Privacy Policy

What we collect

• Account information (name, email address) used for login and access control.
• Business data entered into the platform by authorized users: customers, sites, chemical inventory, orders, invoices, work orders, service reports, mileage, and training records.
• Files uploaded by users (photos, PDFs) for work orders and documentation.
• Location, if you use mileage tracking. Starting a drive records your device's coordinates at that moment, and the finished drive stores start and end coordinates. Your browser asks permission first, and declining leaves mileage entry manual.
• Access logs and authentication events for security monitoring and audit purposes.

How we use data

• To provide the platform's features: inventory tracking, ordering, work orders, reporting, and customer portal access.
• To deliver operational notifications you or your administrator configure.
• To monitor platform reliability, detect errors, and maintain security (server logs, error monitoring).
• We do not sell your data to third parties.

Cookies and device storage

We use cookies to sign you in and to remember a few preferences. We do not use advertising cookies, cross-site tracking, or any third-party analytics script.

In the customer portal

• Keeps you signed in after you enter the emailed code — 12 hours (oversight_portal_access).
• Recognises your browser so you are not asked for a code every time, set only if you tick "This is my own device" — the cookie is kept 180 days, and the trust it carries stops working after 30, after which you are asked for a code again (oversight_portal_device).
• Remembers which of your locations you are viewing — cleared when you close the browser (portal_site_ctx_…).
• Remembers that you dismissed the "add this to your home screen" tip — one year (portal_home_hint_dismissed).
• In the installed crew app, remembers the last job page so the icon reopens it — 180 days (crew_last_path).

When you sign in as a staff user

• Your sign-in session — 24 hours, and you are signed out after an hour of inactivity (oversight_seen).
• Records that you completed two-factor verification — 24 hours (x-mfa-verified). Two short-lived cookies are used during two-factor setup; the one that reveals backup codes lasts ten minutes.
• Remembers which company you are working in — 30 days (x-active-company).

Either way

• Your browser's time zone, so dates and times display correctly — one year (oversight_tz).

Other storage on your device

• An in-progress mileage trip — including the coordinates recorded when you started it, and any notes you typed — is held in your browser so a refresh does not lose it. It stays until the trip is saved or discarded; unlike the cookies above it has no automatic expiry.
• A form you were part-way through, and the last action you took, are kept for the current tab only and are cleared when you close it.
• The installed crew app keeps a copy of its own pages so it opens without a signal.

Managing all of this. Clearing site data in your browser removes every item above from that device, and the portal will ask for a code again next time. A remembered device also stops being trusted on its own after 30 days. If a device is lost or a person leaves, ask your service provider to remove that contact from the portal or replace the portal link — either takes effect on the next request, on every device.

Google sign-in. If you sign in with Google, Google sets its own cookies on its own domains. Those are governed by Google's privacy policy, not this one.

Who else handles your data

Running OverSight means a few other companies process data on our behalf. None of them is an advertising or analytics company, and we do not sell your data.

• Vercel — hosts the application; every request passes through it.
• Supabase — the database, and the storage for files you upload: photos, receipt scans and documents.
• Google — signing in, sending mail from your own Google account, turning addresses into map coordinates, and reading text out of images you upload.
• Anthropic — reads receipt and vendor-invoice images to pull out the amounts and dates. Their terms state they may not train models on this content.
• SerpApi — runs parts price searches. It receives the words you typed and nothing identifying you or your customer.
• Apple and Google push services — deliver notification alerts to your phone. They receive a wake-up signal only, never the message content.

Two more are built in but switched off, and receive nothing unless we enable them: error monitoring (Sentry) and a backup email sender (Resend).

The application and its database run in the United States.

Data isolation

The platform uses multi-tenant architecture. Each organization's data is logically isolated. Users can only access data belonging to their own organization and the accounts assigned to them.

Google services

If your account uses Google OAuth for sign-in, your Google profile information (name and email) is used solely to authenticate your identity. We request only the minimum permissions needed. You may revoke access at any time through your Google Account settings.

Data retention

Business data is retained for the duration of your account and a reasonable period after account closure to support audit and recovery needs. Contact your account administrator or service provider to request data deletion.

Contact

For privacy-related questions, contact your account representative or service provider. See our Contact page for details.