EzLife HVAC Service ("EzLife," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store, share, and protect information when you use the EzLife HVAC mobile and desktop application ("App") and related services (collectively, the "Service").
This Policy applies to all users of the Service, including Company Owners, Managers, and Workers. By creating an account or using the Service, you consent to the practices described in this Policy. If you do not agree, do not use the Service.
The data controller for information processed through the Service is EzLife HVAC Service. For inquiries, contact us at privacy@ezlifesystems.com.
When a Company Owner registers a tenant and invites employees, both EzLife (as the platform provider) and the Company (as the employer) may act as independent or joint data controllers for employee data, depending on applicable law. Company Owners are responsible for their own compliance with employment and data protection laws regarding their employees' data.
| Data Field | Owner Registration | Employee Registration |
|---|---|---|
| Full name | Yes | Yes |
| Email address | Yes | Yes |
| Phone number | Yes | Yes |
| Password | Yes | Yes |
| Company name | Yes | No |
| Invitation code | No | Yes |
| Data Point | Purpose |
|---|---|
| Installation ID (random UUID) | Distinguish devices per user account |
| Platform (iOS/Android/macOS/etc.) | Compatibility, diagnostics |
| Device model | Diagnostics, support |
| Operating system version | Compatibility, diagnostics |
| App version name and build number | Version management, update prompts |
This data is sent as part of device heartbeats to track active installations and deliver version-update notifications.
We apply PII scrubbing to all telemetry data. Business content such as customer names, task details, report text, and employee personal information is not transmitted to Sentry.
When you use address autocomplete or map features, Google may process:
Google's processing of this data is subject to the Google Privacy Policy.
Our authentication service (powered by Supabase/GoTrue) processes:
| Purpose | Legal Basis (GDPR) | Data Categories |
|---|---|---|
| Provide the Service — account creation, authentication, data sync, offline operation | Performance of contract | All registration data, user content, sync metadata |
| Maintain tenant isolation — enforce multi-tenant security boundaries | Legitimate interest (security) | Tenant ID, user roles, RLS metadata |
| Enable role-based access control — enforce permissions per user role | Performance of contract | User role, tenant membership, capability matrix |
| Device management — track active installations, deliver update prompts | Legitimate interest (service reliability) | Device/installation data, heartbeat records |
| Error monitoring and diagnostics — detect, investigate, and fix bugs | Legitimate interest (service improvement) | Crash data, sanitized diagnostic telemetry |
| Security — detect unauthorized access, prevent abuse | Legitimate interest (security) | Authentication logs, audit logs, access patterns |
| Audit trail — tamper-evident record of data changes | Legitimate interest + legal compliance | Audit log entries |
| Media processing — compress, store, and serve uploads | Performance of contract | Uploaded files, file metadata |
| Communications — support requests, service notices | Performance of contract / legitimate interest | Email address, in-app notifications |
| Legal compliance — respond to lawful requests | Legal obligation | Any data as legally required |
We do not:
| Storage | Data | Encryption Status |
|---|---|---|
| Isar database | All synced entities, registration drafts, sync cursors | Not encrypted at rest (engine limitation). Key material provisioned for future activation. |
| Pending media files | Photos/documents awaiting upload | Unencrypted (device file system) |
| Flutter Secure Storage | Encryption key material (32-byte random key) | Platform keychain/keystore encrypted |
| SharedPreferences | Installation ID, UI preferences, cached release policy | Platform default (generally unencrypted) |
Your responsibility: We recommend enabling device-level encryption (full-disk encryption) on all devices used to access the Service.
| Component | Data |
|---|---|
| PostgreSQL (with RLS) | All synced entity data, audit logs, sync metadata |
| Object Storage | Avatars, company logos, task/checkpoint/session media |
| Authentication | Credential hashes, session tokens, verification state |
Data you create is visible to other users within your Company tenant according to role-based permissions:
| Provider | Data Shared | Purpose |
|---|---|---|
| Supabase | All synced data, authentication credentials, uploaded media | Cloud infrastructure, database, storage, authentication |
| Sentry | Sanitized error reports (user ID as UUID, tenant ID, role; no business content) | Error monitoring and crash reporting |
| Google (Maps Platform) | Address search queries, selected place details | Address autocomplete, geocoding, map display |
We may disclose your information if we believe in good faith that disclosure is necessary to:
(a) Comply with applicable law, regulation, or legal process.
(b) Protect the rights, property, or safety of EzLife, our users, or the public.
(c) Detect, prevent, or address fraud, security, or technical issues.
(d) Enforce our Terms of Service.
In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change.
We do not sell, rent, or trade your personal information to third parties for their marketing or commercial purposes.
| Data Category | Retention Period |
|---|---|
| Active account data | Duration of active account + 30 days after termination |
| Audit logs | 90 days (automated pruning) |
| Deleted media queue | 14 days then permanently removed |
| Soft-deleted records | Retained as tombstones; purged with account deletion |
| Registration drafts (local) | 1 hour TTL (auto-purged locally) |
| Device heartbeats | Duration of active account |
| Error telemetry (Sentry) | Per Sentry's retention policy (typically 90 days) |
| Backup copies | Purged per Supabase backup schedule after source data deletion |
Depending on your jurisdiction, you may have the following rights:
You may request a copy of the personal data we hold about you.
You may correct inaccurate personal data via the App or by contacting us.
You may request deletion of your personal data. Note:
You may request your data in a structured, commonly used, machine-readable format. During Beta, data export is processed manually upon request.
You may request restriction of processing in certain circumstances.
You may object to processing based on legitimate interest.
Where processing is based on consent, you may withdraw consent at any time.
You have the right to lodge a complaint with a data protection supervisory authority in your jurisdiction.
To exercise any of these rights, contact us at privacy@ezlifesystems.com. We will respond within 30 days.
Your data may be processed in countries other than your country of residence. Where such transfers occur, we ensure appropriate safeguards are in place as required by applicable law (e.g., Standard Contractual Clauses under GDPR).
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly. Contact us at privacy@ezlifesystems.com if you believe a child has provided us with personal information.
If you are a Company Owner or Manager using the Service to manage employees:
(a) You are responsible for informing your employees about how their work-related data is collected and processed through the Service.
(b) You must obtain any consents required by applicable labor and data protection laws before enrolling employees.
(c) You acknowledge that work session data constitutes employee monitoring data in some jurisdictions and may be subject to specific legal requirements.
(d) EzLife provides the platform; the Company determines the purposes and means of processing employee data within its tenant.
The App does not use cookies. We do not use web-based tracking technologies, advertising identifiers, or cross-app tracking. The only persistent local identifier is the randomly generated Installation ID (UUID) used solely for device-level service management.
We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification or email at least fifteen (15) days before taking effect.
For privacy-related questions, requests, or concerns:
For data protection officer inquiries (where applicable under GDPR): dpo@ezlifesystems.com