Privacy Policy

INTERNAL STAGING TEST DOCUMENT — NOT FOR PRODUCTION USE PRIVACY POLICY This Privacy Policy explains how BusinessManager Staging Sandbox - Internal Evaluation Only, operator of BusinessManager, collects, uses, discloses, retains, and protects information when businesses, workforce users, customer-portal users, prospective customers, and website visitors use BusinessManager or related services. 1. SCOPE AND ROLES This policy applies to information processed through BusinessManager and related platform services. For Customer Data placed in a business workspace, the business generally determines why and how that data is used and BusinessManager Staging Sandbox - Internal Evaluation Only processes it to provide the service. For platform account, security, billing, support, and service-operations information, BusinessManager Staging Sandbox - Internal Evaluation Only may determine the relevant processing purposes as permitted by applicable law. 2. INFORMATION WE PROCESS Depending on features used, we may process account and profile information; business information; employee and workforce data; customer and location records; estimates; work orders; appointments; invoices; payment and refund metadata; vendor, expense, purchase-order, and reporting data; uploaded photos and supporting images; image captions, categories, visibility settings, dimensions, hashes, filenames, and storage metadata; portal activity; support communications; audit and security events; device, browser, IP, session, diagnostic, and usage information; and configuration or integration data. Accepted image uploads are decoded and re-encoded into optimized WebP display and thumbnail renditions. The original uploaded source bytes are not retained after successful processing, although the original filename is retained as metadata. 3. SOURCES OF INFORMATION Information may come directly from users, from the business that administers a workspace, from customer-portal activity, from connected providers and integrations, from payment processors, from security and diagnostic systems, and automatically from use of the service where permitted by law. 4. PURPOSES OF PROCESSING We may process information to provide requested features; create and administer accounts; authenticate users; maintain tenant isolation; process subscription and transaction workflows; provide support; send operational, billing, legal, or security communications; prevent fraud and abuse; investigate incidents; maintain audit records; monitor reliability and performance; improve the service; comply with legal obligations; and establish, exercise, or defend legal claims. 5. CUSTOMER DATA A business controls the operational and customer data it enters into its workspace, including photos and supporting images, and is responsible for notices, consents, permissions, and other legal bases required for that data. Business-originated media is internal by default. An authorized business user may mark a supported image relationship as Customer visible; that visibility setting applies to the specific record relationship and customer-portal access remains scoped to an authenticated membership for the same business, customer, and eligible record. We process Customer Data according to the business's authorized use of the service, documented functionality, security requirements, support needs, and applicable legal obligations. 6. PAYMENT INFORMATION When payment or subscription information is collected through Stripe-hosted or tokenized flows, BusinessManager does not receive or store full card numbers, CVV values, or bank credentials collected by that provider. We may retain transaction identifiers, customer or connected-account identifiers, amounts, statuses, fees, refunds, reconciliation records, invoice allocations, and other metadata needed to operate financial workflows and maintain business records. 7. HOW INFORMATION MAY BE DISCLOSED Information may be disclosed to service providers and subprocessors that support hosting, communications, payment processing, security, diagnostics, support, or other service functionality; to a business and its authorized users within their workspace; to connected services at the user's direction; in connection with a corporate transaction; to professional advisers; or when disclosure is required or permitted by law. We do not sell payment credentials to advertisers. 8. INTERNATIONAL OR CROSS-BORDER PROCESSING Service providers and infrastructure may process information in locations different from the user's location. Where applicable law requires safeguards for cross-border transfers, appropriate contractual or legal mechanisms should be used. 9. SECURITY We use administrative, technical, and application safeguards designed to protect information, including authentication, authorization, tenant-scoped access, audit logging, encryption capabilities provided by infrastructure, secure transport, and hosted/tokenized payment collection where applicable. No method of storage or transmission is completely secure. 10. RETENTION Information is retained for periods reasonably necessary to provide the service, maintain subscription and financial records, preserve security and audit evidence, meet legal or contractual obligations, resolve disputes, enforce agreements, and support legitimate business continuity. Retention periods may differ by record type, account status, backup lifecycle, and legal requirement. Under the media configuration used when this starter copy was generated, a stored image with no active BusinessManager record relationships is eligible for orphan cleanup after 30 days. Removing one relationship does not remove a shared stored image while another active relationship remains. This technical cleanup window is not a substitute for a business's own legal or regulatory retention obligations, and backups, legal holds, security evidence, or other obligations can affect actual retention. 