Privacy Policy

1. What we collect

• Account data: name, email, role, language preference, and login activity for each person a Customer invites.
• Data the Customer enters: its own clients' contact details (name, address, phone, email), equipment records, and service history (dates, technician names, notes) — this is the Customer's own business data, stored on its behalf. The Customer is the data controller for this data; we act as its processor.
• Prospect data: if you submit the "interested" form, we collect your company name, contact name, email, city, approximate company size, and any message you include, so we can follow up.
• WhatsApp reminder logs: when a Customer sends a client a service reminder, we log the recipient's phone number and delivery status. Messages are delivered through Meta's WhatsApp Business Platform, subject to Meta's own terms.
• Technical data: a login session cookie (strictly necessary — not used for advertising or cross-site tracking), and a language/appearance preference stored in your browser.

2. How we use it

To operate the Service — store and display a Customer's own records, send reminders a Customer triggers, generate the certificates/reports a Customer requests — and to respond to prospects who ask to be contacted. We also keep a security audit log of administrative actions (e.g. account changes), and a log of sign-in activity (successful and failed login attempts, sign-out, approximate device type and screen size, and IP address) to protect accounts from unauthorized access and misuse. We use this operational and usage data, in aggregate, to understand how the Service is used and to guide product improvements. We do not use a Customer's data to train third-party AI models, and we do not build advertising profiles from it.

3. What we don't do

We do not sell personal data, rent it, or trade it. We do not use a Customer's data to advertise to that Customer's own clients, and we do not access a Customer's data ourselves except to provide support at that Customer's request or as needed to keep the Service secure and operating correctly.

4. Who we share data with

Meta (for WhatsApp reminder delivery, where a Customer enables it), and our hosting/infrastructure providers (to run the Service and keep it backed up). Every such provider is bound to use the data only to provide that specific service to us, never for its own purposes. We do not share Customer data with anyone else except where required by law, and we will notify affected Customers of any such request unless legally prohibited from doing so.

5. Retention and export

Data is retained while an account is active. A Customer can export the entirety of its own data (clients, units, service history, employees) at any time from within the Service. If an account is closed, a firm's records are removed within a reasonable period on request, though a minimal administrative log (e.g. that an account existed, and billing records) may be retained longer where we have a legal or legitimate business reason to do so (e.g. accounting obligations, fraud prevention, dispute resolution).

6. Security

Security is core to what we sell, not an afterthought, so we take it seriously at every layer:

• Tenant isolation: every Customer's data is walled off at the database level (row-level security), not just by application logic — a bug in one part of the Service cannot leak one firm's data into another's.
• Encryption in transit: all traffic to and from the Service is encrypted (HTTPS/TLS).
• Passwords: hashed with scrypt, a salted, industry-standard algorithm — we never store passwords in plain text, and we cannot see them ourselves.
• Access control: the Service is invite-only and role-based; an employee only ever sees their own firm's data. Administrative actions are recorded in an audit log.
• Minimal internal access: our own access to Customer data is limited to what's needed to operate and support the Service.
• Breach notification: in the event of a security incident affecting personal data, we will notify affected Customers without undue delay once we understand its scope, consistent with applicable law.

7. Your rights

If you're an employee of a Customer, your firm's administrator manages your account and can update or remove your access. If you'd like to access, correct, export, or delete data we hold about you, contact your firm's administrator, or reach us directly at contact@extinguo.com. Wherever you're based, we aim to honor the same core rights most data protection laws recognize — access, correction, deletion, and portability of your own data — regardless of whether local law technically requires it. You may also have additional rights under the law of your own country or region.

8. Children

The Service is a business tool and is not directed at children. We do not knowingly collect data from children.

9. International use

The Service is offered to servicing companies in multiple countries. Data may be processed in a country other than the one a Customer or its clients are located in; where that happens, we take steps to keep it protected to the standard described in this policy regardless of where it's processed.

10. Changes to this policy

We may update this policy from time to time; the date above reflects the latest revision. Material changes will be communicated to account administrators.

11. Contact

Questions about this policy: contact@extinguo.com