Privacy Policy

Who we are and what this covers

SitewideOps, LLC (“SitewideOps”, “we”, “us”) provides an operations platform for specialty trade contractors, available at app.sitewideops.com and through our mobile field app (together, the “Service”), and operates the marketing website at sitewideops.com (the “Site”).

This policy covers both. It applies to visitors of the Site, to the contractor businesses that subscribe to the Service (each a “Customer”), and to the people who use the Service under a Customer’s workspace (“Users”). Our Terms of Service govern use of the Service itself.

Information we collect

Information you give us

When you request a demo, contact us, or create an account, we collect contact and account details such as your name, work email address, phone number, company name, and role.

Customer Data

The Service exists to run a contracting business, so Customers and their Users enter business records into their workspace: employees and crews, customers and vendors, projects and work orders, schedules, time entries, estimates, purchase orders, bills, invoices, pay applications, journal entries, photos and documents, and similar operational and financial records (“Customer Data”). Customer Data can include personal information about a Customer’s employees and business contacts — for example names, contact details, wage rates, hours worked, and, where a Customer enables mobile time-clock or geofence features, the job-site location captured at clock-in and clock-out.

Each Customer controls what goes into its workspace. SitewideOps processes Customer Data on the Customer’s behalf to provide the Service.

Information collected automatically

Like most online services, we collect standard technical information when you use the Site or the Service: IP address, browser and device type, pages viewed, and timestamps. The Service also keeps an audit trail of actions taken inside a workspace (who created, changed, or approved a record and when) — that audit trail is part of the Customer’s own records and exists for the Customer’s benefit.

The mobile field app additionally sends us its version with each request, and, if you turn on push notifications, the device’s push token so we can deliver them. It can report crashes and errors to us: the technical details of the failure, the app version, and the device model and operating-system version — never the contents of your records, your name, your email address, or your location. Crash reports are not tied to your identity and are used only to fix the app. The mobile app does not read your device’s location, contacts, or advertising identifier, and photos you attach have their embedded metadata (including any GPS position) removed before they are uploaded.

How we use information

We use the information we collect to:

• Provide, operate, secure, and support the Service;
• Set up and maintain accounts, workspaces, and integrations you ask us to connect;
• Send service communications — for example scheduling notifications, portal links, and billing notices — by email or SMS, including messages a Customer directs us to send to its own customers (our SMS Terms describe text-message opt-in and opt-out);
• Respond to demo requests and support questions;
• Bill for the Service;
• Understand how the Site and Service are used so we can improve them; and
• Comply with legal obligations.

We do not sell personal information, and we do not use Customer Data for advertising.

QuickBooks Online and other accounting integrations

SitewideOps can connect to a Customer’s accounting system — currently Intuit QuickBooks Online and Sage Intacct — so that financial documents created in SitewideOps (such as vendor bills, vendor credits, and journal entries) post to the Customer’s general ledger.

• You connect it; we don’t. An integration is only active after a workspace administrator explicitly connects it — for QuickBooks Online, through Intuit’s own OAuth consent screen. We never ask for, see, or store your accounting-system password.
• What we access. We access only the accounting data needed to run the sync the Customer configured: pushing bills, vendor credits, and journal entries; and reading company information, account lists, and document status (for example, whether a bill has been paid). We do not delete records in your accounting system.
• How credentials are stored. OAuth tokens and integration credentials are encrypted at rest and used solely to operate the integration.
• How the data is used. Data exchanged with your accounting system is used only to provide the integration for that Customer. It is never sold, never used for advertising, and never shared with third parties except as described in this policy.
• Disconnecting. A workspace administrator can disconnect an integration at any time from Settings → Integrations (or by revoking access from within Intuit’s or Sage’s own tools). Disconnecting stops the sync, and stored tokens for that connection are discarded. You can also ask us to delete previously synced data by contacting us.

Use of the QuickBooks Online integration is also subject to Intuit’s own terms and privacy policy, which govern the QuickBooks side of the connection.

Bank and card connections (Plaid)

SitewideOps offers a card-transaction feature that imports a Customer’s credit-card and bank activity so purchases can be captured, coded to jobs, and posted to the Customer’s accounting system. We use Plaid Inc. (“Plaid”) to connect the financial accounts a workspace administrator chooses to link.

• You connect it; we don’t. An account is linked only when a workspace administrator completes Plaid’s own Link flow. Your online-banking credentials are entered with Plaid or with your financial institution — SitewideOps never asks for, sees, or stores them.
• What we receive. Through Plaid we receive account information for the linked accounts (institution, account name and type, masked account number) and transaction data (date, merchant, amount). The connection is read-only: we do not receive your banking password, and we cannot move money.
• How it’s used. Imported bank and card data is used only to provide the feature for that Customer’s workspace — capturing transactions, matching receipts, coding spend to jobs, and posting to the general ledger. It is treated as Customer Data under this policy: never sold, and never used for advertising.
• Plaid’s role. When you link an account, you grant SitewideOps and Plaid the right to access and transmit your financial information from the relevant financial institution as described above. Plaid’s collection and handling of that information is governed by the Plaid End User Privacy Policy.
• Disconnecting. A workspace administrator can unlink an account at any time from within the Service, which stops the import and discards the stored access token for that connection. You can also manage or revoke Plaid’s own access at my.plaid.com, and you can ask us to delete previously imported transaction data by contacting us.

