Privacy Policy

1. Information We Collect

1.1 Account Information

When you register for an account, we collect your name, email address, phone number, and business name. If you sign up using a third-party identity provider (e.g., Google), we receive your name and email from that provider.

1.2 Business Data You Provide

You enter information about your business operations into the Service, including customer names, addresses, phone numbers, and email addresses; job details and schedules; quotes and invoices; and notes or other records. This data is yours — we store and process it solely to provide the Service to you.

1.3 Payment Information

We do not store credit card numbers or bank account details on our servers. Payment processing is handled entirely by Stripe. When you connect your Stripe account or your customers make payments, Stripe collects and processes financial data under its own Privacy Policy.

1.4 Usage and Device Data

We automatically collect certain technical information when you use the Service, including IP address, browser type and version, device type and operating system, pages visited and features used, and date and time of access. This data helps us maintain and improve the Service.

1.5 Communications

When you contact us for support or send us feedback, we retain the content of those communications along with your contact information so we can respond and improve the Service.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process transactions and send related information (invoices, payment confirmations, reminders)
• Send notifications you have configured (email and SMS appointment reminders, job updates, quote follow-ups)
• Respond to your support requests and communicate about your account
• Monitor and analyze usage trends to improve the Service
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

3. Notifications and Communications

The Service sends transactional notifications on your behalf to your customers (e.g., appointment reminders, invoices, payment receipts) and to you (e.g., job reminders, overdue invoice alerts). These are sent via email and SMS based on your notification preferences.

You can manage which notifications are sent and through which channels in your account settings.

3.1 SMS Messaging Consent

SMS messages sent through the Service are strictly transactional and limited to the following categories:

• Appointment reminders and on-the-way alerts for a scheduled service
• Invoice notifications, payment receipts, and payment reminders
• Quote follow-ups and acceptance confirmations
• Job status updates (completed, rescheduled, cancelled)

Consent. Before any SMS is sent to a recipient through the Service, the business owner using OurWork records explicit consent on the recipient's customer record. Consent is captured per recipient via a dedicated checkbox in the customer form (web and mobile), and the consent timestamp, method, and granting account are stored in the recipient's audit trail. We do not send marketing or promotional SMS, and we do not share recipient phone numbers with third parties for marketing.

Message frequency. Frequency varies based on scheduled service activity — typically 1–4 messages per appointment cycle plus optional invoice and payment notifications.

Cost. Message and data rates may apply. Carriers may charge recipients for messages received depending on the recipient's mobile plan.

Opting out. Recipients can reply STOP (or UNSUBSCRIBE, CANCEL, END, QUIT) to any SMS at any time to immediately revoke consent. The Service records the opt-out, blocks all future SMS to that number, and the recipient's carrier also blocks future delivery at the network layer. Recipients can reply HELP for support contact information. Re-opting in after a STOP requires the business owner to re-collect consent through the customer form.

Carriers and operators. SMS delivery is performed through commercial carriers and may transit Twilio, AWS End User Messaging, and US/Canadian mobile network operators. Neither OurWork, Twilio, nor any mobile carrier is responsible for delayed or undelivered messages.

For the full SMS messaging policy, see our SMS Messaging Policy. For a visual walkthrough of how recipients opt in (including screenshots of the in-app consent checkbox and the confirmation SMS), see our SMS Consent Flow page.

4. Data Sharing and Third-Party Services

We share your information only in the following circumstances:

4.1 Service Providers

We use the following third-party services to operate the platform:

• Amazon Web Services (AWS) — Cloud infrastructure, data storage, email delivery (SES), and SMS notifications (SNS)
• Stripe — Payment processing and merchant account management via Stripe Connect
• Amazon Cognito — Authentication and identity management
• Sentry — Error monitoring and crash reporting (may receive anonymized technical data)

Each provider processes data under their own privacy policy and is contractually obligated to protect your information.

4.2 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of OurWork, our users, or the public.

4.3 Business Transfers

If OurWork is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

5. Data Storage and Security

Your data is stored on Amazon Web Services (AWS) infrastructure in the United States. We implement the following security measures:

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• Authentication via AWS Cognito with secure token handling
• Per-account data isolation — your data is never accessible to other accounts
• Secure credential storage on mobile devices (encrypted keychain/keystore)
• Regular security monitoring and alerting

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your account and business data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your data within 30 days, except where we are required to retain it for legal, tax, or compliance purposes (e.g., invoice records may be retained for up to 7 years).

7. Cookies and Tracking

We use only essential cookies required for the Service to function, such as session tokens and authentication state. We do not use third-party advertising cookies, tracking pixels, or analytics cookies on our marketing site or within the application.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate or incomplete data
• Deletion — Request deletion of your personal data
• Export — Request a machine-readable export of your data
• Restriction — Request that we limit how we process your data
• Objection — Object to our processing of your data in certain circumstances

To exercise any of these rights, contact us at projectourwork@gmail.com. We will respond within 30 days.

9. California Residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights, including the right to know what personal information we collect and how it is used, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your CCPA rights, contact us at projectourwork@gmail.com.

10. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at projectourwork@gmail.com.

11. International Data Transfers

Your data is processed and stored in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a notice within the Service prior to the changes taking effect. We encourage you to review this page periodically. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: