Privacy Policy

Who uses the app

Only staff accounts created by an administrator can sign in. There is no public sign-up. Homeowners do not use the app directly, but information about them is handled as described below.

Information we handle

• Staff accounts: name, email address, password (stored securely by our sign-in provider, never readable by us) and role.
• Customer information from Jobber: customer names, phone numbers, property addresses, assessment schedules, request and client notes, quotes and deposit status. Jobber remains the system of record.
• Photos and markup: photos estimators take of concrete at a property, plus drawn lines, slab outlines and measurements.
• Conversation recordings (optional): audio recorded only after the estimator confirms the homeowner's consent and taps Record.
• Google Calendar (optional): see the dedicated section below.

Where information is stored

• Photos, markup, estimates and recordings are currently stored on the estimator's own device (browser storage). They are not uploaded to our servers except as described in this policy.
• Staff accounts, roles, settings, Jobber and Google connection records and calendar sync records are stored in our cloud backend.
• Jobber and Google access tokens are stored only on our servers, encrypted or held by our connection provider, and are never sent to the browser.

Google Calendar

An estimator may choose to connect their own Google account. We request only these permissions:

• calendar.calendarlist.readonly — to list the estimator's calendars so they can choose one.
• calendar.events — to create, update and delete the appointment events PolyjackFlow made for that estimator's assigned Jobber assessments.

Events contain the customer name, appointment time, property address, customer phone, relevant Jobber notes and links back to the app and Jobber. We do not read, modify or delete other calendar events, do not invite guests, do not access Gmail or contacts, and do not use Google data for advertising, for training AI models, or for any purpose other than this calendar feature. We do not sell Google data. It passes only through the service providers that run the feature, described below.

PolyjackFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Estimators can disconnect at any time in Settings → Google Calendar, and can also revoke access from their Google Account permissions page.

Google user data: what we access, how we use, store and share it

• Data accessed: the list of calendars in the connected Google account (names and IDs), and the events PolyjackFlow itself creates in the one calendar the estimator selects. We also receive the connected account's email address to show which account is connected.
• How it is used: solely to let the estimator pick a calendar and to keep their assigned Jobber assessments in sync on it (create, update when the schedule or notes change, and remove when reassigned or cancelled). A background job does this automatically while sync is turned on.
• Storage: we store the connection, the selected calendar ID and name, sync settings and status, and the IDs of events we created, so we never duplicate or touch other events. OAuth tokens are held server-side by our connection provider and never sent to the browser.
• How it flows and who processes it: requests to Google are made from our servers through Lovable's connection gateway, which holds the OAuth tokens. Our app and database are hosted on Lovable Cloud, which relies on its own infrastructure subprocessors. The calendar list is shown to the estimator in their browser so they can choose a calendar. Google user data is not sold, not used for advertising, not sent to AI models and not shared with Jobber or anyone else. Humans do not read it except with the estimator's permission, for security, or as required by law.
• Disconnecting: when an estimator taps Disconnect in Settings → Google Calendar, sync stops and we immediately delete the stored Google connection and tokens, the selected calendar ID and name, sync settings and status, and the list of event IDs we created. Turning sync off without disconnecting only pauses sync.
• Revoking at Google: disconnecting asks our connection provider to revoke the stored tokens. We cannot confirm that this also removes PolyjackFlow from the Google account's list of connected apps, so to be certain, estimators should also remove PolyjackFlow at myaccount.google.com/permissions.
• What remains after disconnecting: events we already created stay in the estimator's Google Calendar until they delete them. If they reconnect later, the app recognizes those events and updates them rather than creating duplicates. Customer records in Jobber and company estimates are not affected.
• Employees who leave: an administrator deactivates the employee in the app. This blocks sign-in, stops sync and deletes the same Google data described above.

Jobber

An administrator connects our Jobber account. The app reads assessments, customers, notes, quotes and staff assignments, and enforces that each estimator only sees assessments assigned to them. When an estimator explicitly chooses Finalize & Sync, the app adds an internal note and selected marked-up photos to that customer's Jobber record. It does not send emails or texts, or change schedules, quotes, invoices or payments in Jobber.

AI processing

Some optional features send data through the Lovable AI gateway to OpenAI models:

• Photo suggestions (joint lines, slab numbers and outlines) and photo cleanup send the selected photo.
• Generate Summary sends the conversation audio for transcription, then the transcript for a concise summary. Our app does not save the audio or transcript on our servers; only the summary the estimator reviews and saves is kept with the assessment.

AI features run only when a staff member taps them. Google Calendar data is never sent to AI models. Data sent to these providers is handled under Lovable's and the model provider's own terms, which may include temporary retention by the provider for safety and abuse monitoring.

Website early-access requests

If you submit the early-access form on our website, we store your name, company, business email, specialty and any phone number or message you add, plus a one-way scrambled version of your IP address used only to block spam. Only our administrators can see these requests. We use them only to reply to you about PolyjackFlow and do not sell them. Email jeff@stlpolyjack.com to have your request deleted.

Phone calls and texts

Call and Text buttons open the estimator's own phone dialer or messaging app. Nothing is sent automatically and the app does not record calls or messages.

Third-party providers

• Lovable (hosting, cloud database, sign-in, file storage, connection gateway and AI gateway) and its infrastructure subprocessors
• Jobber (customer and scheduling records)
• Google (Calendar, only for estimators who connect it)
• OpenAI (AI models reached through the Lovable AI gateway)

We do not sell personal information.

Retention and deletion

• Device-stored photos, markup and recordings stay until the estimator deletes them or clears the browser's data. Recordings can be deleted from the assessment at any time.
• Temporary photo copies sent to Jobber are deleted once Jobber confirms receipt (links expire after 1 hour).
• Google Calendar data is handled as described in the Google section above.
• Customer records live in Jobber and are kept under our Jobber account according to our business needs and Jobber's own policies. Notes and photos an estimator sends to Jobber become part of those records.
• When an employee leaves, an administrator deactivates their account: sign-in is blocked, their roles are removed and their Google Calendar data is deleted immediately. Their name and email remain on the deactivated account, and business records they created, such as estimates, photos, notes and Jobber notes, are kept as company records.

To request access to or deletion of your information, including removing a deactivated account or events we created in your calendar, email Jeff Wade at jeff@stlpolyjack.com. We aim to respond within 30 days. Some information may be kept where we need it for business, legal or tax reasons.

Security

Access requires a staff login, roles are checked on our servers, private files are stored in access-controlled storage and connections use encrypted HTTPS. No system is perfectly secure.

Children

The app is for business staff only and is not directed to children.

Changes and contact

We may update this policy and will change the date above when we do.

Contact: STL Polyjack — Jeff Wade, jeff@stlpolyjack.com, St. Louis, Missouri, USA.