Auxano Privacy Policy

This policy explains what personal information Auxano collects, why, who it is shared with, how long it is kept, and the choices people have. Words such as Company, Owner, Authorized User, End Customer and Records mean what they mean in Auxano's Terms of Service.

1. Two kinds of information, two responsibilities

1.1 Information about Companies and their Authorized Users (accounts, sign-ins, billing with Auxano). Auxano decides how this is used and is responsible for it under this policy.

1.2 Records a Company puts into Auxano about other people: its End Customers, their properties, jobs, invoices, payments and messages, and its employees' and subcontractors' work records. Auxano handles these on the Company's behalf and on its instructions. The Company is responsible for them under its own privacy notice and the law that applies to it. End Customers with questions about their information should contact the Company they deal with. (Lawyer: confirm controller/processor wording and attach a data processing agreement.)

2. What Auxano collects

• Account details: name, email address, phone number, company name, job title and role. Passwords are held by Auxano's sign-in service in scrambled (hashed) form and are never visible to anyone, including Auxano. Two-step sign-in recovery codes are stored hashed.
• Company Records: customers and their contact details and addresses, properties, estimates, jobs, schedules, invoices, payments, refunds, memberships, signatures, photos, videos, documents, messages and notes, as entered by the Company and its users.
• Work records about Authorized Users: clock-in and clock-out times, time on jobs, timesheets, pay rates, tips, commissions, quality scores and ratings, and subcontractor documents such as insurance certificates and tax details where the Company records them.
• Location: when a Company turns on location sharing, an Authorized User's device location while they are clocked in and have agreed to share it. Addresses are also turned into map positions to plan routes.
• Payments: card and bank payments are processed by a payment processor. Auxano stores only limited card details, such as the card brand, last four digits and expiry date, never the full card number.
• Device and usage: IP address, browser and device type, sign-in times, and a log of actions taken in the app (for example who changed a record and when).
• Agreements and decisions: which version of the Terms of Service and this policy was accepted, when, by which account, from which IP address and device; and Auxano's records of branch closures and of a Company leaving Auxano.
• Support: messages sent to Auxano's support.

3. Cookies

Auxano uses cookies that are needed to keep people signed in and to make the app work, for example to remember which email address a signup is waiting on. Auxano does not use advertising cookies, and does not use third-party analytics or tracking.

4. How Auxano uses information

• to provide the app, carry out what Companies and their users ask it to do, and keep it working
• to keep accounts secure: sign-in checks, two-step sign-in, logs that show who did what
• to send messages a Company asks Auxano to send, and service messages about the account
• to bill Companies for Auxano and to keep Auxano's own tax and accounting records
• to provide support, and to improve and fix the app
• to keep evidence of agreements and of closures, to resolve disputes, and to meet legal obligations

Auxano does not sell personal information, and does not use Records to advertise to anyone.

5. Who Auxano shares information with

Auxano uses service providers that handle information only to run Auxano for it:

• hosting and database (Supabase)
• file storage for photos, videos and documents (Cloudflare R2)
• email delivery (Resend) and text-message delivery (Twilio or Telnyx)
• card and bank payment processing (Stripe or another processor Auxano uses)
• maps and address lookup (the US Census Geocoder, and Google Maps where turned on)
• AI drafting, when a Company uses AI features (Anthropic or OpenAI): only the text needed for the draft is sent
• printing and mailing of postcards, when a Company sends them

A Company can also connect other services it chooses, such as QuickBooks, Google Calendar or Microsoft Outlook. Information sent to those services is then also governed by their terms.

Auxano may also share information when the law requires it, to protect people or Auxano's rights, or as part of a sale or merger of Auxano's business (with this policy continuing to apply). (Lawyer: review the provider list against signed agreements before launch.)

6. Messages to End Customers

Messages a Company sends through Auxano (reminders, invoices, marketing and others) are the Company's messages. The Company is responsible for having the consent the law requires. Auxano lets the Company record each End Customer's marketing opt-outs and "do not contact" choices, and holds marketing messages back from people who opted out.

7. How long information is kept

• While a Company uses Auxano, its Records are kept until the Company deletes them, except that money records of a closed branch are kept read-only for about seven years, and job photos and videos of a closed branch are deleted after a warning and a chance to download them.
• When a Company leaves Auxano, the Owner has 60 days to download its Records. After that, all of its Records and every login used only for that Company are deleted.
• Auxano keeps, after a Company leaves: its records of which terms were accepted, its closure records, and its own billing records with the Company.
• Deleted information may remain in backups for a limited time until those backups expire. (Lawyer: state the backup period and the retention schedule.)

8. Security

Information is sent over encrypted connections. Access inside each Company follows the permissions the Company gives its users. Keys for connected services are stored encrypted. Auxano's own administrators must use two-step sign-in. No system is perfectly secure; Auxano will tell affected Companies about a security incident as the law requires.

9. Your choices and rights

• Authorized Users can ask their Company, or Auxano, to correct, copy or delete their information.
• Companies can export their Records at any time while they use Auxano.
• End Customers should contact the Company they deal with; Auxano will help the Company answer.
• Depending on where you live, you may have more rights (for example under California law). (Lawyer: add state-specific rights, how to make a request, and how identity is checked.)

10. Children

Auxano is a business tool and is not meant for children. It does not knowingly collect information from children under 16. (Lawyer: confirm the age.)

11. Changes to this policy

Every version of this policy is numbered, dated and kept readable at /privacy. For an important change, the Owner of each Company is asked to read and accept the new version on their next visit; small fixes are announced with a notice in the app.

12. Contact

Questions about this policy can be sent through the in-app help chat. (Owner and lawyer: add a privacy contact email and postal address.)