Privacy Policy

That is unusual enough to be worth stating plainly rather than burying. It is also checkable: there is no third-party analytics code in the application to find.

This is a summary, not a substitute. Everything below is the full version — there is no separate longer policy held somewhere else, and nothing in this summary narrows what the rest of the page says.

There are three kinds of people in this system, and the distinction matters:

• Poolhand (us). We provide the software and host it.
• A pool-service company — our customer. It controls its own business records. We process those records on its instructions.
• A homeowner or property manager whose pool is serviced. They have no account with us. Their name, address, phone and email are in our database because their pool company entered them. If that company switches service reports on, we also email them on its behalf — see section 9, including how to stop it.

In data-protection terms: for a pool company’s own account information we are the controller; for the client records that company stores, the company is the controller and we are its processor. See section 9 if you are a homeowner.

We collect these categories of information:

• Account and contact details for the people who sign in and for the company, including a password stored in a form that cannot be reversed. While a signup waits to be confirmed, we hold the details submitted with it.
• Your customers’ details — names, service addresses and contact details your company enters.
• Pool, equipment and site-access records you enter, and the routes and schedules you plan.
• Visit records — visit logs, water readings, chemicals added, notes and photos your technicians record, and the alerts worked out from them.
• Billing details — your plan, subscription, seat counts and a label for the card on file. Card numbers and the billing address you give Stripe are held by Stripe, never by us.
• Technical information — IP addresses, used to rate-limit sign-in and other public requests, and error reports, which we keep free of names and contact details.
• Support messages you send us, with your account details, the screen you were on and the app version, so we can reply.
• On a technician’s phone — a copy of route data so the app works offline, the sign-in token in the phone’s secure storage, and a few preferences, including your email address if you ask it to remember you. Fingerprint and face unlock are handled by the phone itself; we never receive biometric data.

• To run the service — you cannot have route planning without routes, or visit history without visits.
• To sign you in and keep accounts separate — email, password hash and session tokens.
• To bill correctly — seat counts, sign-in timestamps and plan state.
• To keep the service secure — rate limiting, and detecting reuse of a stolen session token.
• To fix what breaks — error reports and support messages.
• To send transactional email — password resets, signup confirmations, and a confirmation link when you change your own sign-in email (with a notice to the old address).
• To send billing email — payment confirmations and account-closing notices go to the billing email address your company sets. It can belong to someone outside your team, such as a bookkeeper; we use it for billing mail only.
• To send service reports — where a pool company has switched them on, a summary of each visit to the client whose pool it was, sent on that company’s behalf. Every one carries a link to stop them; see section 9.
• We send no marketing email — no newsletter and no promotions.

We do not profile users, we do not make automated decisions with legal effects, and we do not use your business data to train anything.

Only the service providers needed to run Poolhand, each limited to providing its service to us, with one exception, Google, described below the list.

• DigitalOcean — hosting, database and file storage.
• Stripe — payments, and, where a pool company bills its own customers through Poolhand, the usage it bills them for, on that company’s own Stripe account.
• Resend — email delivery, including service reports a pool company sends.
• Sentry — error monitoring.
• Cloudflare — DNS and delivery of our sites.
• Better Stack — our status page.

Google (the Android app only). On Android, the app’s map is drawn by Google’s Maps SDK, which sends Google information about your device and how the map is used; Google handles it under its own privacy policy. The iPhone app uses Apple Maps instead.

We will also disclose data if legally required, and we may transfer it as part of a merger or acquisition — in which case this policy continues to apply until you are told otherwise.

We set only strictly necessary cookies: the ones that keep you signed in. Without them you would be signed out on every page load.

Your browser also stores a few preferences locally: whether you chose light or dark mode, whether you folded away the getting-started checklist, and which legal-update notices you have dismissed. None of it leaves your device.

One exception, on one page. The billing page loads Stripe’s payment form, and Stripe sets its own cookies there for fraud prevention. That happens only when you visit billing.

