Aquasition

Privacy Policy

Effective date: July 27, 2026

This Privacy Policy explains how Aquasition LLC (“Aquasition,” “we,” “us,” or “our”) collects, uses, stores, and shares information when you use Aquasition, our pool-service management platform. It covers all three parts of the product: the web application at app.getaquasition.com, the Aquasition iOS app distributed through the App Store, and the customer portal we host for pool-service companies (collectively, the “Service”). Aquasition LLC is the operator of the Service and the developer of the iOS app.

This policy applies to everyone who interacts with the Service:

• Company users — owners, administrators, office staff, and technicians of a pool-service company that holds an Aquasition account. Technicians use the iOS app in the field.
• Portal users — pool owners and other customers of a pool-service company who sign in to the customer portal to view service history, quotes, invoices, and statements.
• Customers of record — people whose contact and service information a pool-service company enters into Aquasition, whether or not they ever sign in themselves.
• Visitors to our websites.

If you have questions about this policy, want a copy of your data, or want your data deleted, contact us at support@getaquasition.com. Section 12 sets out the deletion process in full.

1. What We Do Not Do

Before the detail, the commitments that shape everything below:

• We do not sell, rent, or trade personal information — anyone’s, for any purpose.
• We do not show advertisements and do not share data with advertising networks or data brokers.
• We do not load analytics, attribution, or session-recording software in either the web application or the iOS app. Nothing in the Service records taps, screen views, scroll depth, or session-level behavior, and we build no profile of how you use it.
• We do not use App Tracking Transparency identifiers. The iOS app declares “Tracking: No” in its App Store privacy details and never requests the tracking permission, because nothing in it tracks you.
• We do not send push notifications. The iOS app has no push-notification capability and stores no device push tokens.
• We do not send text messages. The Service has no SMS provider and never sends SMS to anyone.
• We do not send your data to any artificial-intelligence or machine-learning provider, and we do not use your data to train models. Everything the Service computes — routes, reports, statements — is calculated by our own servers from the data your company entered. If we ever add an AI-powered feature, we will update this policy first, disclose exactly what data is involved and which provider receives it, and ask for consent inside the product before any data is sent.
• We do not collect the location of any person or device. The iOS app ships without a location permission string, so iOS never presents a location prompt and never grants the app access to the device’s position. The only location data in the Service is the street addresses of the pools being serviced, and the map coordinates derived from them, as described below.

2. Information We Collect

We collect only the information needed to operate the Service, bill correctly, and keep accounts secure. The first eight headings below carry an App Store data type in their titles, and those eight are exactly what the iOS app declares on Apple’s App Store privacy questionnaire, in Apple’s order and under Apple’s names. The headings after them — service-address coordinates, subscription records, and server-side diagnostics — describe records that exist elsewhere in the Service and are deliberately not among the app’s declared types; each says why, and the last part of this section sets out the complete App Store answer, type by type. For every category, the data is linked to identity, the only purpose is app functionality, and it is never used for tracking or advertising.

Contact Info: Name

The name of each company user, entered when the account is created or when a team member is invited, and the names of the company’s customers and their named contacts, entered by the company. Names are used to address people inside the product, on invoices, quotes, and statements, and in the emails the Service sends. A technician signed in to the iOS app can see the names and work email addresses of their colleagues on the same company account.

Contact Info: Email Address

Company users sign in with an email address and password. Portal users sign in with a link emailed to the address their pool company has on file — the portal has no passwords at all. Customer email addresses entered by the company (a primary address, an optional second address, and an optional separate portal address) are used to deliver invoices, quotes, receipts, service notifications, and any messages the company composes. We use email addresses to authenticate users, deliver these messages, and send important account and security notices. Passwords are stored only as salted hashes by our authentication provider; we never store or see a plain-text password.

Contact Info: Phone Number

Customer phone numbers entered by the company — a primary number, an optional second number, and numbers on named contacts — used so a technician can call the customer from the stop screen and so contact details appear on service records. Phone numbers are optional. We never use them for marketing, and the Service sends no text messages of any kind.

Contact Info: Physical Address

The company’s business address, the billing addresses of its customers, and the service addresses of the pools it maintains. Addresses appear on routes, stops, invoices, quotes, and statements.

