Privacy Policy

1. Who We Are and Scope

Isles Mechanical LLC ("Isles Mechanical", "we", "us") operates ServiceRunner, a field-service, maintenance and dispatch platform for businesses. This policy applies to the ServiceRunner website at servicerunner.app, the web application, the iOS and Android apps and related support channels (together, the "Service").

The Service is designed for use by organizations and their staff in a work context. It is not directed at consumers or children. If you are an employee, contractor or client of an organization that uses ServiceRunner, that organization decides what data about you goes into the Service and why; Section 2 explains what that means for your rights.

Where the Service is offered. ServiceRunner is offered only to businesses established in the United States and Canada, and is intended only for use in those two countries (Section 1.3 of the Terms of Service). This policy describes our obligations under United States federal and state privacy law and under Canadian federal and provincial privacy law. We do not represent that the Service, or our handling of personal data, meets the requirements of the laws of any other country, and we do not offer or market the Service outside the United States and Canada.

You can reach our Privacy Officer at privacy@servicerunner.app. Full contact details are in Section 16.

2. Controller and Processor Roles

Privacy laws distinguish who decides why and how personal data is used from who merely handles it on instruction. We act in both roles:

2.1 Where we are the controller

We are the controller (a "business" under California law) for personal data that we collect for our own purposes: account and login details, organization and billing records, support and feedback communications, website visits, usage and diagnostic telemetry, security logs and marketing preferences. This policy is the primary notice for that data.

2.2 Where we are the processor

We are a processor (a "service provider" under California law) for personal data that a customer organization ("Customer") and its users put into the Service or generate by using it: site and task records, photos and their metadata, forms, daily logs, time entries, technician location during shifts, chat messages, and the names, phone numbers, emails and addresses of the Customer's own clients, tenants and site contacts ("Customer Data"). We process Customer Data only on the Customer's documented instructions and under our Data Processing Addendum.

Customer Data also includes the Customer's invoices, accounting records, and end-client payment and agreement records. When a Customer enables QuickBooks Online or card collection, we process those records to operate the connection on its instructions. Intuit and the Customer's connected Stripe merchant account may process data under their own terms and privacy notices as well as any processor arrangements that apply to a particular activity.

If you are a technician, employee, contractor or client of a Customer, the Customer is responsible for telling you how your data is used and for answering your privacy requests. Please contact the organization directly. If you contact us instead, we will pass your request to the Customer and assist them as required by law.

3. Personal Data We Collect

3.1 Account data (controller)

• Name, email address, password hash, phone number, trade or job title, and profile photo.
• Single sign-on identifiers (Google, Microsoft or Apple subject ID) if you sign in that way; we do not receive your SSO password.
• Two-factor authentication secrets, email-verification status and password-reset tokens (stored hashed).
• Session records: session token, device type, browser or device description, IP address, last-active time.

3.2 Organization and billing data (controller)

• Organization name, slug, address, plan, trial and subscription status, seat count, storage usage.
• Our subscription billing contact, invoice history, Stripe payment-method reference and limited card details such as brand and last four digits. End-client invoices, payment records and agreement authorizations belong to Customer Data. We do not receive or store full card numbers or card security codes.

3.3 Usage, telemetry and device data (controller)

• Server logs: request path, timestamp, IP address, user agent, response code, and the acting user and organization ID for authenticated calls.
• Online booking requests: when a visitor sends a callback request from a company's booking page, we keep a keyed, one-way hash of the visitor's IP address (different for every company, not reversible) for 24 hours, only to limit how many requests one address can send. It is never shown to the company, never synced to a device, and is not used to identify or track anyone. The request itself belongs to the company's Customer Data.
• Audit events (who created, changed or deleted a record and when) used for security and to give Customers an audit trail.
• App diagnostics: app version, operating system, device model, crash and sync-error reports, offline-queue status, and whether persistent storage was granted. Optional browser error reports use Sentry only when configured and after you enable diagnostics in Cookie preferences. We do not buffer browser errors before that choice, attach your account identity, or enable session replay or performance tracing. Essential server security and operational logging is separate. See the Cookie Policy.
• Push notification tokens (Firebase Cloud Messaging registration tokens) so we can deliver notifications you enable.