• While your account is open: we keep your business records for as long as you keep them, and we do not delete them on your behalf. We may set fair-use storage limits for photos. If we ever do, you will get at least 60 days’ notice and a way to export before anything is removed.
• After an account ends: we keep your data for 30 days so it can still be exported, then delete it.
• Backups: encrypted backups may hold copies for a limited time after deletion before they rotate out.
• Signup requests: deleted automatically once the confirmation link expires, whether or not it was used.
• Imported spreadsheets: we keep the uploaded rows while an import is in progress so you can review them. A row’s copy is cleared as soon as it is imported or skipped; rows that failed keep theirs so you can see why. The whole import is deleted automatically after a limited period, or sooner if you delete it.
• Session tokens: expire and are purged automatically.
• Billing records: retained as long as tax and accounting law requires.
• Service reports sent: for each one we keep the address it went to, when it was sent, and a copy of what it said, so it can be re-sent exactly. Once a report has been sent, that record is kept permanently and the visit behind it can no longer be deleted. A report that was never sent is deleted with its visit. The record keeps the address even after that client is purged.
• Report delivery problems: if a report email to one of your clients is permanently rejected by their mail server, we keep a note on that client — the date and the reason our email provider gave — and stop sending reports to that address until the address is changed. If the recipient marks a report as spam, we stop sending them reports until you turn reports back on for that client.
• Removing a client: you can archive a client, which hides them everywhere without changing any record and can be undone. An owner can purge an archived client, which permanently erases their email address, phone number and addresses. The client’s name is kept, and your visit records, reports and readings stay where they are. A purge cannot be undone.
• Removing a team member: an owner or manager can deactivate a team member and then delete their account; their name — or the address they signed in with, if no name was set — stays on past visits and activity.

You can ask us to delete sooner — see below — and we will, except where we are legally required to keep something.

Wherever you are, and regardless of which law applies to you, we will honour these requests. California residents have these rights under the CCPA/CPRA; we extend the same treatment to everyone rather than gate it by geography.

• Know what we hold about you and why. This policy sets it out, and we will answer questions about your own data.
• Access and export — a machine-readable copy of your account’s data. Most of it you can download yourself, at any time, without asking us.
• Correct anything inaccurate. Most of it you can edit yourself.
• Delete your data, subject to legal retention requirements.
• Not be discriminated against for exercising any of these. We will not degrade your service or change your price because you asked.

How to exercise them: email privacy@poolhandhq.com from the address on your account. We may ask you to confirm your identity — for a request about an account, being able to sign in to it is normally enough. We respond within the time the law requires.

If your pool is serviced by a company that uses Poolhand, your details are in our system because that company put them there. It decides what to store and for how long; we hold it on their behalf.

Please contact your pool-service company first — they can see, correct and delete your record directly, which is faster than anything we can do. If you cannot reach them, or they will not help, write to privacy@poolhandhq.com and we will help — including passing your request to them and, where the law requires it, acting on it ourselves.

Service reports. If your pool company sends you reports after visits, what they contain is that company’s choice — ask them about it. A report never includes the notes the company keeps for its own internal use.

You can stop these emails at any time, and you do not need an account to do it. Every report has an unsubscribe link at the bottom. If you change your mind later, ask your pool company to turn reports back on for you.

How we protect your data:

• Encrypted in transit.
• Each company’s data is isolated from every other company’s.
• Passwords are never stored in readable form. We cannot recover yours; a reset is the only way back in.
• Photographs are stored privately, and inside the service they are reachable only through short-lived links.
• Hosted with the providers named in section 5.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your data, we will tell you without undue delay and notify regulators where the law requires. If you believe you have found a vulnerability, please write to support@poolhandhq.com; we will not pursue anyone who reports one in good faith.

Poolhand is a tool for businesses and is not directed at children. Accounts require you to be 18 or older, and we do not knowingly collect personal information from children. If you believe a child’s information has reached us, contact privacy@poolhandhq.com and we will delete it.

If we change this policy in a way that materially affects you, we will give account owners at least 30 days’ notice by email and in the app before it takes effect. The version and effective date at the top of this page always tell you which version you are reading.

Poolhand (operated by Tremor Consulting LLC) — privacy questions and data requests: privacy@poolhandhq.com. Anything else: support@poolhandhq.com. See also the Terms of Service.