A service location may also carry a gate code and free-text access notes, because a technician has to get into the yard. These are entered by the company, are treated as part of the service record, and are downloaded to the technician’s device with the rest of the customer directory. Section 3 describes what happens to that copy.

Financial Info: Other Financial Info

A service location’s monthly service rate and billing type, entered by the company, and the invoice numbers, dates, statuses, and balances shown on a customer’s screen. Across the Service this category also covers invoice line items, amounts, payment status, credits, refunds, and payout status — the company’s own billing records for its pool-service work.

Payment card and bank account details are collected directly by Stripe, our payment processor, and never touch our servers. That is why neither Payment Info nor Credit Info is a declared type: no card number, bank credential, or credit score exists anywhere in our systems or in the app. Where a customer keeps a payment method on file, we store from Stripe only the payment method’s Stripe identifier, whether it is a card or a U.S. bank account, the card brand, the last four digits, and the expiry month and year, so the Service can show which method is on file. We also store the event records Stripe sends us about payments, refunds, and disputes. See Section 8 (Payments).

User Content: Photos or Videos

Technicians may optionally attach photos of the pool and equipment to a service stop, using the device camera or a photo they pick from their library. Only photos deliberately captured or selected are uploaded; the Service never scans, indexes, or reads the photo library beyond the one image you pick in the system picker. The iOS app re-encodes each picture as a JPEG before saving it, so the metadata embedded in the original file — including any camera or location tags — is not carried into the upload. Photos become part of the customer’s service record, visible to the company and, where the company shares them, to the customer through the portal or in a visit-summary email.

User Content: Other User Content

The working records a company creates in the course of running its business: water-test readings, chemical dosages, checklist results, service notes, skip reasons, work orders, jobs, equipment records (including manufacturer, model, and serial number), pool details, quotes, invoices, statements, customer service requests submitted through the portal, files a company uploads to a customer record (images, PDFs, and common office documents), and the content of emails the company composes and sends through the Service. All of it exists because someone at the company (or a portal user) entered it.

Identifiers: User ID

An internal user ID (a UUID) generated by our database provider links each account to its company and its records, and an internal organization ID keeps each company’s data separate from every other company’s. Stripe customer, account, subscription, and transaction identifiers are stored so subscription and payment state can be reconciled. None of these identifiers are shared with advertising networks or analytics vendors.

Service-address coordinates — not a declared Location type

When a company enters or corrects a service address, our servers convert it into map coordinates (latitude and longitude) using a geocoding provider, so the address can be shown on a map and stops can be ordered into routes. We store the resulting coordinates, the address string that was submitted, and whether the lookup succeeded. This is the coordinate of the customer’s pool, not the position of any person or device. The Service does not collect, request, or track the real-time location of technicians or anyone else.

The address fields in the web application also offer autocomplete. While someone is typing an address, the partial text is sent to the same geocoding provider to fetch up to five candidate completions. Nothing else about the customer is sent with it.

Apple’s two Location data types describe where a user or their device is, and nothing here is that, which is why the iOS app declares neither Precise Location nor Coarse Location. The geocoding happens on our servers when a company saves an address in the web application. The coordinates then travel down to the phone so the route map can draw a pin on the pool, and the app never sends a coordinate back up, because it never has one of its own to send. The street address itself is declared, under Physical Address.

Subscription records — not a declared Purchases type

The status of the company’s Aquasition subscription (plan, trialing, active, past-due or canceled state, and Stripe subscription identifiers), so we can grant and revoke access correctly. A company owner starts and manages that subscription in the web application, which hands off to a Stripe-hosted page where the payment details are entered, not in our software. The iOS app has no part in this: it contains no purchase, no price, no plan, and no checkout, and it reads the subscription status only to know whether to open.

Apple’s questionnaire asks what an app sends off the device, which is why Purchases is not a declared type. Invoices, their balances, and the subscription state travel down to the phone and are displayed there; the app writes no purchase record and sends none. The rate and billing type a company can edit on the phone do travel up, which is why Other Financial Info is declared.