Cookies and analytics

The Site uses Google Analytics (GA4) to understand aggregate traffic — which pages people visit and which pages lead to demo requests. Google Analytics sets cookies and receives standard usage data as described in Google’s privacy documentation. You can opt out with Google’s browser opt-out tools or by blocking analytics cookies in your browser.

The Service itself uses cookies and browser storage only for sign-in sessions and product functionality (for example, remembering your column layout) — not for advertising or cross-site tracking. We do not use third-party advertising cookies anywhere.

When information is shared

We share information only with:

• Service providers that help us run the Service, under contracts limiting their use of the data to providing that service to us — currently: Supabase (database and user authentication, including files uploaded to the Service), Hostinger (application server hosting), SendGrid (email delivery), Twilio (SMS delivery), Plaid (bank and card account connectivity, only for accounts a Customer links), and Google Analytics (Site traffic measurement, Site only);
• Integrations the Customer connects, such as QuickBooks Online or Sage Intacct, at the Customer’s direction as described above;
• Recipients the Customer chooses — for example, when a Customer sends a quote, invoice, or portal link to its own customer through the Service;
• Legal and safety recipients, if required by law or reasonably necessary to protect rights, safety, or the integrity of the Service; and
• A successor entity in connection with a merger, acquisition, or sale of assets, in which case this policy continues to apply to the transferred data.

We never sell or rent personal information to data brokers or advertisers.

Mobile numbers and text messaging

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding our SMS delivery provider (Twilio), which processes messages solely so we can deliver the service communications described in this policy. Mobile phone numbers are used only to send those service communications. You can stop receiving text messages at any time by replying STOP to any message — see our SMS Terms for the full opt-in and opt-out policy.

Your workspace’s data belongs to you

As between SitewideOps and a Customer, the Customer owns its Customer Data. We act as a processor/service provider for it: we use it only to provide the Service and never mine it for other purposes.

If you are an employee, customer, or business contact of one of our Customers and have questions about data that business keeps about you in SitewideOps, please contact that business directly — it controls its own records. We will assist our Customers in responding to such requests.

Security

We take security seriously. Measures include encryption in transit (TLS) for all Site and Service traffic, encryption at rest for integration credentials and stored secrets, role-based permissions inside each workspace, audit logging of workspace activity, and access controls limiting who at SitewideOps can reach production systems. No online service can promise perfect security, but we design for it and review it regularly.

Separation between workspaces

Tenant isolation is enforced by PostgreSQL row-level security on every application query. The application connects as a non-owner role without BYPASSRLS; policies on every tenant-scoped table restrict rows to the tenant stamped on the connection. A separate, audited privileged path exists for schema migrations, tenant provisioning and operator lifecycle operations; its call sites are pinned in CI and logged. The Supabase Data API is disabled; all database access is through the application server.

Two limits on that statement, so they are disclosed rather than discovered:

• The database independently enforces this boundary when data is read. When data is written, the workspace a record belongs to is stamped by the application, so a write is not independently checked by the database.
• The privileged database credential is held by the application process for as long as that process runs — not only at startup. It is used only for the operations named above, and the routes that reach it are protected by their own access controls rather than by row-level security.

Data retention, export, and deletion

We keep Customer Data for as long as the Customer’s subscription is active. Customers can export a complete backup of their workspace at any time from within the Service. When a subscription ends, Customer Data remains available for export for sixty (60) days. Within thirty (30) days after that window closes we delete or de-identify Customer Data from production systems, unless we are required to retain it to comply with law, enforce our agreements, or resolve a dispute, in which case we retain only what is needed for that purpose and for no longer than necessary. Backups age out on a rolling schedule within ninety (90) days after deletion from production. Contact, billing, and tax records are kept for as long as applicable law requires (typically seven years for financial records).

Our Data Retention and Deletion Policy sets out the full schedule: how long each kind of data is kept and how it is deleted.

Service providers (sub-processors)

We use the following third parties to run the Service. Each processes information only as needed to provide its service to us and is bound by contract to protect it.

• Supabase — database, user authentication, and storage of files uploaded to the Service
• Hostinger — application server hosting
• SendGrid (Twilio) — transactional email
• Twilio — SMS delivery
• Expo (650 Industries) — delivery of push notifications to the mobile field app, when a User turns them on
• Sentry (Functional Software) — crash and error reports from the mobile field app, not tied to a User’s identity
• Plaid — bank and card account connections, when a Customer enables them
• Intuit — the QuickBooks Online connection, when a Customer enables it
• Sage — the Sage Intacct connection, when a Customer enables it
• Google Analytics (GA4) — aggregate usage analytics on the marketing site

We will update this list when it changes and note the change in the effective date above. Customers who need advance notice of new sub-processors can request it at contact@sitewideops.com.

Your choices and rights

You can access and update your account information in the Service, unsubscribe from non-essential emails using the link in the email, stop receiving text messages by replying STOP to any SMS we send, and ask us to access, correct, or delete personal information we hold about you by emailing contact@sitewideops.com. Depending on where you live, you may have specific legal rights to access, correct, delete, or port your personal information; we honor valid requests under applicable law. We do not discriminate against anyone for exercising privacy rights.

Children’s privacy

The Site and Service are built for businesses and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

Changes to this policy

If we make material changes to this policy, we will update the effective date above and notify Customers through the Service or by email before the changes take effect. Continued use of the Site or Service after changes take effect means the updated policy applies.

Contact us

Questions about this policy or our data practices: contact@sitewideops.com, or by mail to SitewideOps, LLC, 212 N 2nd St, Richmond, KY 40475.

SitewideOps, LLC