Privacy Policy

Document version: 2026-10-07

This policy describes information handled through OtisOS business software and its enabled integrations. The business using OtisOS controls which customer and workforce records it enters, who it authorizes to access them, and which optional services it enables. Direct privacy questions to otisoshvac@outlook.com.

Information processed

• Account and company details: names, work email, contact information, business/service addresses, company profile, member roles, authentication records, and versioned legal acceptance.
• Business records: customers, properties, equipment, appointments, service calls, diagnostic readings, observations, recommendations, reports, photographs, uploaded files, and other information your company supplies.
• Financial and workforce records: estimates, invoices, payment references/status, accounting records, and time-clock/payroll-related data where used.
• Compliance records: technician/EPA certification information, refrigerant activity, and supporting files where entered.
• Operational information: device/app version, installation or notification identifiers, errors, integration health, audit history, and synchronization information used to operate and troubleshoot the service.

Device permissions and optional features

Location/map features process location or addresses when used, for example to find nearby suppliers or identify a service location. Camera/photo permissions support evidence and document uploads. Device permissions are controlled through the operating system. Denying a permission may prevent that feature from working without changing unrelated business records.

When AI Receptionist or other telephony features are enabled, OtisOS and its telephony providers process call routing information, call identifiers, duration/usage, caller details, messages and intake information, transcripts, and recording references where recording is configured. Audio is processed by the enabled telephony/AI service. Microphone access applies only to features that request and use it. Your company is responsible for required notices, permissions, and appropriate use of caller information.

Why information is used

Information supports authentication, company-isolated workspaces, scheduling and field work, reports, billing, payments, optional AI/telephony, notifications, customer communications, exports, fraud/abuse prevention, troubleshooting, and support. OtisOS also uses billing and legal-acceptance records to administer the service. Do not put unnecessary sensitive information into free-text notes or attachments.

Infrastructure and service providers

Supabase supplies authentication, database, storage, and server-function infrastructure. Square processes platform subscription payments and supported Square payment flows. Helcim processes enabled OSPay merchant payments. Telnyx and enabled telephony/AI providers support receptionist and calling features. Hosting, notification, map/location, and supplier-discovery services receive information needed for their enabled functions. Those providers operate under their own applicable terms and privacy policies.

Full card numbers and CVV are entered through approved payment-provider components, not stored as OtisOS business records. OtisOS may retain provider transaction identifiers, amounts, payment status, receipts, and limited card descriptors supplied by the processor. Server-side integration credentials are not intended for client display. Do not send card numbers, CVV, or API credentials through support messages or business notes.

Access, sharing, and security

Authorized company members access information according to their company membership and supported permissions. Information may be shared with a customer or another receiving application when your company sends a report, uses a customer portal, shares a file, or enables an integration. Support or platform administration may require authorized access for operations, security, or a requested support task. Information may also be disclosed when required by law or reasonably necessary to address security, fraud, or legal claims.

OtisOS uses authentication, tenant-access controls, server-side credential handling, and other technical safeguards appropriate to its implementation. No system can promise absolute security. This policy does not represent a regulatory certification or authorize a sale of your company's customer records.

Retention, export, and deletion requests

Records are retained as needed to provide the service, maintain business and payment history, address support/security matters, and meet applicable obligations. Retention depends on the record type and those purposes; no fixed deletion schedule is established by this policy. Trial expiration, pause, or cancellation does not automatically delete company records. Authorized businesses can use available read-only views and exports, subject to security and legal restrictions.

Contact your company administrator about correcting or accessing its records. For privacy or deletion requests involving OtisOS, contact otisoshvac@outlook.com. Requests may require identity/authority verification, and some records may need to be retained for applicable obligations or legitimate recordkeeping. A subscription cancellation and a data-deletion request are separate actions.

Account security and policy changes

Protect your sign-in details and devices, restrict access to appropriate staff, and report suspected unauthorized access. Local app caches or downloaded/shared reports may remain on devices or with receiving applications; manage those copies appropriately.

Policy versions and acceptance timestamps are recorded. Existing acceptance history is preserved when text changes, and material changes will be communicated appropriately. No historical acceptance is fabricated for existing accounts. The current version is available at otisos.com/privacy; the Terms of Service describe service and subscription terms.