Server logs and error reports — not a declared Diagnostics type

When your device talks to our servers, our hosting and database providers record standard request metadata — IP address, user-agent string, timestamps, endpoint, and response status — for security, rate limiting, fraud prevention, and debugging. Inside the Service we keep an audit trail of significant changes to company records, showing which user changed what and when.

The web application and the customer portal also report unexpected errors to us so we can fix them. An error report contains the error message, the technical stack trace, the address of the page you were on, and your browser’s user-agent string. Those reports are delivered to a private engineering channel on Telegram, as described in Section 6. The iOS app sends no such reports.

For email the Service sends, we record the recipient address and delivery events (delivered, bounced, marked as spam, or suppressed) so companies can see whether their messages arrived and so we can protect deliverability.

None of this is a declared type for the iOS app, and the reason is that none of it comes from the app. Request metadata is recorded by the servers being spoken to, as it is for every website on the internet; the error reports are the web application’s. The app carries no crash reporter, no telemetry, and no logging SDK, so it declares neither Crash Data, nor Performance Data, nor Other Diagnostic Data.

Information we do not collect

We do not collect device GPS or any device location, contacts, calendars, health or fitness data, biometric data, audio recordings, handwritten or electronic signatures, browsing or search history outside the Service, advertising identifiers (IDFA), push tokens, or financial information beyond what is described above.

What the iOS app declares on the App Store

Apple asks every developer to declare, type by type, what its app collects, and publishes the answer on the app’s App Store page. The Aquasition iOS app declares eight types. Every one of them is for App Functionality only, every one is linked to the user, and not one is used for tracking:

• Contact Info — Name, Email Address, Phone Number, Physical Address
• Financial Info — Other Financial Info
• User Content — Photos or Videos, Other User Content
• Identifiers — User ID

Why customer information is declared. Most of what those eight types cover is information about a pool-service company’s customers rather than about the technician holding the phone. Apple’s question is what the app collects, not whose information it is, so we declare it. Entering customer records is the app’s primary function and not an infrequent, optional act, so none of Apple’s optional-disclosure exceptions applies to it. Section 4 answers the separate question of who controls that information, and Section 12 how it is deleted.

Every other type on Apple’s list is left undeclared. Here is why, for each one that could plausibly apply to an app like this:

• Precise Location and Coarse Location — the app ships without a location permission string and never reads the device’s position. The pins on the route map are customer addresses geocoded on our servers, as described above.
• Payment Info and Credit Info — no card number, bank credential, or credit score ever reaches the app or our servers. Stripe collects them on its own hosted pages.
• Purchases — the app displays invoices pulled down from our servers and writes no purchase record. It contains no in-app purchase, no price, and no checkout.
• Emails or Text Messages — the app opens no mailbox and sends no message of its own. A technician writing a service note can tick “Email owner,” which asks our servers to email that note to the account owner; the note is declared as Other User Content and the owner’s address as Email Address. Nobody’s mail is read, and the Service sends no SMS at all.
• Customer Support — the app has no support form and no ticket flow. It prints our support address so people can write to us themselves.
• Search History — the customer search box filters the copy of the directory already on the phone. What is typed there never leaves the device and is never stored.
• Browsing History — the app keeps no history of web pages. The only web addresses it opens are this policy, our terms, and the company owner’s own Stripe onboarding page; tapping Directions or Call at a stop hands the address or the number to the device’s maps or phone application, as Section 6 describes.
• Device ID — the app reads no advertising identifier and no vendor identifier, and registers no push token.
• Contacts — the device address book is never requested or read. Customer contacts are typed into the app or synced from the company’s own records.
• Other User Contact Info — every way the app records to reach someone is a name, an email address, or a phone number, and all three are declared above.
• Product Interaction, Advertising Data, and Other Usage Data — no analytics, attribution, or session-recording software is built into the app, so no taps, screen views, or sessions are recorded anywhere.
• Crash Data, Performance Data, and Other Diagnostic Data — the app carries no crash reporter, telemetry, or logging SDK, and sends no error reports.
• Sensitive Info — the app asks for nothing in Apple’s sensitive categories. A gate code is property access information, kept as part of the service record and described under Physical Address.
• Health, Fitness, Audio Data, Gameplay Content, Environment Scanning, Hands, Head, and Other Data — nothing in the app collects any of these.

