Privacy Policy

• Account data: name, email address, and role for each team member; company name.
• Equipment data: equipment IDs/types, status, location (address and/or coordinates recorded at the time of each scan or edit — not continuous tracking), purchase date, life expectancy, and repair/maintenance history you enter.
• Job/customer data: customer names, job-site addresses, and notes your team chooses to enter against a piece of equipment.
• Usage & log data: an audit trail of who created, edited, scanned, or corrected each record, and when.
• Demo requests: first name, last name, and email address, provided when requesting access to the shared demo account, along with your explicit consent to receive marketing communications.
• CRM connection data: if you connect a third-party CRM (such as HouseCall Pro), we store the API key you provide in encrypted form, used only to call that CRM's API on your behalf.

We don't collect or store your payment card details — our payment processor, Stripe, handles this directly. We also don't collect health information or biometric data.

Primarily to provide the Service to your company: displaying your equipment on a map and list, recording scans and edits, generating the audit log and its exports, sending account-related emails (password resets, team invites), and improving reliability. We do not sell personal information, and we do not use your data to train unrelated third-party products.

If you request a demo, we also use your name and email to send you marketing communications about Equipment-Hub — only if you've explicitly consented to this. Every marketing email includes an unsubscribe link, and you can withdraw consent at any time by contacting us at the address below.

The Service relies on a small number of infrastructure providers to operate:

• Supabase — hosts our database (all account, equipment, and log data).
• Resend — delivers transactional email (password resets, team invites).
• OpenStreetMap / Nominatim — converts GPS coordinates to street addresses (and address searches back to coordinates) when your team scans or enters a location.
• Vercel — hosts the application itself.
• Stripe — processes subscription payments; we never see or store your card details.
• Your connected CRM (e.g., HouseCall Pro) — if you connect one, we call its API using the key you provide, only to power the features you enable. We don't share that key with anyone else. Some providers require a specific plan on their end to issue an API key at all (e.g., HouseCall Pro requires MAX or XL) — that requirement, and any cost of meeting it, is between you and your CRM provider, not something Equipment-Hub charges for.
• Google Analytics / Google Ads — measures site traffic and ad performance.
• Meta (Facebook) Pixel — measures ad performance for our Facebook/Instagram campaigns.

Each acts as a data processor on our behalf under their own terms; we don't share your data with anyone else except as required by law or with your consent. Google and Meta receive standard browser/device information and on-site activity (such as pages visited and whether you signed up) — not your equipment, customer, or job data.

Location is recorded when equipment is scanned or its status is corrected — this can indirectly reveal where the employee doing the scan was standing at that moment. Template note:depending on where your team is located, notifying employees about this (and, in some jurisdictions, obtaining consent) may be a separate legal requirement on top of this policy — that's an employer responsibility, not something this Service enforces automatically.

We use a single session cookie to keep you signed in. We also use Google Analytics/Ads and the Meta (Facebook) Pixel to measure site traffic and ad performance — these set their own cookies and may track activity across sites you visit. You can opt out via your browser's cookie settings, or through Google's and Meta's ad-preference tools.

We retain your data for as long as your account is active. If you close your account, contact us and we'll help you export your data first, then delete it within 30 days.

Passwords are hashed, never stored in plain text. Third-party CRM API keys you choose to connect are encrypted at rest and only decrypted server-side, in memory, when needed to call that provider's API on your behalf — never exposed back to your browser or stored in plain text. Every company's data is scoped to that company at the database level and is not accessible to other companies using the Service. No method of storage or transmission is 100% secure, and we can't guarantee absolute security.

Depending on where you're located (including under PIPEDA in Canada or the GDPR in the EU/UK), you may have the right to access, correct, export, or request deletion of your personal information. Contact us using the details below to make a request.

The Service is intended for business use by adults and is not directed at children.

We may update this policy from time to time; we'll update the date at the top when we do.

Questions about this policy, or to make a data access/deletion request: info@equipment-hub.co