3.4 Precise geolocation of technicians (processor)

When a Customer enables time tracking or dispatch, the mobile app can record the device's precise GPS location (latitude, longitude, accuracy, timestamp) at clock-in and clock-out, periodically while clocked in or on an active dispatch shift (including in the background on native apps), when a proximity prompt fires near a site, and when a photo is taken. Location collection is off unless the Customer turns the feature on and the user grants the device permission; it stops when the user clocks out or ends the shift, or revokes permission. Location history is Customer Data: the Customer decides how long to keep it and who may view it.

3.5 Photos, files and their metadata (processor)

Photos, plans, documents and form attachments uploaded to the Service, together with capture time, device-supplied metadata and, where enabled, the capture location. Photos are automatically optimized on upload, which strips most embedded EXIF metadata other than orientation; the capture time and location, if recorded, are stored as separate fields under the Customer's control.

Receipt photos. When a user photographs a receipt for an expense, the Service sends every page of that receipt to the AI model provider selected for receipt reading (currently OpenAI or Anthropic, chosen by us and listed on the Subprocessors page) to read the vendor, date, amounts, taxes, the last four digits of the card if printed, and line items. A receipt can show a name, a card's last four digits or a store location. The provider returns the fields; we store them with the expense, together with which provider and model read it. Under the provider's business API terms the images are not used to train its models; the provider may keep them for a limited period for abuse monitoring. Each receipt is read once after upload, and again only when a user asks. The user checks and can change every field before submitting. If no provider is available, nothing is sent and the user enters the details by hand.

3.6 End-client and site contact data (processor)

Customers may record names, phone numbers, email addresses, service addresses, gate codes, access instructions and notes about their own clients, tenants, property managers and site contacts, and may send those people quotes, reports or SMS/email notifications through the Service. That data belongs to the Customer.

When enabled, invoice card collection records payment amounts and status, Stripe customer, payment and merchant-account references, limited card details (brand, last four digits and expiry), provider events, refunds or disputes where reported, and reconciliation history. A recurring agreement also records the signer's name and email, accepted wording, schedule, time and audit evidence. Stripe receives card details through its secure payment fields; we do not receive or store the full card number or security code.

A connected QuickBooks Online company supplies company identity, accounting settings, customer and transaction references, and matched payment information. If accounting sync is separately enabled, we may send end-client names and email addresses, issued invoices, recorded payments and supported credits to Intuit and import matched receipts. We retain encrypted OAuth credentials and connection, command, result and reconciliation history needed to operate and audit the integration.

Disconnecting QuickBooks stops new synchronization and removes the active credential from the connection. Revocation of the previous provider grant is queued and can remain uncertain; disconnecting does not erase records already sent to Intuit or the local accounting history. The Customer may also need to revoke access in QuickBooks. Turning off new Stripe collections does not cancel an existing agreement's accepted payment authority; the Customer can pause or cancel that collection separately.

3.7 Communications and support (controller)

• Emails, in-app feedback and bug reports you send us, including any screenshots or diagnostics you attach.
• Records of notifications we send (email, SMS, push), including delivery status.
• Marketing preferences and, if you subscribe, newsletter engagement.

3.8 Cookies and local storage

The Service uses browser storage and app-local storage that is strictly necessary to keep you signed in, remember your organization, work offline and store your cookie choices. We do not use advertising cookies or cross-site tracking. Every key we set is listed in the Cookie Policy.

3.9 Sensitive data

Outside designated Stripe payment fields and provider verification flows, we do not ask for, and Customers should not enter in notes, uploads or messages, full payment card or financial account numbers, card security codes, government identifiers, health data, biometric data, or data about race, religion, union membership or sexual orientation. Precise geolocation is treated as sensitive personal information where the law requires; it is collected only for workforce and dispatch purposes described above and is not used for profiling or advertising.

