fix data that is inaccurate or incomplete
• Deletion, ask us to delete your account and associated data
• Export, receive your data in a portable, machine-readable format (CSV)
• Restrict or object, limit how we process your data in certain cases
• Withdraw consent, where we rely on consent, you can withdraw it at any time

To exercise any of these rights, email support@jobflo.us. We'll respond within 30 days. California residents have additional rights under the CCPA, and residents of the European Economic Area, United Kingdom, and Switzerland have rights under the GDPR. Where Jobflo is a processor (for example, customer records uploaded by your business), please direct individual requests to the business that uploaded the data; we'll assist them in responding.

6. Data retention

We keep your account data for as long as your subscription is active. If you cancel, we keep your data for 60 days so you can reactivate without losing anything, then we delete it from production systems. Encrypted backups are retained for up to 30 additional days before being overwritten. We may keep limited records longer when required by tax, accounting, or legal obligations.

7. Security

We use industry-standard safeguards: TLS for data in transit, encryption at rest on managed databases and object storage, role-based access controls, and audit logs. For a deeper look, see our Security page. No system is perfectly secure, so we also rely on you to keep your password safe and report anything suspicious to support@jobflo.us.

8. Cookies and tracking

Inside the app we use a small number of cookies that are needed to make it work: the one that keeps you signed in, your theme choice, and a flag for the dashboard PIN. Stripe and Supabase also set their own necessary cookies during checkout and sign-in.

On our public website (pages like the homepage and the pricing page) we run PostHog to count page views and see which pages bring people in. We also set one cookie named jf_attr that remembers the first page you landed on and the link that sent you, for up to 90 days. We use that to work out which pages are worth writing more of.

PostHog does not run on your signed-in pages and does not run inside the mobile app. After you sign up, five milestone events are sent to PostHog from our server, tagged with your account ID and nothing else: account created, first job, first invoice sent, trial ending, and subscription started. No names, and nothing about your customers or jobs.

We do not run advertising trackers, ad networks, fingerprinting, or cross-site tracking. We do not sell or share personal information for cross-context behavioral advertising, so a Global Privacy Control signal (the Sec-GPC request header) has nothing to switch off. If that ever changes, we will honor GPC as an opt-out and say so here first.

9. International data transfers

Jobflo is run from the United States and your account data is stored in the United States. If you use the Service from another country, your data is transferred to and processed in the U.S.

Two of the companies we use sit outside the U.S. and we want to be plain about it. Telegram carries the short owner alert described on the subprocessors page, and ImprovMX forwards mail sent to our support addresses. Neither one touches your customer or job data. We rely on Standard Contractual Clauses or equivalent safeguards where they are required.

10. Children

Jobflo is not designed for use by anyone under 16. We don't knowingly collect personal information from children. If you believe a child has provided us data, contact us and we'll delete it.

11. California residents (CCPA / CPRA)

If you're a California resident, the California Consumer Privacy Act as amended by the CPRA gives you specific rights. Some are duplicates of the global rights listed in Section 5, listing them again here for clarity:

• Right to know, what categories of personal information we’ve collected, where it came from, how we use it, and who we share it with.
• Right to delete, request deletion of your personal information, subject to legal-retention exceptions.
• Right to correct, fix inaccurate personal information.
• Right to opt out of sale or sharing, we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of today.
• Right to limit use of sensitive personal information , we collect only the limited set in Section 2 and use it for service delivery, security, and legal compliance.
• Right to non-discrimination, we won't penalize you for exercising any of these rights.

Categories of personal information collected: identifiers (name, email, phone, postal address, IP address), commercial information (subscription tier, payment history), internet and network activity (pages viewed, actions taken), and professional or employment-related information (role, business name). We do not collect precise or approximate device location. The only location-type data we hold is a street address somebody typed in, turned into a map point so we can draw a pin (see Section 2).

Authorized agents: you can authorize someone to submit a request on your behalf. We'll verify the agent's permission to act for you.

To exercise any of these rights, email privacy@jobflo.us. We respond within 45 days and may extend an additional 45 days if needed (we'll tell you why if so).

12. Changes to this policy

We may update this policy from time to time. When we do, we'll change the “Last updated” date at the top and, for material changes, notify you by email or in-app message at least 14 days before the change takes effect.

13. Contact us

For privacy questions, rights requests, or complaints, contact us at privacy@jobflo.us. For security issues, email security@jobflo.us. We aim to acknowledge within two business days and respond fully within 30 days (45 for CCPA requests, see Section 11).