The app also carries a privacy manifest inside the bundle, and it says the same thing: the same eight types, tracking set to false, and an empty list of tracking domains. Its one required-reason API declaration covers reading a stored preference, which is how the app remembers whether a technician prefers Apple Maps or Google Maps for directions. The only third-party code in the app is a database library, which collects nothing and reaches no network.

3. The Aquasition iOS App

The iOS app is the field tool. It is built so a technician can finish a route in a dead zone, which shapes what it keeps on the phone and when it talks to our servers.

Signing in, and creating an account

Almost everyone who opens the app already has an account: a pool-service company signs up for Aquasition on our website and then invites its own technicians, and the app’s sign-in is the email address and password issued through that company.

Where the app does offer to create an account, it asks for three things and nothing else — your name, your company’s name, and your email address — and sends a single-use sign-in link to that address. No password is typed into the app, no payment details are asked for, and nothing is charged. The three fields are used to create the account and the company workspace, and for nothing else. This form is off by default and is shown only when we deliberately turn it on.

Nothing is bought, sold, or priced anywhere in the app. It contains no in-app purchases and no checkout of any kind.

Deleting an account happens inside the app, under Settings → Delete account, from initiation to confirmation. The screen lists exactly what will be destroyed and what will be kept before you confirm, an owner is asked to type the company name, and the deletion is carried out there and then. There is no website to visit, no email to send, and no deactivate-only option. Section 12 explains exactly what a deletion removes and what it keeps.

Camera and photo library

The app asks for two permissions, both only at the moment you use the feature, and both refusable without losing the rest of the app:

• Camera — so you can take photos of the pool and equipment at a stop. Photos are saved to the customer’s service record.
• Photo library — so an existing photo can be attached to a stop when the camera is not available. Only the photo you pick is added to the service record. The app never browses, reads, or uploads anything else from your library.

Location

The app does not use the device’s location. It ships without a location permission string and never asks iOS for your position, so no location prompt can appear and no position is ever read, stored, or sent. The map does not draw your position on it and has no control to. Every pin on the route map is the street address of a pool on that day’s route, placed using the standard Apple Maps coordinate type, and nothing on that screen is derived from where the phone happens to be.

What the app stores on the device

So that the app works with no signal, it keeps a local copy of the company’s working data in a private database inside the app’s sandboxed container. That copy is broader than one technician’s stops, and it is worth being precise about it. It contains:

• the company’s customer directory — customer and contact names, phone numbers, email addresses, billing addresses, portal settings, and free-text notes;
• the service locations — addresses, gate codes, access notes, pool details, equipment records with serial numbers, and the map coordinates for each address;
• the team roster for that company — colleagues’ names, work email addresses, and roles;
• a rolling schedule window of roughly the last week of completed work and the next two weeks of planned stops, along with the readings, dosages, checklist results, notes, and work orders in that window;
• photos you captured, held as files in the app’s container until they upload, and any work still queued to be sent.

Older synced work is pruned off the device as the schedule window moves past it. The signed-in session token is stored in the iOS Keychain, marked so that background sync can still read it while the phone is locked in a technician’s pocket. Local data is protected by iOS’s app sandboxing and device encryption. We recommend that companies require a device passcode on field devices.

What happens on sign-out

Signing out erases the company’s data from the phone. The app deletes the entire local database — customers, locations, gate codes, schedule, visits, readings, notes, work orders, the team roster — and removes the captured photo files, and only then clears the session. Signing in with a different account on the same device does the same thing before the new account can see anything. If work is still queued and unsent, the app refuses to sign out and asks you to sync first, rather than silently discarding a technician’s day. Deleting the app from the device also removes everything it stored.

Background sync

When the app is in the background, iOS may wake it periodically — at most about every fifteen minutes, and only when the system decides conditions allow — to upload work that is still queued. These background runs send exactly what a foreground sync sends: the readings, notes, photos, and status changes already recorded on the device. Nothing is collected in the background that is not collected in the foreground, and no location, sensor, or usage data is gathered at any point.

