This policy explains what personal information the Certified Arborist Pro service (the web application, the iOS app, and the sign-in and support pages) collects and how it is used and protected. "We" means [LEGAL ENTITY NAME] ("Provider"). It covers the web app and the iOS app. [OWNER DECISION: an earlier standalone desktop program has been discontinued; it is not covered and should not be used for business data.]
1. Two roles: your employer's data, and ours
Customer Data we host for a company. Certified Arborist Pro is sold to businesses. Each business (the "Customer") gets its own dedicated server and database. The clients, properties, jobs, photos, emails, invoices and staff records in it belong to the Customer. For that data the Customer decides what is collected and why, and we act as its processor / service provider under the Data Processing Addendum. If you are a Customer's client, employee or contractor and want to see, correct or delete your information, ask the Customer first; we will help them respond.
Data we are responsible for ourselves. We act as the controller for: contact and billing details of the people who buy or administer the Service; support emails and requests; security and server logs; and visits to our own sign-in, support and legal pages.
2. What information is processed
| Category | Examples | Who it is about |
|---|---|---|
| Account information | Name, email, phone, role, a salted hash of the password (we never store the password itself), optional two-factor settings and recovery-code hashes, sign-in history | The Customer's staff |
| Client and contact records | Names, addresses and map coordinates, phone numbers, emails, notes, job and invoice history, appointment-reminder preferences | The Customer's clients and their contacts |
| Field documentation | Service reports, tree inventories, assessments, field notes and photographs. Hidden camera metadata (EXIF) is removed from uploaded photos. If the app or a form supplies a location for a photo it is stored with the photo | The Customer's clients and staff |
| Staff and HR records (Team module) | Pay history, certifications and licence numbers, time off, reviews, injuries, home address, and an optional Social Security number. The SSN is stored encrypted, hidden by default, visible only to owners and managers who have been granted HR access, and every reveal is logged | The Customer's employees and contractors |
| If the Customer connects a mailbox, the messages and attachments in the folders it syncs, filed against client records; the connection credentials are stored encrypted | Anyone who corresponds with the Customer | |
| Location (iOS app) | Precise location only while the app is open and a feature that needs it is used (for example, directions to a job or recording a site). We do not track location in the background | The Customer's staff |
| Technical and security data | IP address, browser or device type, app version, request logs, error logs and audit records of who changed what. Logs do not record passwords or sign-in tokens | Everyone who uses the Service |
| Billing and support | Order details, invoices to the Customer, support correspondence | The Customer's administrators |
What we do not do. We do not run advertising or analytics trackers, we do not use third-party analytics SDKs, we do not track you across other websites or apps, we do not sell personal information, and we do not make decisions about people by automated means. The web app uses only the browser storage it needs to keep you signed in and remember your display choices, and a local cache so pages load faster.
3. Why we use it
- To provide the Service the Customer ordered: scheduling, routing, documentation, invoicing, email, reminders and reports.
- To secure the Service: sign-in checks, lockouts, audit trails, abuse prevention and fixing faults.
- To support the Customer and to bill for the Service.
- To meet legal obligations and to protect our rights.
We use Customer Data only for the Customer's purposes and ours as a service provider; we do not use it to advertise or to build profiles for anyone else.
4. Who else receives it
We share personal information only with the providers below, which help us run the Service, and with anyone the Customer connects (for example, its own Microsoft 365 mailbox or QuickBooks) or the law requires. We give notice of changes to this list as the Data Processing Addendum describes.
