Privacy Policy

1. Overview

ElecPro ("we," "us," or "our") operates a field management platform for electrical contracting businesses. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights regarding that data.

By creating an account or using the Service, you agree to the practices described in this policy. If you are a technician added to an account by a company owner, your employer has accepted these terms on behalf of your company; this policy still governs how we handle your personal information.

2. Information We Collect

2.1 Account and Company Information

When you register, we collect:

• Company name and unique login code
• Owner first and last name
• Business email address and phone number
• Business address, city, state, and postal code
• Electrical contractor licence number (optional)
• Password (stored as a one-way bcrypt hash — we cannot recover it)

2.2 Team Member Information

When you add technicians or staff to your account, we store:

• First and last name, email address, phone number
• Role (Owner or Technician) and permission flags
• Hourly rate (if provided)
• Password hash

2.3 Client and Job Data

As you use the Service, you input data about your customers and work, including:

• Client names, email addresses, phone numbers, and billing/site addresses
• Job titles, descriptions, site addresses, and scheduling information
• Leads, appointments, and permit records
• Estimates, invoices, line items, and payment records
• Time logs and labour entries
• Parts, materials, and purchase orders
• Mileage logs (distance, date, and notes)

2.4 Files and Photos

Photos attached to jobs and receipt images attached to purchase orders are uploaded directly to secure cloud storage (Cloudflare R2). We store a reference key tied to your company. Files are served only via short-lived signed URLs (30-minute expiry) — they are never accessible via a permanent public link.

2.5 Technical and Usage Data

Our servers automatically record standard request logs, including:

• IP address and HTTP request metadata
• Timestamps of API requests
• Error events (stripped of personal data before logging)

We do not use third-party analytics trackers, advertising pixels, or behavioural profiling tools.

2.6 Information We Do Not Collect

ElecPro never receives, processes, or stores the following. Where these are required to accept payments, they are collected directly by Stripe through Stripe-hosted pages that our servers do not see:

• Card numbers, CVC codes, or any cardholder data — your clients enter these on a Stripe-hosted payment page, never on ElecPro
• Bank account or routing numbers, and payout details
• Social Security Numbers, Employer Identification Numbers, or other tax identifiers
• Government-issued identity documents or verification materials
• Date of birth or personal identity data collected during payment-processor onboarding

When you connect a payment account, we create an empty Stripe Express account and redirect you to Stripe's own onboarding flow. You submit your identity, tax and banking details directly to Stripe under the Stripe Connected Account Agreement. The only thing we store as a result is the Stripe account identifier (for example acct_…) needed to associate payments with your company.

Because card details are never transmitted to or through our servers, a compromise of ElecPro could not expose your clients' payment credentials. It could, however, expose the business and client information described in sections 2.1 to 2.4 — see section 4 for how we protect it.

3. How We Use Your Information

We use the data we collect to:

• Create and manage your company account and user sessions
• Provide all features of the Service (jobs, invoicing, scheduling, inventory, reporting)
• Process and record payments via Stripe Connect
• Send transactional emails — invoices, estimates, and password reset links — via Resend
• Send password reset SMS messages via Twilio (only when you request one)
• Maintain audit logs and financial records for your business
• Respond to support requests
• Detect and prevent fraud, abuse, and security incidents
• Comply with applicable legal obligations

We do not use your data for advertising, we do not sell your data to any third party, and we do not build advertising profiles from your usage.

4. How We Store and Protect Your Data

Database

All structured data is stored in a PostgreSQL database hosted by Neon. Every query is scoped to your company's unique identifier — data from one company account is never accessible by another.

Authentication tokens

Access tokens (15-minute lifespan) are signed with HMAC-SHA256 and stored in your browser's localStorage. Refresh tokens (30-day lifespan) are stored in HttpOnly, Secure, SameSite=Strict cookies on web clients and in encrypted device storage on mobile. Refresh tokens are stored as SHA-256 hashes in the database — the raw token value is never persisted. Revoking a session immediately invalidates the token chain.

File storage

Photos and receipt images are stored in Cloudflare R2 under your company's namespace. Files are retrieved only via time-limited signed URLs generated at request time. There are no permanent, guessable public URLs for any uploaded file.

Passwords

All passwords are hashed with bcrypt (cost factor 12) before storage. We cannot retrieve or display your password. If you forget it, you must use the password reset flow.

Infrastructure

Application servers are hosted on Railway. All traffic between your browser and our servers is encrypted via TLS. We apply rate limiting on all authentication endpoints to mitigate brute-force attacks.

If a breach occurs

No system is immune to compromise. If we determine that personal information held in the Service has been acquired by an unauthorised person, we will investigate promptly and notify affected account owners without unreasonable delay, and in any event as required by applicable law, including the Nebraska Financial Data Protection and Consumer Notification of Data Security Breach Act. Our notice will describe what we know about the incident, the categories of information involved, and the steps we are taking. Where you are the controller of affected client data, we will give you the information you need to meet your own notification obligations.

5. Third-Party Services

We share data with the following sub-processors only as necessary to provide the Service:

We do not share your data with any other third parties except as required by law or to protect the rights and safety of ElecPro, our users, or the public.

6. Cookies and Local Storage

We use the following browser storage mechanisms:

• HttpOnly cookie — stores your refresh token on web clients. Marked Secure and SameSite=Strict. Cannot be read by JavaScript.
• localStorage — stores your short-lived access token and cached profile information (name, role, company name). Cleared on sign-out.

We do not use advertising cookies, tracking pixels, or any third-party analytics cookies. The only cookies set are strictly necessary for authentication.

7. Data Retention

We retain your account data for as long as your account is active. If you cancel your account, we will retain Your Data for 30 days to allow you to export it, after which it is deleted from our active production systems. Server-side logs are retained for up to 90 days for security and operational purposes, then automatically purged. Stripe-processed payment records are subject to Stripe's own retention obligations.

We take encrypted backups of the database on a rolling schedule so the Service can be recovered after a failure. Residual copies of deleted data may remain in those backups after they have been removed from active systems, and are erased when the backups containing them expire under our standard retention cycle. Backups are used only to restore the Service, never to reinstate individual records that have been deleted.

8. Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — update inaccurate personal data via your account settings or by contacting us
• Deletion — request deletion of your account and associated data (subject to legal retention obligations)
• Portability — request an export of your structured data in a machine-readable format
• Objection — object to any processing we carry out beyond what is strictly necessary to provide the Service

To exercise any of these rights, email [email protected]. We will respond within 30 days.

9. Client Data You Enter

When you enter your customers' personal information (names, addresses, emails, phone numbers) into ElecPro, you act as the data controller for that information and we act as the data processor. You are responsible for ensuring you have a lawful basis for collecting and storing your customers' data, and for informing them about how it is used.

10. Children's Privacy

The Service is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy as the Service evolves. We will notify you of material changes by email or via an in-app notice at least 14 days before the changes take effect. The effective date at the top of this page will always reflect the latest version.

12. Contact

Questions, requests, or concerns about this Privacy Policy? Contact us at [email protected].