4. Two Roles: Account Data and Your Company’s Customer Data

Aquasition is a business tool, and that gives us two distinct roles under privacy law:

• For company account data — the accounts, credentials, subscription, and billing relationship of the pool-service company itself — Aquasition LLC is the data controller. We decide how that data is processed, as described in this policy.
• For customer records — the names, addresses, phone numbers, emails, service history, photos, and billing records that a pool-service company enters about its own customers — the company is the controller and Aquasition processes that data as a service provider (processor) on the company’s instructions. The company decides what to enter, whom to invoice, and what to send; we store it, render it back, and transmit what the company tells us to transmit.

If you are a technician or staff member, your employer provisions your account, sets your role and permissions, and can see the work you record under it. Your employer decides whether you keep an account at all. Requests about your own account — access, correction, deletion — go first to your employer, because the account is theirs to administer; write to us at support@getaquasition.com and we will coordinate with them, and act directly where the law requires us to.

If you are a customer of a pool-service company and want your information accessed, corrected, or deleted, the fastest path is to contact your pool company directly, because the data belongs to your relationship with them. You may also contact us at support@getaquasition.com — we will route the request to your company and assist them in honoring it, and where the law requires us to act directly, we will. Each company is responsible for having the right to enter its customers’ information into the Service.

5. How We Use Information

• Provide the Service: customer records, routes, stops, readings, photos, work orders, quotes, invoicing, statements, the customer portal, and offline sync in the iOS app.
• Authenticate users, keep accounts secure, enforce per-company data isolation, and detect abuse, fraud, and automated attacks.
• Process the company’s subscription and, through Stripe, the payments companies collect from their customers, including receipts, automatic payment where a customer has enabled it, and overdue-invoice reminders.
• Send transactional and security email: sign-in links, team invitations, password resets, invoices, quotes, receipts, payment reminders, and material changes to this policy.
• Deliver, on a company’s behalf, the messages it composes to its own customers, and record whether they arrived.
• Diagnose and fix errors, and keep an audit trail of changes to company records.
• Respond to support requests.
• Comply with legal obligations, including tax and accounting requirements.

We do not use your information for advertising, behavioral profiling, or third-party marketing.

6. How We Share Information

We do not sell personal data

We do not sell, rent, or trade personal information, and we do not share it for cross-context behavioral advertising.

Subprocessors and third parties

We share information only with the service providers we need to run Aquasition. Each processes data solely to perform the service we engaged it for, under its own privacy policy and our agreements with it:

• Supabase, Inc. — hosts our PostgreSQL database, authentication, and file storage. Account records, customer records, service history, photos, and documents live here, encrypted at rest.
• Vercel, Inc. — hosts our application servers and serves web and API traffic. Processes request metadata (IP address, user-agent) to serve requests.
• Stripe, Inc. — processes all payments: the company’s Aquasition subscription, and the payments companies collect from their own customers through Stripe Connect. Stripe receives the payment details you or your customers enter and handles them under Stripe’s privacy policy. See Section 8.
• Resend, Inc. — sends every email the Service produces (sign-in links, password resets, invitations, invoices, quotes, receipts, statements, reminders, service notes, visit summaries, and company-composed messages) and reports delivery events back to us.
• Apple Inc. — distributes the iOS app through the App Store.
• OpenStreetMap Foundation — service addresses, and partially typed addresses in the autocomplete field, are sent to the Nominatim geocoding service to convert them into map coordinates. Map screens in the web application also load map tiles from OpenStreetMap’s tile servers, which means the browser’s IP address and the area of the map being viewed reach those servers. Where we configure a paid geocoder instead, that provider is Mapbox, Inc.; only the address text is sent to it.
• Telegram Messenger Inc. — receives the automatic error reports described in Section 2 (error message, stack trace, page address, and browser user-agent string) in a private engineering channel, so that we learn about failures. No customer record is sent deliberately, but a page address can contain the internal identifier of the record that was open. The iOS app sends no error reports.
• Google LLC — the web application loads its typeface from Google Fonts, so each page load sends the visitor’s IP address and user-agent to Google. Nothing else about you is sent, and no Google analytics or advertising code runs anywhere in the Service. Separately, when a technician taps “Directions” at a stop, the stop’s address is handed to the maps application on the device — Apple Maps by default, or Google Maps if the technician chose it — which then handles that address under Apple’s or Google’s own policy. Nothing is sent unless the technician taps.