4. Sources of Personal Data

• You, when you register, fill in your profile, upload content, contact support or use the app.
• Your organization, when an administrator invites you, assigns you to sites, sets your role or records your time and location settings.
• Your device, through permissions you grant (camera, location, notifications) and diagnostic data.
• Single sign-on providers, which pass your name, email and subject ID when you choose to sign in with them.
• Stripe, which passes payment status, invoice events and the last four digits of a card.
• Intuit QuickBooks Online, when your organization connects a company, which supplies company details, accounting settings, transaction references and eligible payment records used for matching and reconciliation.
• Customers' clients, when a Customer records their details, or when a recipient opens a quote or report link we sent on the Customer's behalf.

5. Purposes and Our Basis for Using Data

We use personal data only for the purposes below. In Canada, PIPEDA and the provincial private-sector laws require that we identify those purposes at or before collection and obtain your consent — express where the information is sensitive or the purpose would not be obvious, and implied where a reasonable person would consider the purpose appropriate in the circumstances — subject to the specific exceptions those laws provide. In the United States, state privacy laws require that we use personal data only for the disclosed purposes listed here and for purposes reasonably compatible with them. For Customer Data we act on the Customer's documented instructions, and the Customer is responsible for the notice and consent its own staff and clients are owed.

You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice, as described in Section 12; withdrawal may mean we cannot continue to provide the Service. We do not use personal data for purposes incompatible with those listed without telling you first.

6. How We Share Personal Data

We share personal data only as follows:

• Subprocessors and service providers that host and operate the Service for us, bound by contracts that restrict their use of the data. The current list, with the purpose and location of each, is published on the Subprocessors page and is incorporated into this policy.
• Customer-selected financial services, when the Customer enables them: Intuit receives accounting records for QuickBooks Online sync, and Stripe processes card payments and related end-client information for the Customer's connected merchant account. Intuit and Stripe may act as independent controllers for some activities and processors for others, under their own terms and notices. See the Intuit Privacy Statement and Stripe Privacy Policy.
• Your organization. Administrators of the organization you belong to can see your profile, your role, your activity in the Service and, where enabled, your time entries and location history.
• Recipients you or your organization choose, such as a client who is emailed a quote or report, or another user who is @-mentioned in chat.
• Professional advisers (lawyers, accountants, auditors, insurers) under confidentiality.
• Authorities where required by law, subpoena or court order, or to protect the rights, safety or property of Isles Mechanical, our users or the public. We will notify the affected Customer before disclosing Customer Data unless legally prohibited, and we challenge requests that appear overbroad.
• Successors in a merger, acquisition, reorganization or sale of assets, under this policy, with notice to you.

We do not sell personal data and have not done so in the preceding twelve months. We do not share personal data for cross-context behavioral advertising and do not allow third parties to collect data on the Service for their own advertising. We do not use personal data for targeted advertising.

7. International Transfers

The Service is offered in the United States and Canada. Our subprocessors process data primarily in the United States, and the hosting region for the production database and file storage is chosen by the deployment operator (see the Subprocessors page). If you are in Canada, or in a different country from the one where data is stored, your data will be transferred across a border to be processed.

• Canada to the United States. PIPEDA and the provincial private-sector laws permit a transfer for processing provided the information receives a comparable level of protection while it is in the hands of the processor, and provided you are told the transfer happens. We use written contracts with every subprocessor to require that protection, we review each one's security documentation before onboarding, and we are accountable for the information throughout. Information held in the United States is subject to U.S. law, including lawful access by U.S. courts, law enforcement and national security authorities, and we cannot contract out of that.
• Quebec. Before communicating personal information outside Quebec we conduct the privacy impact assessment Law 25 requires, taking account of the sensitivity of the information, the purpose, the protective measures in place and the legal regime of the destination.
• Within the United States. Data is processed in the region the deployment operator selects. We do not commit to a specific state or to data residency unless it is stated in a signed Order.

You can ask for a summary of the contractual safeguards that apply to a particular subprocessor by contacting the Privacy Officer.

