Privacy Policy

HazardOS is business software for environmental remediation companies. It is operated by Asymmetric Marketing LLC("we", "us"). This policy explains what information HazardOS holds, why, who it is shared with, and the choices you have.

Two groups of people are covered. Our customers are the companies that subscribe to HazardOS and their staff who sign in ("users"). Those companies also store information about their own clients, site contacts and partners in HazardOS ("contacts"). For contact information, the subscribing company decides what is collected and how it is used, and we process it on that company's behalf.

Information we hold

• Account information for users: name, email address, phone number, role, and sign-in records.
• Business records a company enters or imports: contacts, companies, properties, site surveys and photos, estimates, proposals, jobs, schedules, invoices, payments, notes, documents and lab results.
• Messages sent through HazardOS: emails and text messages to contacts and staff, their delivery status, and contacts' opt-in and opt-out choices.
• Connected-account data: when a company connects QuickBooks Online, Google Calendar, Outlook Calendar or another service, the access tokens for that connection and the records exchanged with it.
• Technical information: IP address, browser type, and error and performance reports, used to keep the service secure and working.

How we use it

• To provide HazardOS to the subscribing company and the features its users turn on.
• To send the emails and text messages a company or its automations ask HazardOS to send.
• To secure the service, prevent abuse, and diagnose problems.
• To bill the subscribing company and to communicate with it about the service.

We do not sell personal information, and we do not use contact information for our own marketing.

Each company's data is kept separate

HazardOS is multi-tenant: many companies use the same system. Every record belongs to one company, and the database enforces that a user can see only their own company's records, limited further by the user's role. Our own staff access a company's data only to provide support, fix a problem, or when the law requires it.

QuickBooks Online

When a company connects its QuickBooks Online account, HazardOS uses Intuit's authorization to create customers and invoices in that QuickBooks company and to read back invoices and payments, so that balances in HazardOS match QuickBooks. HazardOS stores the connection's access tokens encrypted. It does not read other QuickBooks data, and it does not use QuickBooks data for any purpose other than providing that sync to the company that connected it. A company can disconnect at any time from Settings > Integrations in HazardOS or from within QuickBooks; disconnecting stops all further access.

Service providers we use

HazardOS relies on these providers, each of which handles data only to provide its service to us:

• Supabase: database, file storage and sign-in.
• Vercel: application hosting, plus aggregate page-performance analytics.
• Cloudflare R2: storage for photos and documents.
• Resend: sending email.
• Twilio and RingCentral: sending and receiving text messages, depending on which one a company uses.
• Stripe: subscription billing. Card details go to Stripe and are not stored by HazardOS.
• Intuit (QuickBooks Online): invoice and payment sync, for companies that connect it.
• Google and Microsoft: calendar sync, for users who connect a calendar.
• eSignatures.io: electronic signing of proposals, for companies that use it.
• Mapbox: looking up the county and map location of an address.
• Sentry: error reports, which can include the page and account involved.
• Upstash: rate limiting, which uses IP addresses and account identifiers.
• Anthropic and OpenAI: AI-assisted features, such as transcribing voice notes, when a user uses them.

Text messages and email

HazardOS sends transactional messages about a contact's own project, such as appointment reminders and invoices, unless that contact has opted out. Marketing messages are sent only with consent. Replying STOP to a text opts that number out. A contact can also ask the company to stop email.

Security

Data is encrypted in transit. Third-party access tokens and app keys are encrypted at rest with a key held separately from the database. Access within HazardOS is limited by company and by role, and deactivated users lose access immediately.

Retention

We keep a company's data while it subscribes. After a subscription ends, the company can ask for an export and for deletion. Backups and logs age out on our providers' normal schedules.

Your choices

If you are a contact of a company that uses HazardOS, that company controls your information. Contact them to see, correct or delete it, and we will help them do so. If you are a user, your company's administrator can update or remove your account. You can also write to us at the address below.

Changes

We will post any change to this policy on this page and update the date at the top. Material changes will be announced to subscribing companies before they take effect.

Contact

Asymmetric Marketing LLC
[PLACEHOLDER: mailing address of Asymmetric Marketing LLC]
[PLACEHOLDER: privacy and legal contact email]