This is the complete list of third parties that receive personal data from the Service. We will update this policy before adding a new subprocessor.

Each of these third parties provides the same or equal protection for your data that this policy provides. Every one of them is engaged under a written agreement that permits it to process the data only to perform the service we engaged it for, and for no purpose of its own; forbids selling the data, sharing it for advertising, and using it to train models; requires security measures at least equivalent to our own, including encryption in transit and at rest; requires deletion or return of the data when our engagement ends; and binds its own subprocessors to the same terms. We review each provider’s privacy and security commitments before engaging it and will not add one that offers less protection than this policy states.

No data from the Service is sent to any artificial-intelligence or machine-learning service. No provider on the list above is an AI service, the iOS app contains no AI or machine-learning feature and links no such framework, and no person’s data is used to train a model, ours or anyone else’s. The commitment in Section 1 governs: if we ever add an AI-powered feature, we will update this policy first, name the provider and the exact data involved, and ask for consent inside the product before anything is sent.

Legal requirements

We may disclose information if required by law, court order, subpoena, or other valid legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud.

Business transfers

If Aquasition LLC is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. We will notify affected account holders by email before their information becomes subject to a different privacy policy.

7. Links We Email

Two features work by emailing someone a private link rather than asking them to sign in with a password:

• Portal sign-in links. A customer asks for a link, and we email a single-use link to the address the company has on file. It expires after 30 minutes and can be used once. Signing in with it creates a portal session that lasts up to 30 days. We store only a one-way hash of each link and session token, never the value itself.
• Quote links. When a company emails a quote, the email carries a private link that lets the recipient view and approve or decline it without signing in. Anyone who has that link can act on that quote, so it should be treated like the quote itself and not forwarded.

8. Payments

Stripe processes payments for the Service in two separate roles:

• Your Aquasition subscription. Aquasition LLC charges the pool-service company for its subscription through Stripe. The card details entered at checkout go directly to Stripe; we receive only the subscription state and non-sensitive payment metadata. Checkout always happens on a Stripe-hosted page in the browser, including when a company owner starts it from the iOS app.
• Payments between a company and its customers. A pool-service company can connect a Stripe account and collect payment on its invoices by card or U.S. bank account (ACH). Funds go to the company’s own connected Stripe account — Aquasition is the platform, not the merchant. A customer may choose to keep a payment method on file for automatic payment of future invoices; that payment method is stored by Stripe, not by us, and automatic payment can be turned off by asking the company at any time. Refunds for pool-service charges are a matter between the customer and the company.

In both roles, card numbers, CVVs, and bank credentials are collected and stored exclusively by Stripe under its own privacy policy and PCI-DSS obligations. Our servers never see them.

9. Email Communications

• Transactional email — sign-in links, password resets, team invitations, invoices, quotes, receipts, statements, payment reminders, and account or security notices. These are necessary to operate the Service and cannot be opted out of while the underlying relationship exists.
• Company-composed email — a company may send messages (for example, service updates or announcements) to its own customers through the Service. These messages come from the company, not from us; the company chooses the recipients and the content. Recipients can unsubscribe from a company’s non-essential messages using the link in those emails, and the Service enforces the unsubscribe. Every such message also carries a “didn’t sign up for this?” link; using it records a report against that company so we can act on companies that misuse the Service.
• Visit summaries — where a company enables them, a customer receives a summary of a completed visit. If the visit has photos, the email includes short-lived private image links, so the recipient’s mail application fetches those images from our storage provider when the message is opened.
• Delivery events — we record whether each message was delivered, bounced, was marked as spam, or was suppressed, so companies can see the status of what they sent and so we can protect deliverability. We do not embed advertising or open-tracking pixels in email.

10. How We Store and Protect Information

Your data is stored in the United States. Account records, customer records, service history, photos, and documents are held in our managed PostgreSQL database and private file storage at Supabase, in its us-west-1 region; the servers that answer the web application and the iOS app run at Vercel. Section 14 covers what that means if you use the Service from outside the United States.