8. Retention

We keep personal data only as long as needed for the purposes above. Customer Data is retained for as long as the Customer keeps it in the Service and is then handled under the Terms of Service (Section 15). Representative periods:

Legal holds, disputes and regulatory investigations may extend these periods. Data in backups is not restored except to recover from a failure, and is overwritten as the backup cycle rotates.

9. Security

We apply technical and organizational measures appropriate to the risk, including: encryption in transit (TLS) for all connections; encryption at rest for databases, backups and object storage; salted password hashing with a memory-hard algorithm; optional two-factor authentication; role-based access control within organizations and sites; signed, expiring links for report and file downloads; API rate limiting; least-privilege access to production for our staff, with logging; separation of development, staging and production environments; automatic photo optimization that removes most embedded device metadata; vulnerability management and dependency updates; and encrypted, tested backups. The security section of the DPA describes these measures in more detail.

No system is perfectly secure. You are responsible for keeping your credentials confidential, enabling two-factor authentication, securing devices used offline, and telling us at security@servicerunner.app about any suspected vulnerability or compromise.

10. Data Breach Notification

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data, we will: contain and investigate it; notify affected Customers without undue delay and in any event within 72 hours of becoming aware, with the information they need to meet their own obligations; notify affected individuals for data we control where the law requires or where the breach is likely to result in a high risk to them; and notify regulators as required (including the Office of the Privacy Commissioner of Canada and the Commission d'accès à l'information du Québec for incidents creating a real risk of significant harm, and U.S. state attorneys general where state law requires). We keep a register of every incident, its effects and the remedial action taken, as Law 25 requires.

11. Your Rights: California (CCPA/CPRA)

This section applies to California residents and supplements the rest of this policy. In the preceding 12 months we collected the categories of personal information listed in Section 3, which map to the statutory categories of identifiers; customer records; commercial information; internet or network activity; geolocation data (precise, for technicians using the mobile app); audio or visual information (photos); professional or employment-related information (role, trade, organization); and inferences drawn only for operational purposes (for example, whether a device is offline). Sensitive personal information we collect is limited to account credentials and precise geolocation.

We collect it from the sources in Section 4, use it for the business purposes in Section 5, and disclose it for business purposes to the service providers on the Subprocessors page. We retain it as described in Section 8.

11.1 Your rights

• Right to know what personal information we collect, use, disclose and sell or share, and to access it;
• Right to delete personal information we collected from you, subject to exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of; we honor the Global Privacy Control signal as a valid opt-out in any case;
• Right to limit use of sensitive personal information. We use sensitive personal information only for the purposes permitted by regulation (providing the Service you requested, security, and, for geolocation, the workforce purposes the Customer configured), so no separate limit is needed;
• Right to non-discrimination for exercising any right; and
• Right to receive notice of financial incentives (we offer none).

11.2 Do Not Sell or Share My Personal Information

ServiceRunner does not sell or share personal information as those terms are defined in the CCPA. If we ever change that, we will add a "Do Not Sell or Share My Personal Information" link to our website and update this policy before doing so. Our website recognizes the Global Privacy Control (GPC) browser signal: when it is present we treat it as an opt-out of sale, sharing and non-essential cookies for that browser.

11.3 How to exercise your rights

Submit a request by emailing privacy@servicerunner.app with the subject "California privacy request", or through the contact page. We will verify the request by matching it to the account email and, where needed, asking for additional information. An authorized agent may submit a request on your behalf if they provide your signed permission and we can verify your identity directly. We respond within 45 days, extendable once by 45 days with notice. Requests about data we process for a Customer will be forwarded to that Customer, which is the "business" responsible for responding.

Notice at collection for job applicants, employees and contractors of Isles Mechanical is provided separately at the time of collection.

12. Your Rights: Canada (PIPEDA and Quebec Law 25)

If you are in Canada, PIPEDA and applicable provincial private-sector laws (including Alberta's and British Columbia's PIPA and Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25) govern our handling of your personal information.

