Privacy Policy

1. Who we are

JobSorted is run by Navigatem Sàrl-S ("JobSorted", "we", "us"). Navigatem Sàrl-S is registered in Luxembourg with the Trade and Companies Register (RCS) under number B268646, and its registered office is at 9 an de Gaarden, L-6842 Machtum, Luxembourg.

If you have any questions about this policy or your data, email support@jobsorted.app. We haven't appointed a data protection officer because we're not required to, so please contact us directly.

2. Who this policy covers

Businesses use JobSorted to send quotes and invoices to their customers. So this policy covers two groups of people, and our role is different for each:

• Businesses that use JobSorted ("users"). For your account and business details, we're the controller. That means we decide how that information is used, and this policy explains how.
• Their customers. If a business sent you a quote or invoice through JobSorted, that business is the controller of your information, and we process it on the business's behalf, as its processor. Section 9 explains what that means for you.

Our Terms of Service (section 15) set out the rules we follow when we process customer information for a business.

3. What we collect about users

• Account details: your sign-in email address, when you signed up and last signed in, and how you sign in: a one-time code or link sent to your email, or Google or Apple where we offer them. Also your plan (for example a free trial), and when you cancel a plan or ask to delete your account.
• Business details: your business name, your name, phone number, email address, address and country, time zone, tax details, currency, payment terms and quote settings, and your logo. Your logo is stored at a web address that anyone who has it can open, because it appears on your quotes and invoices.
• Bank details: the bank details you want on your invoices, such as the account name and number, IBAN, BIC, sort code or routing number, depending on your country. When you change them, we keep a record of the change, showing only the last four digits, and email you an alert.
• Settings: whether reminders are on, your reminder schedule and wording, and your notification choices.
• Support and problem reports: what you tell us when you email us or use "Report a problem" or "Suggest an idea", along with your sign-in email, the screen you were on, the app version and your browser details.
• Error reports: when something goes wrong in the app, it sends us a technical report: the error, the type of screen, the app version, your browser details, and your business's ID if you're signed in. We remove email addresses, IBANs, sign-in details and long numbers from it first.
• Phone notifications: if you turn them on, a technical address for your device (a "push subscription") so we can send notifications to it.
• Paying for JobSorted: if you pay by card, Stripe takes the payment and keeps your card details. We never see or store them. We keep the references Stripe gives your account and subscription, and your subscription's status: whether it's paid, when it renews or ends, and whether a payment failed.
• Free trials: so each person gets one free trial, we keep a one-way code made from your sign-in email address, with the parts that don't change who you are taken out (such as dots in a Gmail address, and anything after a +), and when you first started. The code can't be turned back into your address.

We don't keep our own log of users' IP addresses. Our hosting providers keep standard technical logs, which include IP addresses, for a short time (see section 8).

4. What we process for users about their customers

When you use JobSorted, you add information about your customers. We process it for you, as your processor:

• Customer details: name, email address, phone number, job and billing addresses, company name and tax number if the customer is a business, and your notes.
• Quotes and invoices: what's in them, including line items, prices, notes and photos; when they were sent, first opened, accepted or declined; and the payments you record. Photos are stored privately, and we remove location and camera details from them.
• What happens on your customer's page: the first time a quote or invoice is opened. If a quote is accepted or declined, we keep a record of the decision with the time, the customer's IP address, their approximate country, their browser details and any reason they gave. We also keep any questions your customer asks, with your replies.
• Emails: which emails and reminders were sent, to which address, and whether they were delivered.
• A "stopped emails" list: if a customer uses the link in an email to stop your emails, we keep their email address so they aren't emailed again. This stays even if you delete the customer.

5. How we use information, and why we're allowed to

This covers the information we're the controller of (section 3). The law requires us to have a reason, called a legal basis, for each use:

We don't sell personal data, we don't use it for advertising, and we don't use it to make automated decisions that have legal or similarly significant effects on anyone.

We'll send you important emails about your account and about changes to JobSorted. We won't send you marketing emails unless you've agreed to them.

6. Who we share it with

We use a small number of trusted companies to run JobSorted. They only process data on our instructions, under contracts that protect it. These are our sub-processors:

We may also share information when the law requires it, to protect people's rights, safety or property, or with a buyer if JobSorted is ever sold. A buyer would have to keep protecting it as this policy says.

When you send a quote or invoice, anyone with the link can open it, so only share it with the right person. Quote links stop working after 90 days and invoice links after 180 days, and you can switch a link off at any time.

7. Transfers outside the EU

JobSorted's main database and files are stored in the EU, in Ireland, and our server code runs in Dublin. Some of our providers, such as Resend and GitHub, are US companies. When personal data goes outside the European Economic Area or the UK, we make sure it's protected, using an adequacy decision (such as the EU–US Data Privacy Framework, where the company is certified) or the standard contractual clauses approved by the European Commission, with the UK addendum where needed.

