Privacy Policy

AssetHours ("AssetHours," "we," "us") provides equipment maintenance tracking software at https://www.assethours.com. This Privacy Policy describes how we handle information when you use the AssetHours web application, related APIs, and native field client. It reflects the capabilities present in our V1 product. It is not a claim of compliance with GDPR, CCPA, or other privacy laws.

Information we process

Depending on how you use AssetHours, we process:

• Account and organization information — email address, password (stored by our authentication provider), display name, organization name, membership role, timezone, and related account settings.
• Equipment and maintenance data you supply — equipment records, meter readings, service events, maintenance requirements, issues, operator notes, and organization-specific maintenance policies.
• Reference and manufacturer information — equipment model references and manufacturer documentation links drawn from AssetHours reference catalogs and sources you or your organization associate with equipment. AssetHours does not guarantee the accuracy or completeness of reference or OEM material.
• Uploaded files — issue attachment metadata and file objects stored in private organization storage when your organization uploads attachments.
• Billing-related identifiers — subscription status, plan tier, Stripe customer and subscription identifiers, and billing portal session metadata. AssetHours does not store full payment card numbers; card data is handled by Stripe on Stripe-hosted pages.
• Notification delivery data — email addresses used for transactional and product notifications; web push subscription endpoints and keys when you opt in; native push tokens when you register a mobile device; notification preferences and delivery logs (with payload identifiers cleared on account or organization deletion as described below).
• Operational and security data — request logs, error reports, and diagnostic events needed to operate and secure the service.

How we use information

We use the information above to:

• Provide, authenticate, and secure access to AssetHours.
• Store and display your organization's equipment, maintenance, issues, attachments, and related history.
• Send transactional messages such as email verification, password recovery, invitations, and maintenance notifications you or your organization enable.
• Deliver optional web and native push notifications according to your preferences.
• Process subscriptions and entitlements through Stripe-hosted checkout and billing portal flows.
• Monitor errors and reliability, investigate abuse, and improve operational stability.
• Produce bounded CSV exports and process organization-initiated bulk imports when authorized users request them.

AssetHours V1 does not sell customer personal information, does not use advertising networks, and uses Microsoft Clarity only on the public web experience for product and user-experience analytics. The launch configuration is privacy-conscious and cookieless; authenticated, private, tenant, and token-bearing surfaces are not intentionally instrumented. Application, database, and Stripe records remain the authoritative business records.

Service providers and infrastructure

AssetHours relies on third-party infrastructure and processors to operate the service, including:

• Supabase — authentication, PostgreSQL database, Row Level Security, and private object storage for attachments.
• Vercel — hosting for the web application and scheduled notification jobs.
• Stripe — subscription billing, hosted checkout, and customer billing portal.
• Resend — outbound email for invitations and notification messages; Supabase Auth may also send authentication email through configured SMTP (including Resend SMTP when enabled).
• Expo push services — delivery of native mobile push notifications when you register a device token.
• Sentry — error and performance monitoring on the web application and server, with scrubbing configured to reduce sensitive data in reports.
• Microsoft Clarity — interaction and usage analytics on the public web experience in the privacy-conscious cookieless launch configuration described above.

These providers process data on our behalf according to their terms and our configuration. We do not authorize them to use your organization content for their own advertising purposes.

Platform-internal telemetry

AssetHours records minimized, platform-internal catalog demand telemetry (for example, aggregated reference search dimensions and equipment recognition enums). This telemetry does not include organization identifiers, user identifiers, equipment identifiers, raw search text, serial numbers, or email addresses. Tenant users cannot read this telemetry. Retention is limited to approximately 180 days and is cleared through manual owner operations rather than an automatic customer-facing purge schedule.

Retention and deletion

We retain active account and organization data while your account or organization remains in use and as needed to provide the service.

Account deletion. When you delete your account, AssetHours removes your Supabase Auth identity after recording a local account tombstone, clears your display name, revokes notification endpoints and tokens associated with you, and redacts matching pending invitations. Equipment, service history, and other tenant records associated with organizations you belonged to are retained under those organizations' history rules.

Organization deletion. When an organization owner deletes an organization, AssetHours records an organization tombstone, revokes memberships and invitations, neutralizes notification subscriptions, cancels the organization's Stripe subscription (without deleting the Stripe customer record), and asynchronously purges listed private attachment objects from storage. Equipment and historical records remain retained but the organization becomes unusable.

Deleted organizations are ignored by billing reconciliation. External cleanup steps (Stripe cancellation, storage purge) may be retried if they fail; a revoked owner may retry incomplete cleanup from settings.

AssetHours V1 does not offer bulk historical hard-delete of all tenant records beyond the deletion flows above. Downgrading a subscription or entering a restricted unpaid state retains your data while limiting operational writes.

Security

We use HTTPS for web traffic, authenticated access controls, database row-level security for tenant data, private storage buckets for attachments, and server-side secret handling. No security measure is perfect; you are responsible for choosing strong credentials and managing access within your organization.

Your choices and contact

Organization owners and authorized members manage most data directly in AssetHours. You may update your display name, manage notification preferences, export bounded CSV data when entitled, and initiate account or organization deletion from the product where your role permits.

For privacy questions or requests related to AssetHours, contact us at hello@assethours.com. We will review requests we can reasonably fulfill with the deletion, export, and access controls described in this policy and in the product.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date above and publish the updated policy at this URL. Continued use of AssetHours after an update constitutes acceptance of the revised policy.

See also our Terms of Service.