• Accountability. Our Privacy Officer is responsible for our compliance and can be reached at privacy@servicerunner.app. Under Law 25, this person exercises the function of the person in charge of the protection of personal information; their title and contact information are published here.
• Consent. We rely on your express or implied consent, obtained at the time of collection, for purposes a reasonable person would consider appropriate in the circumstances, and on the Customer's authority for Customer Data. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice; withdrawal may mean we cannot continue to provide the Service.
• Access and correction. You may ask what personal information we hold about you, how it is used and to whom it has been disclosed, and ask us to correct it. We respond within 30 days.
• Openness and challenging compliance. This policy, the Subprocessors page and the DPA are our statement of what we do with personal information and who else handles it. You may challenge our compliance with any of the principles by writing to the Privacy Officer; we will investigate, tell you the outcome, and correct our practices where a complaint is justified.
• Cross-border processing. Your personal information may be stored and processed outside Canada, including in the United States, by us and our subprocessors, and may be accessible to the courts, law enforcement and national security authorities of those jurisdictions. We remain accountable for it and require comparable protection by written contract (Section 7).
• Confidentiality incidents. Where an incident involving your personal information presents a real risk of significant harm, we notify the Office of the Privacy Commissioner of Canada and, for Quebec, the Commission d'accès à l'information du Québec, and the individuals concerned, and we keep a register of incidents (Section 10).
• Quebec residents additionally have the right to be informed of and to object to decisions based exclusively on automated processing (we make none), to request de-indexing in the circumstances the law provides, to data portability in a structured technological format, and to file a complaint with the Commission d'accès à l'information du Québec. Privacy settings for optional features default to the highest level of confidentiality. This applies wherever a Quebec resident uses the Service; it does not depend on whether we support invoicing in Quebec.
• Complaints. You may complain to our Privacy Officer and, if unsatisfied, to the Office of the Privacy Commissioner of Canada or the relevant provincial commissioner.

13. Your Rights: Other U.S. States

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Nebraska and Rhode Island, as those laws come into force) may have the right to confirm whether we process their personal data and to access it; to correct inaccuracies; to delete it; to obtain a portable copy; and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in targeted advertising, sale or such profiling. Where the law requires consent to process sensitive data (such as precise geolocation), we obtain it through the device permission prompt and the Customer's configuration.

To exercise these rights, email privacy@servicerunner.app. We respond within 45 days, extendable once by 45 days. If we deny a request you may appeal by replying to our decision with the word "Appeal"; we will respond to the appeal within 45 days (60 in some states) and tell you how to contact your state attorney general if you are not satisfied. Most of these laws apply to data processed in an employment or business-to-business context only in limited ways; where we act as processor, your organization is the controller.

14. Children and Automated Decision-Making

14.1 Children

The Service is for use by adults in a work context. We do not knowingly collect personal data from anyone under 18, and never from children under 13 (or under 16 where that is the applicable threshold). Customers must not invite minors as users. If you believe a child has provided data to us, contact privacy@servicerunner.app and we will delete it.

14.2 Automated decision-making and profiling

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, and we do not profile users. Features such as route optimization, proximity prompts and maintenance reminders are tools that present suggestions to the Customer's staff, who decide what to do; they do not evaluate individuals.

15. Changes to This Policy

We may update this policy as the Service, our subprocessors or the law change. The "Last updated" date shows the current version. For material changes that reduce your rights or expand what we collect or share, we will notify account owners by email and post a notice in the Service at least 30 days before the change takes effect, and, where consent is required, ask for it. Prior versions are available on request.

16. Contact and Privacy Officer

• Privacy Officer: privacy@servicerunner.app
• Privacy requests: privacy@servicerunner.app
• Security: security@servicerunner.app
• General support: support@app.servicerunner.app
• Post: Isles Mechanical LLC, Attn: Privacy (postal address available on request from privacy@servicerunner.app)

Version 2026-09-24. This policy is written in English; where a translation is provided, the English text controls to the extent permitted by law.