Privacy Policy

1. Overview

ElecPro ("we," "us," or "our") operates a field management platform for electrical contracting businesses. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights regarding that data.

By creating an account or using the Service, you agree to the practices described in this policy. If you are a technician added to an account by a company owner, your employer has accepted these terms on behalf of your company; this policy still governs how we handle your personal information.

2. Information We Collect

2.1 Account and Company Information

When you register, we collect:

• Company name and unique login code
• Owner first and last name
• Business email address and phone number
• Business address, city, state, and postal code
• Electrical contractor licence number (optional)
• Password (stored as a one-way bcrypt hash — we cannot recover it)

2.2 Team Member Information

When you add technicians or staff to your account, we store:

• First and last name, email address, phone number
• Role (Owner or Technician) and permission flags
• Hourly rate (if provided)
• Password hash

2.3 Client and Job Data

As you use the Service, you input data about your customers and work, including:

• Client names, email addresses, phone numbers, and billing/site addresses
• Job titles, descriptions, site addresses, and scheduling information
• Leads, appointments, and permit records
• Estimates, invoices, line items, and payment records
• Time logs and labour entries
• Parts, materials, and purchase orders
• Mileage logs (distance, date, and notes)

2.4 Files and Photos

Photos attached to jobs and receipt images attached to purchase orders are uploaded directly to secure cloud storage (Cloudflare R2). We store a reference key tied to your company. Files are served only via short-lived signed URLs (30-minute expiry) — they are never accessible via a permanent public link.

2.5 Technical and Usage Data

Our servers automatically record standard request logs, including:

• IP address and HTTP request metadata
• Timestamps of API requests
• Error events (stripped of personal data before logging)

We do not use third-party analytics trackers, advertising pixels, or behavioural profiling tools.

3. How We Use Your Information

We use the data we collect to:

• Create and manage your company account and user sessions
• Provide all features of the Service (jobs, invoicing, scheduling, inventory, reporting)
• Process and record payments via Stripe Connect
• Send transactional emails — invoices, estimates, and password reset links — via Resend
• Send password reset SMS messages via Twilio (only when you request one)
• Maintain audit logs and financial records for your business
• Respond to support requests
• Detect and prevent fraud, abuse, and security incidents
• Comply with applicable legal obligations

We do not use your data for advertising, we do not sell your data to any third party, and we do not build advertising profiles from your usage.

4. How We Store and Protect Your Data

Database

All structured data is stored in a PostgreSQL database hosted by Neon. Every query is scoped to your company's unique identifier — data from one company account is never accessible by another.

Authentication tokens

Access tokens (15-minute lifespan) are signed with HMAC-SHA256 and stored in your browser's localStorage. Refresh tokens (30-day lifespan) are stored in HttpOnly, Secure, SameSite=Strict cookies on web clients and in encrypted device storage on mobile. Refresh tokens are stored as SHA-256 hashes in the database — the raw token value is never persisted. Revoking a session immediately invalidates the token chain.

File storage

Photos and receipt images are stored in Cloudflare R2 under your company's namespace. Files are retrieved only via time-limited signed URLs generated at request time. There are no permanent, guessable public URLs for any uploaded file.

Passwords

All passwords are hashed with bcrypt (cost factor 12) before storage. We cannot retrieve or display your password. If you forget it, you must use the password reset flow.

Infrastructure

Application servers are hosted on Railway. All traffic between your browser and our servers is encrypted via TLS. We apply rate limiting on all authentication endpoints to mitigate brute-force attacks.

5. Third-Party Services

We share data with the following sub-processors only as necessary to provide the Service:

We do not share your data with any other third parties except as required by law or to protect the rights and safety of ElecPro, our users, or the public.

6. Cookies and Local Storage

We use the following browser storage mechanisms:

• HttpOnly cookie — stores your refresh token on web clients. Marked Secure and SameSite=Strict. Cannot be read by JavaScript.
• localStorage — stores your short-lived access token and cached profile information (name, role, company name). Cleared on sign-out.

We do not use advertising cookies, tracking pixels, or any third-party analytics cookies. The only cookies set are strictly necessary for authentication.

7. Data Retention

We retain your account data for as long as your account is active. If you cancel your account, we will retain Your Data for 30 days to allow you to export it, after which it is permanently deleted from our systems. Server-side logs are retained for up to 90 days for security and operational purposes, then automatically purged. Stripe-processed payment records are subject to Stripe's own retention obligations.

8. Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — update inaccurate personal data via your account settings or by contacting us
• Deletion — request deletion of your account and associated data (subject to legal retention obligations)
• Portability — request an export of your structured data in a machine-readable format
• Objection — object to any processing we carry out beyond what is strictly necessary to provide the Service

To exercise any of these rights, email [email protected]. We will respond within 30 days.

9. Client Data You Enter

When you enter your customers' personal information (names, addresses, emails, phone numbers) into ElecPro, you act as the data controller for that information and we act as the data processor. You are responsible for ensuring you have a lawful basis for collecting and storing your customers' data, and for informing them about how it is used.

10. Children's Privacy

The Service is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy as the Service evolves. We will notify you of material changes by email or via an in-app notice at least 14 days before the changes take effect. The effective date at the top of this page will always reflect the latest version.

12. Contact

Questions, requests, or concerns about this Privacy Policy? Contact us at [email protected].