Privacy Policy

Last updated: September 18, 2026

Who we are

Harkirat Singh ("Companion", "we", "us", or "our") develops and operates the Companion mobile and desktop application (the "App") and related services (together, the "Service") for independent field-service businesses and their technicians. This Policy explains what information the Service collects, how it is used, who it is shared with, how long it is kept, and the choices available to you. If you have questions about this Policy, contact us at billharki@hotmail.com.

Scope and roles

The Service is business-to-business software. An "Organization" is the business account created by an "Owner." Owners may invite "Technicians" to join the Organization. Owners and Technicians are collectively "Users."

Organizations use the Service to store information about their own customers, properties, and equipment ("Customer Data"). As between Companion and an Organization, the Organization controls what Customer Data it collects and why, and is responsible for having a lawful basis to collect and store that data and for responding to requests from its own customers. Companion processes Customer Data only to provide, secure, and support the Service.

Information we collect

Account and profile information: name, email address, phone number, password (stored by our authentication provider in hashed form, never in plain text or visible to us), organization membership, and role (Owner or Technician).

Organization information: business name, primary trade, timezone, currency, business address, business phone/email, and logo.

Customer Data entered by Users: customer names, addresses, phone numbers, email addresses, preferred contact method, and internal notes; property and equipment/asset records and their service history and measurements; job, estimate, invoice, and payment records; and photos and captions attached to jobs, equipment, or service records.

Payment information: when an Organization enables Stripe payment collection, payment card details are entered directly into Stripe-hosted checkout pages and are never transmitted to or stored on Companion servers. Companion stores payment status, amounts, and Stripe-issued identifiers needed to reconcile invoices.

Address lookup queries: when a User types an address, the partial text may be sent to OpenStreetMap Nominatim, a third-party, token-free geocoding service, to suggest matching addresses. See "Third-party service providers" below.

Communications content and metadata: when an Organization sends a customer report, invoice link, or notification by email or SMS, the recipient address/number, message content, and delivery status are processed to deliver and audit that message.

Device and diagnostic information: device type, operating system version, and app version, used for support and, where a crash reporting service is active, crash and stability diagnostics.

Local, offline data: the App stores a local copy of Organization and Customer Data on the device using an on-device database so Users can keep working without network connectivity. This local copy is protected by the device's own security (passcode, disk encryption) and is synchronized to our servers when the device is online.

How we use information

We use the information described above to: provide, operate, and maintain the Service and its offline/online synchronization; authenticate Users and enforce Organization- and role-based access controls; process payments and generate invoices/receipts on behalf of an Organization; deliver customer-facing hosted invoice, estimate, and report links; send Organization- and User-directed communications (e.g., invitations, invoices, reports); provide customer support; detect, investigate, and prevent fraud, abuse, and security incidents; and comply with legal and financial recordkeeping obligations.

We do not sell Customer Data or Account information, and we do not use Customer Data to serve third-party advertising.

Third-party service providers

We use the following service providers to operate the Service:

• Supabase (database, authentication, file storage, and serverless functions) — hosts Organization and Customer Data, profile data, and uploaded photos, and enforces access rules so an Organization can only access its own data.

• Stripe (Stripe Connect) — processes payments on behalf of an Organization when the Organization enables it. Stripe acts as the merchant of record for card data; see Stripe's own privacy policy at https://stripe.com/privacy.

• OpenStreetMap Nominatim — provides address autocomplete suggestions from partial address text a User types. No API key or persistent identifier is sent; see https://operations.osmfoundation.org/policies/nominatim/.

The Service is also built to support optional email/SMS delivery, crash-reporting/diagnostics, voice transcription, and equipment-label (OCR) extraction providers. Any such provider is used only to perform the specific function a User requests (for example, sending an invoice, or transcribing audio a User submits), and this Policy will be updated to name a provider once it is active.

We require our service providers to protect information under confidentiality and data-protection obligations consistent with this Policy, and to use it only to provide services to us.

Data retention

We retain Account and Customer Data for as long as the Organization maintains an active account, and afterward for as long as needed to comply with legal, tax, and financial recordkeeping obligations (for example, invoice and payment records), to resolve disputes, and to enforce our agreements.

When a User deletes their own account (Profile > Delete account), we immediately: (a) prevent that account from signing in again; (b) remove the account's personal profile information (name, phone number); and (c) deactivate the account's membership in every Organization. Job, invoice, service, and other business records the account previously created remain with the Organization, because Organizations are independently required to retain them for financial, tax, and warranty purposes, but they are no longer linked to the deleted account's live sign-in. If an Organization deletes an entire Organization/business account, we will delete or anonymize the associated Customer Data within a commercially reasonable period, except where retention is required by law.

Your choices and rights

Users may review and correct their own name and phone number, review their Organization memberships, sign out of the Service, and permanently delete their own account, all from Profile in the App.

Depending on where you live, you may also have rights to access, correct, export, or request deletion of personal information we hold about you, and to object to or restrict certain processing. Because much of the information in the Service is Customer Data entered and controlled by an Organization, requests concerning that data (for example, a request from one of an Organization's own customers) should generally be directed to that Organization first. You may also contact us at billharki@hotmail.com and we will route or respond to the request as required by applicable law.

Data security

We use technical and organizational measures designed to protect information, including encryption in transit, database-level access policies that isolate one Organization's data from another's, and secure, time-limited access tokens for customer-facing hosted invoice and report links. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

International data transfers

Our infrastructure providers may process and store information in the United States and other countries where our service providers operate. Where required by law, we use appropriate safeguards for cross-border transfers of personal information.

Children's privacy

The Service is intended for business use by adults and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us so we can delete it.

Changes to this policy

We may update this Policy as the Service changes, including as new providers described above become active. We will update the "last updated" date below and, for material changes, provide additional notice in the App.

Last updated: September 18, 2026

Contact us

Questions about this Policy or your information can be sent to billharki@hotmail.com.