11. PRIVACY RIGHTS AND REQUESTS Depending on applicable law and the individual's relationship to a business using BusinessManager, rights may include access, correction, deletion, restriction, objection, portability, withdrawal of consent, or appeal. For Customer Data controlled by a business, individuals may need to direct requests to that business first. Platform-level privacy questions may be sent to legal-evaluation@businessmanager.com. 12. COOKIES AND SIMILAR TECHNOLOGIES Use of cookies, local storage, and similar browser technologies is described in the published Cookie Policy. Required authentication, security, anti-forgery, and session technologies may be necessary for core service operation. 13. CHILDREN BusinessManager is a business service and is not designed for children to create or administer business accounts. A business that enters information relating to minors is responsible for having the authority and legal basis required for that processing. 14. AUTOMATED DECISIONS Unless expressly identified in the service, BusinessManager does not make legally significant decisions about individuals solely through automated processing. Businesses remain responsible for their own decisions made using reports, workflow information, or other service output. 15. CHANGES TO THIS POLICY Published revisions identify their version and effective date. Material changes may be communicated through the service or an available contact method. Where configured or legally required, affected users may be asked to acknowledge or accept an updated version. 16. CONTACT Privacy questions may be sent to legal-evaluation@businessmanager.com or 305-000-0000, through the support channel provided in BusinessManager, or by mail to 123 Legal Evaluation St, Suite 100, Miami, FL 33101. Additional product information is available at https://localhost:7167. 17. CONFIGURATION SNAPSHOT FOR OPTIONAL TECHNOLOGIES AND THIRD-PARTY SERVICES This version was generated from the service configuration then in effect. The snapshot is preserved in this legal version and is not dynamically rewritten if configuration later changes. Optional-technology posture at draft generation: analytics=off; advertising=off; non-essential browser technologies=off. Not every configured provider is contacted for every user or every page; a provider is used only when the related feature or hosted browser asset is requested. Ordinary network requests to an external provider can include request metadata such as IP address, browser/user-agent information, and the requested resource. Configured third-party service inventory at draft generation: - Stripe | Category: Payment processing and subscription billing | Purpose: Provides hosted/tokenized payment collection, connected-account payment processing, subscription checkout, settlement and webhook events. | When used: Only when a user or business uses an enabled online-payment, connected-account or subscription-billing workflow. | Information involved: Account/contact details and payment or subscription metadata needed for the requested transaction; full card/CVV/bank credentials remain in Stripe-hosted flows. | Provider privacy: https://stripe.com/privacy - Configured SMTP email service | Category: Operational email delivery | Purpose: Delivers account confirmation, recovery, security, billing and other configured operational email messages through the environment-specific SMTP provider. | When used: When BusinessManager sends an enabled email notification through the configured SMTP service. The actual provider can differ by environment. | Information involved: Recipient email address, message content and normal delivery metadata required to transmit the message. | Provider privacy: Not configured - OpenStreetMap, Nominatim and OSRM | Category: Maps, geocoding and routing | Purpose: Provides map tiles, address geocoding and route/directions calculations for map-enabled business workflows. | When used: When an authorized user opens map/directions functionality or the application geocodes an address for that workflow. | Information involved: Requested addresses or coordinates plus ordinary network/request metadata needed to return map, geocoding or routing results. | Provider privacy: https://osmfoundation.org/wiki/Privacy_Policy - Google Fonts | Category: User-interface font delivery | Purpose: Loads the Inter typeface used by current BusinessManager web layouts. | When used: On layouts that reference the configured hosted font stylesheet. | Information involved: Ordinary browser/network request metadata such as IP address, user agent and requested asset information. | Provider privacy: https://policies.google.com/privacy - jsDelivr | Category: Static user-interface asset delivery | Purpose: Delivers selected open-source browser assets such as Bootstrap Icons, SignalR client files and page-specific UI libraries. | When used: On pages that reference one of the configured jsDelivr-hosted assets. | Information involved: Ordinary browser/network request metadata needed to deliver the requested static asset. | Provider privacy: https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net - cdnjs / Cloudflare | Category: Static user-interface asset delivery | Purpose: Delivers the Toastr browser assets used for ephemeral application notifications. | When used: On layouts that load the Toastr stylesheet or script from cdnjs. | Information involved: Ordinary browser/network request metadata needed to deliver the requested static asset. | Provider privacy: https://www.cloudflare.com/privacypolicy/ - unpkg | Category: Map user-interface asset delivery | Purpose: Delivers the Leaflet browser library used by the customer map experience. | When used: When an authorized user opens a page that loads the Leaflet map client. | Information involved: Ordinary browser/network request metadata needed to deliver the requested static asset. | Provider privacy: Not configured