Privacy Policy

1. Scope and Application

This Privacy Policy applies to personal information processed by SkilledOS in connection with the Services, including information about:

• Customers — businesses and individuals who subscribe to and use our platform;
• Authorized Users — employees, field crew members, subcontractors, and other individuals given access under a Customer’s account;
• End Customers — clients of our Customers whose information is entered into the platform (e.g., homeowners scheduling service appointments);
• Website Visitors — individuals who visit our marketing website.

This Policy does not apply to third-party websites or services that may be linked from our Services. We encourage you to review the privacy policies of those third parties.

2. Information We Collect

2.1 Information You Provide Directly

• Account Registration: Name, business name, email address, phone number, billing address, and account credentials.
• Payment Information: Credit or debit card details and billing information, processed securely through Stripe. SkilledOS does not store full card numbers.
• Business Operations Data: Job records, scheduling information, service addresses, crew assignments, invoices, estimates, and customer communications you create within the platform.
• End Customer Data: Contact information, service history, and other details about your clients that you enter into the platform.
• Communications: Information you provide when contacting our support team, submitting feedback, or participating in surveys.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, clicks, session duration, and other interaction data within the Services.
• Device and Technical Data: IP address, browser type, operating system, device identifiers, referring URLs, and access timestamps.
• Location Data: General geographic location inferred from IP address. For mobile applications used by field crews, GPS location data may be collected to enable routing and dispatch features, subject to device permissions.
• Cookies and Tracking Technologies: We use cookies and similar technologies as described in Section 10 below.

2.3 Information from Third Parties

• Payment Processors: Stripe may share transaction confirmation and fraud-prevention signals with us.
• AI Providers: When you use AI-powered features, data submitted to those features may be processed by our AI partners (including OpenAI) subject to their privacy practices.
• Integration Partners: If you connect third-party applications to your SkilledOS account, we may receive data from those services in accordance with your authorization.

2.4 Categories of Personal Information Under California Law

We collect personal information that falls within the following statutory categories as defined by the California Consumer Privacy Act (CCPA). A detailed table of these categories appears in Section 11 below.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

• Providing and Improving the Services: Creating and managing your account, processing transactions, delivering core platform features (scheduling, dispatching, invoicing, crew management), and maintaining the performance and security of the Services.
• AI-Powered Features: Powering scheduling optimization, lead scoring, route intelligence, and other AI-assisted operational tools within the platform.
• Customer Support: Responding to inquiries, resolving technical issues, and communicating with you about your account.
• Billing and Payments: Processing subscription fees, managing renewals, and issuing invoices.
• Communications: Sending product updates, security alerts, policy changes, and — where you have opted in — marketing communications and feature announcements.
• Analytics and Product Development: Analyzing aggregated usage patterns to understand how customers use the platform and to develop new features and improvements. We use anonymized or aggregated data for these purposes where possible.
• Security and Fraud Prevention: Monitoring for unauthorized access, detecting abuse, and protecting the integrity of the Services and our users.
• Legal Compliance: Complying with applicable laws, regulations, legal processes, and government requests.

4. How We Share Your Information

SkilledOS does not sell your personal information. We may share personal information in the following circumstances:

• Service Providers (Sub-processors): We engage trusted third-party vendors who process data on our behalf to support the Services. These include cloud hosting (Supabase/PostgreSQL), payment processing (Stripe), AI services (OpenAI), analytics providers, and customer support tools. All sub-processors are bound by contractual data protection obligations. We maintain a current list of sub-processors at skilledos.co/trust. SkilledOS will provide at least 30 days’ advance notice before engaging new sub-processors that handle personal data. If you have entered into a Data Processing Agreement (DPA) with us, you may object to a new sub-processor within 15 days of receiving notice, as described in the DPA.
• Business Transfers: In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or substantially all assets, your information may be transferred to the successor entity, subject to confidentiality obligations.
• Legal Requirements: We may disclose personal information when required by law, court order, or government authority, or when we believe disclosure is necessary to protect the rights, property, or safety of SkilledOS, our users, or the public.
• With Your Consent: We may share personal information with third parties when you have given us explicit consent to do so.
• Aggregated or De-identified Data: We may share aggregated or de-identified information that cannot reasonably be used to identify you.

5. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, including to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. When determining retention periods, we consider the nature and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements.

Specific Retention Periods:

• Account & Profile Data: Duration of subscription + 3 years after termination
• Payment & Billing Records: 7 years (tax and legal requirements)
• Job & Service Records: Duration of subscription + 3 years after termination
• Usage & Analytics Data: 26 months from collection
• Support Communications: 3 years from resolution
• Marketing Consent Records: Duration of consent + 2 years after opt-out
• Security Logs: 1 year
• Data Subject Access Request Records: 3 years from fulfillment

Upon request, we will delete or anonymize personal information where we are not legally required to retain it.

6. Data Security

SkilledOS implements commercially reasonable technical, administrative, and physical safeguards designed to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit using TLS 1.2 or higher;
• Encryption of data at rest for sensitive fields;
• Role-based access controls (RBAC) limiting internal access to personal data;
• Regular security assessments and vulnerability monitoring;
• Incident response procedures for data breach notification.

Data Breach Notification. In the event of a personal data breach, SkilledOS will:

• (a) Notify affected data subjects without undue delay and in no event later than 72 hours after discovery, to the extent required by applicable law;
• (b) Notify relevant supervisory authorities as required by GDPR Article 33;
• (c) Cooperate with you (if you are a Customer subject to GDPR or California law) to fulfill your own breach notification obligations;
• (d) Provide a written incident report detailing the nature of the breach, categories and approximate number of records affected, likely consequences, and remedial measures taken or proposed.

7. International Data Transfers

SkilledOS is headquartered in the United States. If you access the Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

For transfers of personal data from the European Economic Area, United Kingdom, or Switzerland to the United States, SkilledOS relies on appropriate transfer mechanisms, including Standard Contractual Clauses (“SCCs”) approved by the European Commission. To request a copy of the applicable transfer mechanisms, contact privacy@skilledos.co.

8. Children’s Privacy

The Services are not directed to children under the age of 16, and we do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will promptly delete such information. If you believe we may have inadvertently collected information from a child, please contact us at privacy@skilledos.co.

9. Your Privacy Choices

Regardless of your location, you have the following rights and choices:

• Access and Correction: You may access and update most of your account information directly through your account settings. To request access to or correction of other personal information, contact us at the address below.
• Marketing Communications: You may opt out of marketing emails by clicking the “unsubscribe” link in any marketing message or by contacting us. You cannot opt out of transactional communications related to your account.
• Data Deletion: You may request deletion of your personal information by contacting us. We will honor deletion requests to the extent we are not legally required to retain the data.
• Cookie Preferences: You may adjust cookie preferences through your browser settings. See Section 10 for more detail.

10. Cookies and Tracking Technologies

We use cookies, web beacons, pixel tags, and similar tracking technologies to operate and improve our Services. Types of cookies we use include:

• Essential Cookies: Required for basic site functionality, including authentication and session management. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with the Services (e.g., pages visited, session duration). We use these to improve our platform.
• Preference Cookies: Remember your settings and preferences to provide a personalized experience.
• Marketing Cookies: Used to track visitors across websites to display relevant advertisements. These are only placed with your consent where required by law.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may impact the functionality of the Services.

Global Privacy Control (GPC). SkilledOS honors the Global Privacy Control (GPC) signal as required by the CCPA/CPRA and applicable state laws. When we detect a GPC signal from your browser, we treat it as a valid opt-out of the sale or sharing of personal information associated with that browser. You can enable GPC through supported browsers and extensions at https://globalprivacycontrol.org.

