Privacy Policy

01Scope and who we are

Obraups ("Obraups", "we", "us") provides field service software to trade businesses. This policy explains how we handle personal information when you visit obraups.com, write to us, or use Obraups as a staff member of a business that subscribes to it (a "subscriber").

It doesn't cover how subscribers handle information about their own customers. That is explained in the next section.

02Information businesses keep about their customers

Subscribers use Obraups to keep records about their own customers, such as contact requests, client details, service addresses, emails their customers send to the subscriber's Obraups inbox (with attachments), estimates, signatures, invoices and job photos. For that information, the subscriber decides what is collected and why. Obraups processes it only to provide the service to that subscriber and on its instructions, as its service provider. If a subscriber sends email campaigns, Obraups also keeps who received each campaign, its delivery result, and the addresses that unsubscribed, reported spam or bounced, so they never get campaigns or other marketing emails again (account and service messages continue). Campaign emails carry no tracking pixels or tracked links.

Each subscriber publishes its own privacy policy on its own site. If you are a customer of a business that uses Obraups, please send privacy questions and requests to that business. If you contact us instead, we'll refer you to the business and help it respond where we can.

03Information we collect

• Signup. When someone signs up at obraups.com/signup, we keep the business name, the web address and trade chosen, the person's name, email address, username and password (stored only in hashed form), their preferred languages, the IP address and browser details used, and the time they accepted our Terms of Service and this policy. No account exists until the email address is verified; if it never is, the application is deleted after 7 days, and only a minimal audit entry (the signup reference and the web address chosen) is kept.
• Email you send us. When you email us, we receive your email address, your name if you include it, and whatever you write.
• Account details. For each subscriber account, we keep the business's name and contact details, and the name, username and work email of each staff user (passwords are stored only in hashed form), with a record of each staff user's acceptance of our Terms of Service (the time, the wording shown, the IP address and browser details). We also keep sign-in records, including the IP address used to sign in.
• Billing details. For a subscriber account we keep its subscription, the price we quoted and when and by whom it was accepted, and its billing status. Its invoices, its payment method and the business address used for tax are held by our payment processor, which we send the business name, contact email and (where tax applies) business address to.
• Request and error logs. When you visit obraups.com or use the Obraups application, our servers record each request, including your IP address, the address requested and the response status. When an error occurs, we also record an error log that includes your IP address and browser details.

04How we use it

We use personal information to:

• reply to you and follow up about a demo, a quote or your question;
• set up and run subscriber accounts, including the order or plan each account is on;
• verify email addresses, review new accounts before their public site goes live, and stop automated or abusive signups;
• send signup codes and password reset links;
• provide the service, including processing subscribers' customer data on their instructions;
• keep the service secure, check the emails sent to subscribers' Obraups inboxes for spam and viruses, investigate problems and fix errors;
• tell subscribers about changes to the service, their account or these policies; and
• meet our legal obligations and enforce our Terms of Service.

We don't use personal information for advertising.

05Service providers and sharing

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We haven't done either in the past 12 months.

We use a small number of service providers to run Obraups:

• a hosting provider that runs our servers and database;
• an email provider that sends the emails the service sends, including the marketing campaigns subscribers send to their own customers, and receives the emails sent to subscribers' Obraups inboxes, checks them for spam and viruses and stores them;
• the push service run by each browser's maker, which carries an encrypted notification to a user's device after that user has turned push on (see Notifications); and
• a payment processor that bills subscribers for the service and stores their payment card details. Obraups never receives full card numbers.

They may use personal information only to provide their services to us. We'll give you our current list of service providers on request.

We may also disclose personal information when the law requires it, to protect the rights and safety of our users or others, or as part of a merger, acquisition or sale of our business, in which case this policy continues to apply to it.

06Notifications

The Obraups application can tell a business's staff users, and our own team, when something happens, such as a new contact request or a paid invoice.

• In the app. Each notification is stored with the identifiers of the record it is about and non-personal facts, not names or message text. It is deleted 30 days after it is read, or 180 days after it is created if it is never read.
• Push messages. Push is off until a user turns it on for a browser or device in the application's notification settings. We then keep that device's push address, the keys needed to encrypt messages to it and a short description of the browser, and send an encrypted message through the push service run by the browser's maker. The message says only what kind of event happened, unless the user also chooses to show details, which adds the name of the record. A user can turn push off or remove a device at any time in the application's notification settings. Signing out removes that device, and so does deactivating the user.
• Email. Notification emails are optional and off until a user turns them on for an event. They go to the user's work email address.
• Text messages aren't offered yet.

07Cookies and browser storage

The marketing pages of obraups.com have no forms, set no cookies and use no analytics, advertising, or third-party scripts, fonts or content networks.