| Service | What it does for us | What it receives | Where / when |
|---|---|---|---|
| DigitalOcean, LLC | Hosts each Customer's dedicated server, database and uploaded files; optional server backups | All Customer Data, encrypted in transit | United States (San Francisco region). Always |
| Provider's own backup server | Receives the nightly encrypted-in-transit copy of the database and uploaded files, kept for the rotation period in the Service Level Terms | A full copy of Customer Data | United States. Hardware owned and operated by Provider, not a third party |
| Microsoft (Microsoft 365 / Outlook, Microsoft Graph) | Reads and sends the Customer's own company email when the Customer connects a mailbox | Mailbox contents and the messages sent from the app | Customer-directed; only if connected |
| Intuit (QuickBooks) | Accounting integration when the Customer connects QuickBooks Online | Invoice and customer records the Customer chooses to sync | Customer-directed; only if connected (not yet generally available) |
| Stripe, Inc. | Card payments for invoices, on Stripe's own pages | Invoice amount and customer contact details needed to take payment; card numbers go to Stripe, never to us | Customer-directed; only if connected |
| Postmark | Optional delivery of system emails (password links, reminders) when no company mailbox is connected | Recipient address and message content | Only if the Customer's Instance is configured to use it |
| OpenStreetMap Nominatim (OpenStreetMap Foundation) | Turns an address into map coordinates | The address text (and a contact address in the request header) | Public service; when an address is saved or located |
| U.S. Census Bureau Geocoder | Backup address-to-coordinates lookup | The address text | Public service; when an address is saved or located |
| MapTiler or OpenFreeMap / OpenStreetMap tile servers | Draw the base map on the route planner and crew link | The viewer's IP address and the map area requested (no client names) | When a map is shown |
| Apple (App Store, Apple Maps) | Distributes the iOS app; "Navigate" opens Apple Maps | App downloads and crash/usage data under Apple's own terms; a destination address when you tap Navigate | On the user's device |
| Expo (EAS Update) | Delivers over-the-air updates of the iOS app's code | App version and device type; no Customer Data | When the app checks for an update |
Services that never receive Customer Data: our domain registrar and DNS, Let's Encrypt (security certificates), our uptime monitor (it checks that the public address answers), and GitHub (source code and deployments; builds run on our own hardware).
5. How we protect it
- Every connection uses HTTPS (TLS). Each Customer's data lives on its own server and database rather than in a shared one.
- Passwords are stored only as salted hashes. Social Security numbers, mailbox and payment-integration credentials are encrypted with AES-256-GCM using a key kept outside the database.
- Access is role-based. Pay and SSN data need explicit HR access. Administrators can switch a login off at any time, and optional two-factor sign-in (an authenticator app) is available.
- Changes to important records are written to an audit log.
- The database and uploaded files are copied every night to a separate backup server we operate, and the copies are checked automatically.
- We aim to tell affected Customers about a confirmed security incident involving their data without undue delay, as set out in the Service Level and Data Processing terms.
No online service is perfectly secure, and we cannot promise absolute security. We do not hold a third-party security certification (such as SOC 2 or ISO 27001) today.
6. How long we keep it
- Customer Data stays for as long as the Customer's agreement runs. Deleting a client, job, team member or email in the app usually archives it so it can be restored; archived records remain until the Customer's data is deleted.
- After the agreement ends the Customer has a [30]-day return window to export its data, after which we delete the server, database, photos and attachments. Copies in backups age out as backups rotate (about [14] nightly copies), and we delete provider snapshots of the server at the same time. On request we send a deletion certificate.
- Billing and tax records about our own relationship with a Customer are kept for [BILLING-RECORD RETENTION — COUNSEL/ACCOUNTANT].
- Support emails and logs are kept for as long as needed to resolve issues and secure the Service; server logs are rotated automatically.
7. Your choices and rights
Depending on where you live (for example, California or the European Economic Area), you may have the right to know what we hold about you, correct it, delete it, receive a portable copy, object to or limit some uses, and not be treated worse for exercising these rights. For Customer Data, contact the Customer; we will assist them. For data we control, email privacy@certifiedarborist.pro; we will respond within the time the law requires (generally 30 to 45 days) after confirming your identity. We do not sell or "share" personal information for cross-context advertising. You can control iOS permissions (camera, photos, location) in iOS Settings; turning them off limits the features that need them. If you think we have mishandled your information you may complain to your state attorney general or, in the EEA or UK, your data protection authority.
8. Children
The Service is a business tool for adults and is not directed to children. We do not knowingly collect information from anyone under 16.
9. Where data is processed
The Service is hosted in the United States. If you use it from elsewhere, your information is transferred to and processed in the United States. [COUNSEL: add transfer mechanisms (for example, Standard Contractual Clauses in the Data Processing Addendum) if any Customer is in the EEA or UK.]
10. Changes
We will update this policy when our practices change and will post the new effective date here. For material changes we will notify Customers' account owners by email.
11. Contact
[LEGAL ENTITY NAME]
Privacy questions and requests: privacy@certifiedarborist.pro
General support: support@certifiedarborist.pro
Postal address: [POSTAL ADDRESS]