• All data is transmitted between your device and our servers over TLS (HTTPS).
• Data is stored in a managed PostgreSQL database encrypted at rest.
• The Service is multi-tenant with row-level security enforced in the database itself: every query is scoped to the requesting user’s company, so one company can never read another company’s data. Permissions within a company (for example, which team members may edit customers or billing) are likewise enforced in the database, not just hidden in the interface.
• Sign-in credentials for the portal are never stored in a usable form: portal sign-in links, portal sessions, and staff invitations are held only as one-way hashes.
• Uploaded photos and documents are kept in private storage that is not publicly readable, and are served only to authorized users of the owning company and its customers, through short-lived signed links.
• Administrative access to production systems is restricted to a small number of authorized people at Aquasition LLC and is controlled by an explicit permission flag on the account rather than by convention.
• The Service keeps an audit trail of significant changes to company records.

No method of transmission or storage is 100% secure, but we work to protect your information with safeguards appropriate to the sensitivity of the data.

11. Data Retention

We keep information for as long as it is needed to run the Service for the company that owns it, and no longer than the periods below.

• Account and business records — customer records, service history, photos, documents, work orders, quotes, invoices, payment records, communications, audit-trail entries, and the delivery records for email sent — are retained for as long as the company’s account is active, because they are the company’s operating records. Archiving a customer inside the product hides the record from day-to-day views but does not delete it; deletion is the process in Section 12.
• After an account ends — the company’s data remains available for export for 30 days on request, and is then deleted under this policy.
• On the technician’s device — the iOS app keeps roughly the last week of completed work and the next two weeks of schedule, and erases everything the moment you sign out, when a different account signs in, or when the app is deleted. See Section 3.
• Sign-in credentials — portal sign-in links expire after 30 minutes and work once; portal sessions expire after 30 days; staff invitations expire after 7 days. Expired records are inert and are removed when the company’s data is deleted.
• Error reports — the reports described in Section 2 are kept in our private engineering channel for as long as that channel’s history is retained, and are deleted on request.
• Server logs and encrypted backups — held by our hosting and database providers on their own rotation schedules, used only for security, debugging, and disaster recovery. Data deleted from the live database ages out of backups as those backups rotate.
• Billing records — invoices, their line items, payments, credits, and the customer names and billing addresses those invoices refer to. When a company account is deleted these survive the deletion, for the reason given in Section 12, and are held for seven years from the date of deletion. Nothing else about the company survives with them, nobody can sign in to reach them, and they are used for nothing but answering a tax or payment question. At the end of that period they are deleted automatically, along with the empty company record.

12. Account Deletion and Data Deletion Requests

You can ask us to delete your data at any time, and we will. Email support@getaquasition.com with the subject line “Delete my data” and tell us who you are. We acknowledge every request within 5 business days, verify it, and complete it within 30 days. There is no fee, and we will not ask you to create an account or install anything in order to make the request.

• Delete a company account. The account owner confirms it in the iOS app under Settings → Delete account, on the deletion page in the web application, or by emailing us from the owner’s address on the account. Any of the three does the same thing, and the company’s working data goes: team memberships and sign-in credentials, service locations, equipment, schedules, visits, readings, dosages, checklists, photos, service notes, work orders, jobs, quotes, documents, imports, email delivery records, and audit-trail entries. Every account is deleted with it, so nobody can sign in to the company again.
  
  What we keep, and why: the record of what was billed and collected — invoices, their line items, payments, credits, and the customer names and billing addresses those invoices refer to. Tax law requires a business to be able to produce these for years after the fact, and card networks allow chargebacks well past the point an account closes, so destroying them on request would leave the company unable to answer for its own books. They are held for the period described in Section 11 and then deleted along with the empty company record. They are never used for anything else in the meantime.
• Delete an individual staff account. A technician or office user can delete their own account in the iOS app under Settings → Delete account, on the deletion page in the web application, or by email. Their sign-in credentials and profile are deleted, and their access ends immediately. Work already recorded under that person stays in the company’s service history with no live account behind it, because it is the company’s record of work performed at its customers’ homes; on request we will remove their name from it where we are not required to keep it. A company owner or administrator can also remove a team member’s access at any time.
• Delete a customer record. If you are a customer of a pool-service company, ask that company to delete your record — they control it, and they can do it directly in the product. You can also email us and we will pass the request to them, help them carry it out, and act directly where the law requires us to. Where a company has closed its account, the deletion of its account removes its customer records with it, except for the names and billing addresses named on an invoice, which are held for the period in Section 11.
• Delete an error report. If you want the diagnostic reports described in Section 2 removed, say so in the same email and we will delete them.

