Privacy Policy

1. Scope and Controller

This Privacy Policy explains how EquipmentFlow processes personal information when you visit a public EquipmentFlow page, create or use an account, receive an invitation, contact us, use the web or mobile Service, or interact with our support and billing channels. EquipmentFlow is the business responsible for the Service-side processing described here. For Customer Data that a company uploads about its workers, contractors, customers, or other individuals, the Customer may be the controller and EquipmentFlow may act as its processor under the Data Processing Addendum.

2. Information We Collect

Account and identity information

We receive names, email addresses, phone numbers, profile images, job roles, company membership, authentication events, and account-security information through account creation, invitations, sign-in, and profile management. Clerk provides identity and authentication services; EquipmentFlow does not store your Clerk password.

Customer operational data

Customers may enter equipment, fleet, vehicle, trailer, job-site, checkout, repair, parts, maintenance, inspection, JSA, timesheet, receipt, purchase, crew, signature, folder, document, QR or barcode identifier, notification, expense, and audit information. Receipt images, uploaded photos, files, notes, signatures, and records may contain personal information chosen by the Customer.

Access and service information

EquipmentFlow records company access, enabled features, support status, and service communications needed to administer the account. EquipmentFlow is currently available without a subscription charge or payment card.

Usage, device, and security information

We collect IP address, browser and device characteristics, approximate location derived from IP, request timestamps, pages or features used, referral information, error data, authentication events, and security or audit events. We use this information to secure, operate, troubleshoot, and improve the Service.

Communications

We collect the contents and metadata of support requests, sales inquiries, privacy requests, invitation messages, and other communications sent to us or through the Service.

3. How We Use Information

• Provide equipment, fleet, maintenance, inspection, JSA, timesheet, receipt, reporting, QR and barcode scanning, account, and collaboration workflows;
• Authenticate users, manage company membership, enforce permissions, and prevent unauthorized access;
• Administer company access, feature availability, service communications, and support;
• Send invitations, service notices, agreement prompts, reminders, security alerts, and transactional communications;
• Host, search, display, export, and maintain Customer Data to provide the connected Service;
• Maintain audit logs, investigate incidents, prevent fraud and abuse, and enforce our agreements;
• Measure performance, diagnose failures, develop features, and improve reliability; and
• Comply with legal obligations and respond to lawful requests.

4. Service Providers and Disclosures

We disclose information only as reasonably necessary to operate the Service, comply with law, protect rights, or complete a transaction. Current service providers include:

• Clerk: authentication, identity, session, email verification, and security features;
• Resend: transactional email delivery for invitations, alerts, and service messages;
• Replit: cloud hosting, application infrastructure, PostgreSQL database, and object storage; and
• Other Customer-authorized integrations: only where enabled by the Customer or required by a requested workflow.

We may disclose information to professional advisers, law enforcement, courts, regulators, acquirers, or successors when legally required or reasonably necessary to protect the Service and its users.

5. Customer Data and Processing Instructions

Customers retain ownership or control of Customer Data. EquipmentFlow processes Customer Data to provide the Service and under the Customer’s instructions, subject to the Data Processing Addendum where applicable. Customers are responsible for providing notices, obtaining permissions, choosing lawful retention periods, responding to individuals, and not uploading data they are not authorized to provide.

6. Cookies and Similar Technologies

EquipmentFlow uses session, authentication, security, preference, and limited operational technologies. Details, browser controls, and third-party cookie information are in the Cookie Policy. Essential technologies are required for sign-in, company isolation, security, and core workflows.

EquipmentFlow requires an internet connection. Devices or browsers may retain sign-in state, preferences, cached images, and unfinished work saved on that device. Preserved device-only drafts and attachments are not offline service or completed submissions and do not automatically submit after reconnection. Users must explicitly recover and submit eligible work while connected. Uninstalling the app or clearing application or browser storage can remove device-only work. A server-saved draft or submitted record is separate from that local copy.

7. Security

The Service uses authentication, permission checks, company-scoped access controls, HTTPS connections, and application logging. These controls do not constitute a security certification or a guarantee that every configuration is secure. No system is completely secure, and EquipmentFlow cannot guarantee uninterrupted availability or that data will never be lost, altered, or exposed. We do not promise a particular backup recovery window or encryption-at-rest configuration that has not been verified. See the Security page for current practices and limitations.

8. Retention and Deletion

Routine retention of company records while using the Service is different from an explicit deletion request. The current implementation does not enforce a minimum three-year retention period across all company records; EquipmentFlow does not currently promise that minimum. Customers should export and independently preserve records needed for their legal or business obligations.

Personal-account deletion and Owner-requested company deletion are scheduled with a 30-day waiting period. Requests can be cancelled before processing; a company deletion hold can delay processing. Eligible requests are processed by a daily background job, so the scheduled date is not a guarantee of completion at an exact time. Personal-account deletion anonymizes the account profile; it does not by itself delete all company operational history. Scheduled company deletion revokes member sessions, anonymizes member profiles, and marks the company deletion completed. The current scheduled process does not automatically erase company operational records or uploaded files. A separate platform-administrator deletion capability can remove company records and attempt file cleanup; it is not the scheduled Owner-requested process.

Some audit, agreement-acceptance, security, or legal records may remain outside the records removed by these workflows. Provider backup retention, deletion of backup copies, and file-cleanup completion times have not been verified as fixed service guarantees. Contact support before submitting a deletion request if records must be exported or a retention obligation needs review.

9. Individual Rights

Profile “anonymization” in the scheduled process redacts selected profile details; it is not comprehensive personal-data erasure. User identifiers, historical record snapshots, and identity-provider records may remain. Contact support about a request covering those remaining records.

La “anonimización” del perfil en el proceso programado oculta determinados datos del perfil; no es un borrado integral de datos personales. Pueden conservarse identificadores de usuario, datos históricos y registros del proveedor de identidad. Contacta a soporte para solicitar la revisión de esos registros.

Depending on location and role, you may request access, correction, deletion, portability, restriction, objection, or information about processing. If your data is contained in a Customer account, we may direct the request to that Customer because the Customer controls the operational record. Contact us at support@equipmentflowco.com; we may verify identity before responding.

10. International Processing and Children

EquipmentFlow and its service providers may process information in the United States and other locations where they operate, using legally recognized transfer mechanisms where required. The Service is for business users and is not directed to children under 16. We do not knowingly solicit personal information from children.

11. Policy Changes

We may update this Privacy Policy to reflect legal, technical, or operational changes. We will update the version, effective date, and “What’s Changed” information and provide notice for material changes where required. The public page does not itself record acceptance of a contractual agreement; acceptance is handled only through the authenticated agreement workflow when a document is assigned and required.

12. Privacy Contact

Questions about this document or a request for legal/privacy support may be sent to support@equipmentflowco.com. Security reports should be submitted through the security report form.