Privacy Policy
1. Who we are and our role
unitbook is run by [to be confirmed], [to be confirmed]. It is software that field-service businesses use to record client assets, service visits, signed reports and invoices.
- As controller for data about our own customers' account holders and website visitors: names, emails, billing and how they use unitbook. This policy covers that data.
- As processor for data our customers record about their own staff and clients, such as a client's name, address and signature on a service report. If you are one of their clients, contact that business first. We help them answer your request.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email, password (stored hashed), role, timezone, agreement to terms | You, at signup or invitation |
| Company | Business name, address, logo, tax number (TRN), invoice and payment settings | Account admin |
| Billing | Plan, subscription status, Stripe customer ID, invoices. We never see or store full card numbers | Stripe |
| Customer records (processor role) | Client names, account numbers, contacts, addresses, assets and serial numbers, form answers, signatures, job photos, service dates | Our customers and their technicians |
| Job location (processor role) | Where a technician's device was when a job was submitted, and where and when a job photo was taken, if the photo records it. Collected only when the customer has location recording on and the technician's browser allows it. Other hidden data in photos (camera details) is removed | Technicians' browsers and photos |
| Usage and security | IP address, login attempts, device and browser type, error logs, timestamps | Automatically |
| Email delivery | Whether emails were delivered or bounced | Postmark |
We do not use advertising trackers or sell personal data.
3. How we use it
| Purpose | Legal basis |
|---|---|
| Provide the Service: accounts, forms, reports, invoices, emails you send to your clients | Contract with you |
| Bill subscriptions and keep financial records | Contract; legal obligation |
| Security: rate-limiting logins, detecting abuse, error monitoring, backups | Legitimate interest in keeping the Service safe |
| Service emails: verification, password reset, receipts, important changes | Contract |
| Improve the Service using aggregated, de-identified statistics | Legitimate interest |
We process customer records only on our customers' instructions, as set out in our Data Processing Agreement.
4. Who we share it with
We share personal data only with providers that run parts of the Service for us, under contracts that require them to protect it:
| Provider | What they do | Location |
|---|---|---|
| DigitalOcean | Hosts the application and database | [to be confirmed] |
| Amazon Web Services (S3) | Stores invoice and service-report PDFs, encrypted | AWS us-east-2 |
| Postmark (ActiveCampaign) | Delivers emails | United States |
| Stripe | Processes subscription payments, acting as merchant of record | United States |
| Google Workspace | Our own email for support conversations | United States |
We may also disclose data if the law requires it, to protect people's safety or our legal rights, or to a buyer if the business is sold, with this policy still applying.
5. How long we keep it
- Account and customer records: while the subscription is active. After it ends, the customer has 30 days to export, then we delete it. Backup copies expire after that.
- Billing records: as long as tax and accounting rules require.
- Activity log (who changed what in a workspace): 24 months, then deleted automatically. Tax registration numbers are never copied into it.
- Deleted PDFs: older stored versions are removed automatically after 30 days.
A customer's admin can delete individual records, users and clients at any time.
6. Security
All traffic uses HTTPS. Stored PDFs are encrypted, kept in a private bucket with public access blocked, and reachable only through the app. Passwords are hashed. Each business's data is separated by account, and staff access follows the roles their admin assigns. Logins are rate-limited and technician app tokens expire.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority as the law requires.
7. Your rights
Depending on where you live, you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong;
- delete your data, or stop or limit how we use it;
- stop sending you email you can opt out of;
- move your data to another provider in a usable format.
Email privacy@unitbook.io. We will reply within 30 days and may need to verify your identity first. We will not treat you differently for using these rights.
If you are in Jamaica, you can also complain to the Office of the Information Commissioner. If your data was recorded by a business that uses unitbook, send your request to that business and we will help them respond.
8. Other details
- Cookies. The office portal uses only cookies it needs to work: a session cookie to keep you signed in and a security cookie (CSRF) to protect forms. We use no advertising or analytics cookies.
- Children. unitbook is a business tool for adults. We do not knowingly collect data from anyone under 18.
- International transfers. Data is stored in the locations listed in section 4, which may be outside your country. We rely on our providers' contractual safeguards for those transfers.
- Changes. We will post updates here and email account admins about material changes before they take effect.
- Contact. [to be confirmed], [to be confirmed], privacy@unitbook.io.