Deleting your data means it is removed from our live systems. Encrypted backups age out on the rotation described in Section 11, and we do not restore deleted data from them. We will confirm to you in writing when a deletion is complete.

You do not have to email us to start any of this, and you do not have to leave the app. In the iOS app, open the Settings tab and tap Delete account — it is a card at the top level of that tab, one tap from the tab bar. The screen that opens lists exactly what will be destroyed and what will be kept, an owner is asked to type the company name because their deletion also deletes the company workspace and everything in it, and the deletion is carried out in the app when they confirm. The same is offered on the screen shown to a member of a company whose plan has lapsed, so that nobody is signed in without a way to delete their account. The equivalent page in the web application is app.getaquasition.com/account/delete, for anyone who would rather do it in a browser.

Signing out of the app erases the company’s data from that device immediately, as described in Section 3, whether or not you go on to delete the account.

13. Your Rights

Depending on where you live, you have legal rights over your personal data. We honor the rights below regardless of jurisdiction. To exercise any of them, email support@getaquasition.com; we will respond within 30 days. Where the data at issue is a company’s customer record or a staff account, we will coordinate with that company as described in Section 4.

European Economic Area, United Kingdom, and Switzerland (GDPR and UK GDPR)

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — ask us to delete your data (the “right to be forgotten”), by the process in Section 12.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Restriction — ask us to restrict how we process your data.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — withdraw consent at any time where processing is based on consent. In the iOS app, the camera and photo-library permissions are consent you can withdraw at any moment in iOS Settings, and the app keeps working without them.
• Complaint — lodge a complaint with your local data protection authority.

Our lawful bases for processing are: performance of a contract (providing the Service the company signed up for), legitimate interests (security, fraud prevention, and service improvement), consent (where given), and legal obligation (tax and accounting records).

California (CCPA and CPRA)

• Categories collected: identifiers (name, email, phone, user ID); customer records (address, gate code, billing records); commercial information (subscription and invoice history); geolocation data (service-address coordinates, not device location); visual information (service photos); internet activity (server request metadata and error diagnostics); and professional information (company and role). Sources: directly from you, from your pool-service company, and from our payment processor. Recipients: the subprocessors listed in Section 6, each bound to use the data only to provide its service to us.
• Right to know, delete, and correct — request that we disclose, delete, or correct personal information we hold about you.
• Right to opt out of sale or sharing — we do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of. We will not start without first providing an opt-out.
• Right to limit use of sensitive personal information — we use sensitive categories (such as precise service-location coordinates and property access codes) only to provide the Service, which is the use the law permits without a limitation request.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

14. International Transfers

Aquasition LLC operates the Service from the United States. If you access the Service from outside the United States, your data will be transferred to, stored, and processed in the United States or other countries where our subprocessors operate. Where required by law, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, to protect data in transit.

15. Children’s Privacy

The Service is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 13 in the United States or under 16 in the European Economic Area. If you believe a child has provided us with personal information, email support@getaquasition.com and we will delete it promptly.

16. Cookies and Local Storage

The Service sets no cookies at all. The web application and the customer portal keep a small amount of essential state in your browser’s local storage: the session token that keeps you signed in, which company you last had selected, an invitation token while you are accepting an invitation, and any stop work saved offline while your connection is down. All of it is cleared when you sign out. We set no advertising storage and load no analytics or tag-manager scripts.

The iOS application does not use web cookies. It stores its session token in the iOS Keychain and its offline data in a private database, as described in Section 3.

17. Do Not Track

Because we do not track visitors across third-party websites, there is nothing for a “Do Not Track” signal to turn off; we treat all users as if it were enabled.

18. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify account holders by email at least 30 days before the change takes effect. The effective date at the top of this page always reflects the current version. Continued use of the Service after a change takes effect means you accept the updated policy.

19. Contact

For questions about this Privacy Policy, to exercise any of your rights, to request deletion of your data, or to report a privacy concern:

support@getaquasition.com

Aquasition LLC. Mailing address available on request at the address above.