Privacy policy
What this covers
HeadQuarters CRM is field-service software used by maintenance companies. A company signs up on this website; its owner invites the people who work there; those people use the mobile app. This policy describes what the software records, who can see it, and how long it is kept.
Location
The app records a location only at the moment a person clocks in and the moment they clock out, and only if that person has allowed location access on their phone. It never tracks location continuously, and it never records location in the background. Each clock-in or clock-out stores at most one location fix. Managers and owners of the company can see those fixes for the people they supervise.
Photos and documents
Photos, receipts, documents and videos that people attach to jobs are stored on Amazon Web Services in the United States. Location and camera metadata embedded in a photo (EXIF) is removed before the photo is stored; only the image itself is kept.
Who can see what
A company's records are visible only to members of that company, according to their role: owners see everything, managers see their crew's work, service technicians see the jobs assigned to them. The operator of the platform can see which companies exist, their subscription status and how many people they have, and cannot open a company's jobs, contacts, photos, messages or hours.
How long data is kept
If an owner closes the company, its data is deleted. If a company stops paying, its access is reduced in stages and the data is kept for up to five years so the company can return, after which it is permanently destroyed. Deleted photos and files are removed from storage within thirty days of deletion.
Third parties that handle data
The following services process data on our behalf, each for one purpose:
- Amazon Web Services: hosting, file storage and email delivery, such as sign-up codes and invitations (United States).
- Vercel: hosting of this website, including its request logs (United States).
- Stripe: subscription payments. Card details are entered on Stripe's pages and never reach this site or our servers.
- Google: maps in the app and Android push notifications.
- Apple: iOS push notifications.
- Sentry: crash reports, which contain no personal data.
What we do not do
Data is never sold, and never used for advertising.
Deletion and questions
An owner can close the company from the billing page, which deletes the company's data. Anyone can ask for their personal data to be removed by writing to the support address on the support page.