Privacy Policy

Two kinds of people are described here

Contractors are our customers. They and their staff sign in to ScapeLogic, and we hold their account and business data because they asked us to.

A contractor’s clients — the households and businesses whose properties get serviced — are not our customers. We hold their information on the contractor’s behalf and under the contractor’s instruction. If you are one of them and you want your data corrected or removed, the fastest route is to ask your contractor; they can act immediately. You may also write to us and we will pass it on and support them in carrying it out.

What we collect

• Account details for staff: name, email, role and a hashed password. We never store a password in a form we can read.
• Business records the contractor enters: customers and their contacts, properties and their measurements, schedules, visits, quotes, invoices, projects, documents and messages.
• Field records from the crew app: arrival and completion times, the approximate location recorded at those moments, notes, and photographs of work and of obstacles.
• Payment records. Card numbers are entered directly with our payment processor and never reach our servers. We store the last four digits, the brand, and the processor’s reference.
• Campaign identifiers from the link you arrived on — utm parameters and click ids — kept with your enquiry so the contractor knows which campaign brought you, and kept only for that enquiry’s own period on the Data Retention page.
• Operational logs so we can tell what happened when something goes wrong, and an append-only event log of significant actions taken in the product.

Why we hold it

To provide the product the contractor is paying for: scheduling work, telling clients when a crew is coming, taking payment, and keeping the record of what was done. We also use aggregate, non-identifying figures to understand whether the product is working.

We do not sell personal information, and we do not use a contractor’s business data to train models.

Who else it reaches

These are the services ScapeLogic uses. Each receives only what it needs to do its job.

• Supabase — hosts the database, authentication and file storage. All business data rests here.
• Vercel — runs and serves the application.
• Stripe — processes payments and holds card details.
• Mapbox — draws maps. It receives the map view being requested, not your customer list.
• Intuit QuickBooks — only when a contractor connects it, and only in one direction: we send invoices and payments out, we do not read their books.
• Email and SMS providers — where a contractor has enabled messaging, to deliver the notices they send.

Where it lives

Data is stored in the United States. If you are contacting us from elsewhere, that is where your information will be processed.

How long we keep it

Retention is set out in detail on the Data Retention page, including what happens after an account is closed.

Your data is yours

Every ScapeLogic plan, including the cheapest, includes a one-click export of a contractor’s complete data in open formats. This is not a courtesy we may withdraw; it is how the product is sold.

You may ask us to correct information that is wrong, to give you a copy of it, or to delete it. Write to privacy@scapelogic.com and we will answer within thirty days. Where we hold information on a contractor’s behalf we will tell you so and connect you with them, because they, not we, decide what happens to it.

Some records survive a deletion request because the law requires it — invoices and payment records, chemical application logs where a state mandates them, and the suppression list that records who has asked not to be contacted. That last one is deliberately keyed to the address rather than to an account, so deleting an account cannot accidentally resume messaging somebody who opted out.

If you are in California

California’s privacy law gives you specific rights, and it gives us two different roles depending on whose information is in question. For a contractor’s own account we are a business. For the people in a contractor’s records — their clients and their staff — we are a service provider: we handle that information on the contractor’s instructions and never for purposes of our own.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. There are no advertising scripts, pixels or cookies anywhere in ScapeLogic. If you reached a contractor through an advertisement, the campaign identifiers that were in that link are stored with your enquiry so the contractor can tell which campaign brought you — they are never sent to an advertising platform, and there is no audience to opt out of. We would rather write those sentences than put a “Do Not Sell My Personal Information” link on the page that does nothing when you click it.

One category of sensitive personal information is collected: precise geolocation, recorded when a crew member marks a stop arrived or complete. It exists so a contractor can see that the visit happened. We do not use or disclose it for anything else, which is the limit the law lets you ask for.

You may ask us to:

• tell you what we hold about you, and where it came from;
• give you a copy of it in a portable format;
• correct it, where it is wrong;
• delete it, except the records the law requires us to keep;
• do any of the above without being charged more or served worse. We run one price list and it has no clause about this.

Write to privacy@scapelogic.com. We will confirm who you are before we act, and we answer within thirty days — sooner than the forty-five California allows us. You may use an authorized agent; we will ask them for written permission signed by you. Where the information is held on a contractor’s behalf we will tell you whose it is and pass your request to them.

If you are in the EU or the UK

Under the GDPR we are the controller of a contractor’s account data, and the processor of everything a contractor enters about their own clients — for that, the contractor is the controller and decides what happens to it.

Where we are the controller, we rely on:

• Performance of a contract — running the account we were asked to run, and billing for it.
• Legitimate interests — keeping the service secure and diagnosable: the operational logs and the append-only event log.
• Consent — optional marketing only, withdrawable at any time without affecting anything else.
• Legal obligation — the invoices and payment records we are required to keep, set out on the Data Retention page.

You have the right to:

• see the personal data we hold about you;
• have it corrected;
• have it erased;
• restrict how we process it;
• receive it in a portable format, or have it sent elsewhere;
• object to processing we base on legitimate interests;
• complain to your national supervisory authority, without asking us first.

The address is the same — privacy@scapelogic.com — and so is the thirty days. We do not use your information to make automated decisions that produce legal effects for you: scheduling and routing propose, a dispatcher decides.

About transfers, plainly. ScapeLogic is operated from the United States and every record described above is stored and processed there. We have no establishment in the EEA or the United Kingdom, and we are not currently a party to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement with our customers. If you are established there, or your records hold personal data of people who are, write to us before you sign up and we will tell you whether we can lawfully serve you. We would rather lose the sale than have you rely on a compliance claim we have not made.

Security

Every organization’s data is isolated in the database itself, not merely in application code, so one contractor cannot reach another’s. Connections are encrypted in transit and data is encrypted at rest. Access to production by our staff is limited to what is needed to operate and support the service.

If we ever discover a breach affecting your information, we will tell affected contractors without undue delay and give them what they need to inform their own clients.

Children

ScapeLogic is a tool for businesses and is not directed at children. We do not knowingly collect information from anyone under 13.

Changes

If we change this policy in a way that materially affects how your information is handled, we will tell account administrators before it takes effect rather than quietly changing the date at the top.

Contact

privacy@scapelogic.com