Privacy Policy

Last updated: July 2, 2026

This policy describes how ITMEase ("we," "us") collects, uses, and protects information when you use the ITMEase platform ("Service"). Workspace customers are contractors; the data they store often concerns their own clients and job sites. For that data, the contractor is the data controller and we process it on their behalf.

1. What we collect

• Account data — name, email, hashed password (scrypt; never plaintext), optional TOTP enrollment, sign-in timestamps and IP addresses (for rate limiting and abuse prevention).
• Workspace data — customers, sites, equipment, inspection responses, photos, reports, proposals, and contacts your team enters. This data belongs to your workspace.
• Billing data — subscription state and invoices are handled by Stripe; we never store card numbers.
• Operational data — audit logs of actions in your workspace, error diagnostics (with values scrubbed), and usage timestamps.

2. How we use it

To operate the Service: authenticate users, render and deliver reports you send, bill subscriptions, secure the platform (rate limiting, lockout, audit), and provide support you request. We do not sell personal data and we do not use workspace data for advertising.

3. Where it lives (subprocessors)

• Database hosting — Supabase (managed PostgreSQL, US region)
• Application hosting — Vercel; background processing — Railway
• File storage (photos, PDFs) — Cloudflare R2
• Payments — Stripe
• Transactional email — Microsoft 365 (Microsoft Graph)

4. Tenant isolation and security

Every workspace's data is isolated with database row-level security enforced in addition to application-level checks. Access to your workspace by our support staff happens only through an audited, time-limited impersonation session, and every action taken during one is logged and visible in your workspace audit log.

5. Retention and deletion

Workspace data is retained while your subscription is active. After cancellation or non-payment, data is retained for a 30-day offboarding window (during which you may request an export), then permanently deleted. Inspection photos and reports may be retained longer within an active workspace because they document regulated work — that retention is under your control. To request export or deletion, email jason@itmease.com.

6. Cookies

We use strictly necessary cookies only: an authentication session cookie and a theme preference. No advertising or cross-site tracking cookies.

7. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete personal data. For data in a contractor's workspace, direct requests to that contractor; we support them in fulfilling requests. For account data, contact us directly.

8. Changes and contact

Material changes to this policy will be notified to workspace owners by email. Questions: jason@itmease.com.