The signup pages at obraups.com/signup and the Obraups application use only what they need:

• one session cookie that keeps signed-in users signed in. Page scripts can't read it, it is sent only to the sign-in service, and it expires after 7 days (12 hours for Obraups staff on the platform console);
• while you sign up, a reference to your signup, a masked copy of your email address and the time we last sent you a code, kept in your browser's session storage so the page can resume after a reload; it is cleared when you finish or close the tab;
• your language preference, saved in your browser's local storage; and
• an offline copy of the site's own files, kept by your browser so pages load faster. It doesn't contain your account data.

08Global Privacy Control and Do Not Track

We treat a Global Privacy Control signal as a request to opt out of the sale and sharing of your personal information. Because we don't sell or share personal information and don't track you across other sites, we already honor that choice for everyone, with or without a signal. The same applies to Do Not Track signals.

09How long we keep it

• Request and error logs: deleted after 180 days.
• Email delivery log (recipient and subject, not the message itself): deleted after 180 days.
• Email you send us: kept as long as we need it to respond and follow up, and longer only when we need it for an agreement with you or to meet a legal obligation.
• Account details: kept while the account is active, then as long as we need them to close out the account and meet our legal, tax and accounting obligations.
• Billing details: kept while the account is active, then as long as we need them for legal, tax and accounting obligations.
• Signups whose email address is never verified: the application is deleted 7 days after signup; a minimal audit entry (the signup reference and the web address chosen) is kept.
• Signup applications that were verified: the business name and contact email on the application are deleted 90 days after we finish reviewing the account (the account itself keeps them). The web address, trade and language stay with the account's record while the account exists, and for an account we decline, as long as we keep the record of that review.
• IP address and browser details recorded at signup: the copy kept with the signup application is deleted 90 days after we finish reviewing the account. The copy stored with the record of the Terms acceptance is kept as long as that record, as proof of the agreement.
• Password reset links: work once and expire after 60 minutes. The record of each request, including the IP address it came from, is deleted after a day.
• Records of Terms acceptance: kept while the account exists, and longer when we need them as evidence of the agreement.
• Subscribers' customer data: kept as the subscriber directs and as our Terms of Service describe, except for the emails below.
• Email opt-outs and consent confirmations: when a subscriber's customer unsubscribes from automated emails or reports one as spam, we keep the email address and the dates so the choice is honored. A consent confirmation keeps its time, IP address and browser. Both are kept after a deletion request.
• Emails sent to a subscriber's Obraups inbox (the message and its attachments): deleted 2 years after the last message in the conversation when the subscriber has matched it to one of its clients or contact requests, 1 year after the last message when it hasn't, or after 30 days in the spam folder. When a subscriber erases the personal data of a customer or of someone who emailed it, that person's emails are deleted at the same time. After the subscriber's account closes, the emails are deleted 90 days later.
• Original copies of those emails (kept only to help us fix problems): deleted after 90 days.
• Notifications: deleted 30 days after they are read, or 180 days after they are created if they are never read. The record of whether a push message or email was sent is deleted after 30 days. A device's push registration is kept until the user removes the device, signs out or is deactivated.
• Undelivered mail log (the reason, the address the email was sent to and the sender's email domain, not the message): deleted after 90 days.

Deleted information can stay in our backup copies for up to 8 weeks, until those copies are replaced.

10Your rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong; and
• delete or de-identify your information, except records we must keep for legal, tax or security reasons.

To make a request, email [email protected]. We'll verify your identity before acting on it, usually by confirming details we already hold, such as the email address on your account. We won't treat you differently for using these rights.

If your information is in a subscriber's records because you are its customer, see Information businesses keep about their customers.

11California residents

If you live in California, the California Consumer Privacy Act gives you the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for using these rights.

In the past 12 months we have collected these categories of personal information: identifiers (such as name, email address and IP address), internet activity (request logs and browser details), professional information (the business you work for), and commercial information (your subscription and billing records). We collect them from you, from the subscriber that adds you as a staff user, and from your browser, for the purposes in How we use it. We disclose them for business purposes only to the service providers described in Service providers and sharing. We don't sell or share personal information, and we use sign-in details only to let you sign in and keep the service secure.

You can make a request yourself by emailing [email protected], or through an authorized agent. If an agent contacts us, we may ask for your signed permission and ask you to confirm your identity with us directly.

We'll confirm that we received your request within 10 business days and respond within 45 calendar days. If we need more time, up to another 45 days, we'll tell you why.

12Children

Obraups is a tool for businesses and isn't directed to children under 13. We don't knowingly collect personal information from children. If you believe a child has sent us personal information, email [email protected] and we'll delete it.

13Security

We separate each subscriber's data in the database itself and encrypt connections to the service. Our Security page describes these measures. No system is completely secure, so we can't guarantee that information will never be accessed without permission.

14Changes to this policy

When we change this policy, we'll update the effective date at the top of this page. If a change is material, we'll also tell subscribers by email before it takes effect.

15Contact

For questions or requests about this policy, email [email protected]. For anything else, see our Contact page.