8. How long we keep it

• Your account and business details: for as long as your account is open. When you delete your account (in Settings), we keep everything for 30 days in case you change your mind, then delete it, except anything the law requires us to keep. If you ask us by email instead, the same 30 days apply.
• Your customers' data and your documents: for as long as your account is open. You can delete customers who have no quotes or invoices, draft quotes and invoices, and photos. Sent quotes and invoices, and the customers they belong to, stay on record because they're part of your business records. When your account is deleted, they go with it, 30 days after you ask, so download anything you need first. Tax rules in many countries require you to keep invoices for several years.
• The "stopped emails" list: for as long as your account is open, so people who asked not to be emailed aren't emailed again.
• Flagged messages: if our automatic checks flag something written in JobSorted, we keep a copy of it so we can read it. If it's fine, we delete the copy after 90 days. If we have to act on it, we keep it for a year.
• The free-trial code: kept after your account is deleted, so the same person can't start another free trial. It's a one-way code, not your address.
• Payment records: Stripe keeps invoices and payment records for as long as the law requires. We keep your subscription's references and status for as long as your account is open.
• Backups: our encrypted backups are deleted automatically after 35 days. Our database provider also keeps its own backups for up to 7 days. So deleted data disappears from all backups within 35 days.
• Error and problem reports: for as long as we need them to fix problems and improve JobSorted. We review them regularly and delete ones we no longer need.
• Hosting providers' technical logs, which include IP addresses: for a short time, usually a few days, as set by each provider.
• On your device: the offline copy of your data expires after 7 days, and everything is cleared when you sign out.

9. If a business sent you a quote or invoice

If you received a quote, invoice or reminder from a business through JobSorted:

• The business is in charge of your information. It decides what to add about you and what to send you. It's the controller, and we process your information on its behalf.
• What we hold: the details the business added, such as your name, email address, phone number, addresses and its notes about the job; the quotes and invoices it sent you, including any photos; the first time you opened each one; and any questions you asked, with the business's replies.
• If you accept or decline a quote, we keep a record of your decision with the time, your IP address, your approximate country and your browser details, as evidence of what was agreed.
• Emails and reminders come in the business's name, and replies go to the business. Every email has a link to stop them. If you use it, we won't email you for that business again, and we'll let the business know. Reminders about a quote or invoice also stop once you accept or decline it, or once the business records your payment.
• Safety checks. To protect you from scams and abuse, we automatically check what businesses send through JobSorted, and the questions you ask, for signs of phishing, threats, hate speech or abuse. If something is flagged, we may read it, and we keep a copy as section 8 says.
• No cookies or tracking. The pages you open don't use cookies, tracking or advertising.
• Your rights: to see, correct or delete your information, please contact the business first. If you can't reach them, email support@jobsorted.app and we'll help where we can.

10. Cookies and storage on your device

JobSorted doesn't set cookies, and we don't use advertising, tracking or analytics services.

The app stores only what it needs to work on your device:

• your sign-in session, so you stay signed in;
• an offline copy of your data, so the app opens fast and works when the signal is poor. It never includes bank details or photos, it expires after 7 days, and it's cleared when you sign out;
• small settings, such as a notice you've dismissed;
• a note that lets a page reload once after we release an update. This is the only thing the pages your customers open store.

This storage is strictly necessary for JobSorted to work, so it doesn't need your consent. On the sign-in screen, Cloudflare Turnstile checks your browser to make sure you're a person and not a bot. Cloudflare handles that information under its own privacy policy.

11. How we keep it safe

• Data is sent over encrypted connections (HTTPS), and our providers encrypt it when it's stored.
• Each business's data is kept separate at the database level, so one business can't see another's. We test this automatically whenever we change the code.
• Customer links are long random codes that we store scrambled. They expire, and you can switch them off.
• Changing bank details needs a recent sign-in, is recorded, and sends you an email alert. Invoices keep the bank details they were sent with.
• We remove location and camera details from photos when they're uploaded.
• Our backups are encrypted, and only the founder holds the key.
• Only the founder can use our admin tools, and they need two-step sign-in. The admin dashboard shows how JobSorted is running, not your customers' details. If we need to look inside your account to help you, we open a read-only view for 30 minutes. That needs a fresh two-step sign-in and a written reason, and every look is recorded.

No system is perfectly secure. If a breach puts your data at risk, we'll tell you, and the regulator, as the law requires.

12. Your rights

Under data protection laws, such as the GDPR in the EU and the UK GDPR in the UK, you have the right to:

• ask for a copy of your personal data;
• ask us to correct it;
• ask us to delete it;
• ask us to limit how we use it, or object to how we use it;
• get your data in a format you can move to another service;
• withdraw your consent at any time, where we rely on it, for example for phone notifications.

You can correct most of your details yourself in the app, and delete your account in Settings. For anything else, including a copy of your data, email support@jobsorted.app. We'll reply within one month, and we may need to check who you are first. We handle these requests the same way wherever you live. If you're the customer of a business that uses JobSorted, we'll usually pass your request to that business, because it's in charge of your data.

You also have the right to complain to a data protection regulator. Ours is the National Commission for Data Protection (CNPD) in Luxembourg (cnpd.lu), and you can also go to the regulator in the country where you live or work. We'd appreciate the chance to sort things out first, so please contact us.

13. Children

JobSorted is a service for businesses and isn't meant for anyone under 18.

14. Changes to this policy

We'll update this policy when the way we handle personal data changes. If we make a significant change, we'll tell users by email or in JobSorted before it takes effect. The date at the top shows when it was last updated.

This policy is also on our website in other languages, to help you read it. If a translation says something different, the English version counts.

15. Contact us

Email support@jobsorted.app, or write to Navigatem Sàrl-S, 9 an de Gaarden, L-6842 Machtum, Luxembourg.