Do Not Track (DNT). Some browsers transmit “Do Not Track” (DNT) signals. There is currently no uniform standard for interpreting DNT signals. SkilledOS does not currently respond to DNT signals, but does honor the Global Privacy Control signal as described above. We will update this disclosure if a formal DNT standard is adopted.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”):

Notice at Collection. At or before the point of collection, SkilledOS provides California consumers with notice of the categories of personal information collected and the purposes for which each category is used, as described in Sections 2 and 3 of this Privacy Policy. SkilledOS does not collect additional categories of personal information or use previously collected personal information for materially different purposes without providing you with additional notice.

Categories of Personal Information Under California Law. We collect the following categories of personal information as defined by the CCPA:

Your CCPA/CPRA Rights. You have the following rights:

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for which it is used, and the categories of third parties with whom it has been shared.
• Right to Delete: You have the right to request deletion of personal information we have collected about you, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: SkilledOS does not sell your personal information. We do not share personal information for cross-context behavioral advertising without your consent.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit our use and disclosure of sensitive personal information (as defined by CPRA) to purposes specifically authorized by law.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

Categories of Sensitive Personal Information. SkilledOS may collect the following categories of sensitive personal information as defined by the CPRA:

• (a) Account log-in credentials (username and password) in combination with required security questions;
• (b) Precise geolocation data (for field crew mobile app users with device permissions enabled).

SkilledOS does not collect: social security numbers, driver’s license numbers, racial or ethnic origin, religious beliefs, genetic data, biometric data, health information, or sexual orientation data. We use sensitive personal information only for purposes authorized by CPRA Section 1798.121, including performing the Services, maintaining security, and short-term transient use.

Financial Incentives. SkilledOS does not offer financial incentives, price differences, or service differences based on a consumer’s exercise of their CCPA/CPRA privacy rights. If we offer loyalty or rewards programs in the future, we will provide a separate financial incentive notice as required by law.

California “Shine the Light” Disclosure. Under California Civil Code Section 1798.83, California residents who have an established business relationship with us may request a list of any personal information we have shared with third parties for direct marketing purposes during the preceding calendar year. SkilledOS does not share personal information with third parties for their own direct marketing purposes. To submit a request, contact privacy@skilledos.co.

Exercising Your Rights. To exercise these rights, submit a verifiable consumer request to privacy@skilledos.co or contact us as described in Section 14. We will respond within 45 days of receipt of a verified request (extendable by an additional 45 days with notice).

You may designate an authorized agent to submit requests on your behalf. We will require verification that the agent is authorized to act on your behalf.

12. European and UK Privacy Rights (GDPR/UK GDPR)

If you are located in the European Economic Area (“EEA”), United Kingdom (“UK”), or Switzerland, the following provisions apply:

Lawful Bases for Processing. We process personal data under the following lawful bases:

• Contract Performance: Processing necessary to provide the Services under our Terms of Service;
• Legitimate Interests: Processing necessary for our legitimate business interests (e.g., security, fraud prevention, product analytics), balanced against your rights;
• Legal Obligation: Processing required by applicable law;
• Consent: Processing based on your specific, informed, and freely given consent (e.g., marketing emails, certain cookie placements).

Your GDPR Rights. You have the right to: access your personal data; rectify inaccurate data; request erasure (“right to be forgotten”); restrict or object to certain processing; data portability; and to withdraw consent at any time without affecting the lawfulness of prior processing. You also have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or the relevant supervisory authority in your EEA country).

Automated Decision-Making. The Services include AI-powered features that assist in operational decision-making, such as scheduling optimization and lead scoring. These features are designed as decision-support tools that augment, but do not replace, human decision-making. You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. If you believe an automated decision has materially affected you, contact privacy@skilledos.co to request human review.

Data Controller. For EEA/UK users, SkilledOS, Inc., a wholly-owned subsidiary of Connective Technologies, Inc., is the data controller. To exercise your rights or for questions about our data processing, contact our Data Protection Officer (DPO) at privacy@skilledos.co.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated Policy on our website with a new effective date and, where required by law, by sending you an email notification. We encourage you to review this Policy periodically.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us: