Privacy Policy

1.1 Website, Demo, and Contact Information

When you visit our website, request a demo, submit a form, contact us, or interact with our marketing pages, we may collect:

• Name
• Email address
• Phone number
• Company name
• Job title or role
• Message content
• Referral source
• IP address
• Browser and device information
• Pages visited
• General usage and analytics data

We use this information to respond to inquiries, provide demos, improve our website, support sales conversations, and understand how visitors interact with PortaPro Software.

1.2 Account and Organization Information

When a company signs up for PortaPro Software, we may collect:

• Company name
• Business contact information
• Admin user name and email
• User names and email addresses
• User roles and permissions
• Authentication identifiers
• Organization settings
• Account preferences
• Tenant/workspace identifiers

1.3 Operational Data Entered Into the Platform

Customers own the operational data they enter into PortaPro Software. This may include:

• Customer records
• Service locations
• Unit and inventory details
• Quotes and proposals
• Work orders
• Invoices and payment records
• Route schedules
• Driver task completion data
• Service notes
• Images and service photos
• Vehicle and fleet information
• Maintenance records
• Consumables
• File uploads
• Customer portal activity
• Internal notes, tags, and custom fields
• Communications sent through the platform
• Voice calls, call recordings, and voicemails, where an organization enables calling features
• GPS and vehicle location data, where an organization enables GPS hardware or driver location features

PortaPro Software generally acts as a service provider or processor for this operational data. Our business customers are responsible for determining what information they enter into the platform and for providing any required notices to their own employees, drivers, contacts, and end customers.

1.4 Authentication and Identity Information

PortaPro Software uses Clerk for secure authentication and identity management. Clerk may process information such as email address, login credentials, passkeys, device sessions, two-factor authentication tokens, and user metadata.

PortaPro Software does not receive or store plaintext passwords.

Users who choose to connect an optional third-party email account (such as Gmail, Google Workspace, Outlook, Microsoft 365, Yahoo, iCloud, Zoho, GoDaddy, or a custom SMTP mailbox) to send email from within PortaPro Software will have OAuth tokens or SMTP credentials stored securely as described in Section 11.

1.5 Payment Information

PortaPro Software uses Stripe for payment processing. We do not store full credit card numbers, bank account numbers, CVV codes, or full card expiration details.

We may receive limited billing and transaction information, such as:

• Payment status
• Customer billing history
• Invoice records
• Last four digits of a payment method
• Stripe customer or account identifiers
• Subscription status
• Payout or Connect-related information, where applicable

1.6 Device, Log, and Usage Information

To operate, secure, support, and improve the platform, we may collect:

• Device type
• Browser type
• Operating system
• IP address
• Login and session activity
• Pages or features used within PortaPro Software
• Error logs
• Performance data
• General usage telemetry

We do not sell personal browsing history or use customer operational data to train third-party foundation AI models.

1.7 Connected Bank Account Information

Where an organization chooses to connect a business bank or credit card account, PortaPro Software receives read-only financial data through Stripe Financial Connections, with the account holder's explicit permission given at the time of connection. This may include:

• Institution name
• Account nickname and account type (such as checking, savings, or credit card)
• The last four digits of the account number
• Current and available balances
• Transaction history, including date, description, amount, and status

PortaPro Software does not receive or store full bank account numbers or online banking credentials. This data is used solely to display the organization's own account activity inside PortaPro Software and to reconcile it against invoices, payments, and expenses the organization already tracks in the platform. It is never used to initiate payments or transfers, to assess creditworthiness, or for advertising.

Bank account and transaction data obtained through this feature is stored only in the United States. An organization may disconnect a bank account at any time from Financials → Banking, which stops all future syncing. See Section 8 for how this data is retained and deleted.

PortaPro Software may send transactional emails, platform notifications, and, where enabled, SMS messages. These may include account notifications, service updates, job reminders, invoice notifications, customer portal messages, support communications, or other messages configured by an organization.

If SMS notifications are enabled, phone numbers and message content may be processed by Twilio or other communication providers. Message and data rates may apply. Users may opt out of certain communications where required by law.

Where an organization enables PortaPro Software's phone system, voice calls are carried by Twilio. Organizations control optional features such as call recording and voicemail; recordings and voicemails are stored with organization-level isolation. Organizations are responsible for complying with applicable call recording and consent laws in their jurisdictions, including providing any required notice to parties on a call.

PortaPro Software does not initiate unsolicited text message marketing without appropriate consent.

Where a user has connected their own email account (for example, Gmail, Outlook, or a custom SMTP mailbox), certain outbound emails may be sent through that connected account rather than through PortaPro Software's shared transactional email infrastructure. See Section 11 for details.

5.1 Database Storage

Operational data is stored using Supabase Postgres and related infrastructure. Supabase provides managed database hosting, access controls, encryption features, backups, and infrastructure security protections.

5.2 Hosting and Deployment

PortaPro Software is hosted on secure enterprise cloud infrastructure. Our hosting provider supplies application hosting, deployment management, CDN delivery, environment variable protection, serverless functions, and related platform infrastructure.

5.3 File Storage

Images, uploaded documents, service photos, and other files may be stored using Supabase Storage or similar cloud storage providers. Access to files may be controlled through signed URLs, permission rules, authentication checks, and time-limited access tokens.

5.4 Connected Email Account Credentials

OAuth tokens (for Google and Microsoft connections) and SMTP credentials (for other providers) associated with user-connected email accounts are stored encrypted at rest inside PortaPro Software's Supabase database, with access restricted through row-level security. See Section 11 for the full disclosure covering these integrations.

Customers own the operational data they enter into PortaPro Software.

Upon request, organization owners may request:

• A data export
• Correction of certain account information
• Deletion of organization data
• Account cancellation
• Assistance accessing or retrieving information

We will make commercially reasonable efforts to process verified requests within 30 days unless a longer period is required or permitted by law.

We use administrative, technical, and organizational safeguards designed to protect information. These may include:

• Encryption in transit using TLS
• Encryption at rest through managed infrastructure providers
• Additional application-level encryption for sensitive credentials such as OAuth tokens and SMTP passwords
• Role-based access controls
• Row-level security policies for tenant and user data isolation
• Authentication and session management
• Environment variable protection
• Signed or permission-based file access
• Limited internal access based on business need
• Monitoring, logging, and error tracking
• Vendor security review and use of established cloud infrastructure providers

No system can be guaranteed to be 100% secure. However, we work to maintain appropriate safeguards based on the nature of the data we process and the services we provide.

Internal access to customer data is limited to authorized personnel who need access for support, troubleshooting, account administration, security, legal, compliance, or platform operations.

PortaPro Software offers optional features that let users connect their own email account to PortaPro Software so that certain emails (such as sales outreach, lead follow-ups, deal replies, and one-to-one customer communications) can be sent from the user's real email address, using their real inbox, rather than from PortaPro Software's shared transactional email infrastructure. This section describes how PortaPro Software accesses, uses, stores, shares, and protects data received from these connected email providers, and applies to all users who choose to connect an external email account.

11.1 Overview

Connecting a personal or business email account to PortaPro Software is always optional. Users can use PortaPro Software fully without connecting any external email account. Users who choose to connect an account may disconnect it at any time from within PortaPro Software or directly through their email provider.

The specific method of connection depends on the email provider:

• Google (Gmail and Google Workspace): Connected using Google OAuth 2.0. See Section 11.2.
• Microsoft (Outlook.com, Hotmail, Live, and Microsoft 365): Connected using Microsoft OAuth 2.0 and the Microsoft Graph API. See Section 11.3.
• Yahoo, AOL, iCloud, Zoho, GoDaddy, and other providers: Connected using the user's own SMTP server credentials, or a provider-specific app password where required. See Section 11.4.

PortaPro Software requests only the minimum access required to send email on the user's behalf. PortaPro Software does not read the contents of a user's inbox, contacts, calendar, or other data unrelated to sending email that the user has composed or authorized within PortaPro Software.

11.2 Google User Data and Gmail Integration

PortaPro Software's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How Google user data is accessed. When a user connects their Google account to PortaPro Software, they are directed to Google's standard OAuth 2.0 consent screen, where they authorize PortaPro Software to access specific scopes of their Google account. PortaPro Software never receives, stores, or processes a user's Google password.

Google API scopes requested. PortaPro Software requests only the minimum scopes required to provide the feature. Currently, this includes:

• https://www.googleapis.com/auth/gmail.send: permission to send email on behalf of the connected user
• openid, email, and profile: to identify the connected account and display it in PortaPro Software's settings

PortaPro Software does not currently request read access to a user's Gmail inbox contents, message metadata, labels, filters, or drafts. If PortaPro Software introduces features that require additional scopes in the future, users will be prompted to grant those scopes explicitly through Google's consent flow, and this Privacy Policy will be updated accordingly before those scopes are used.

How Google user data is used. PortaPro Software uses the Gmail send scope solely to send email messages that the user composes or authorizes within PortaPro Software, such as sales outreach to leads, follow-up messages to deals, replies to customer conversations, billing and service documents the user sends to their own customers (including invoices, receipts, quotes, and service reports), and one-to-one operational communications initiated by the user. PortaPro Software does not read, scan, or analyze the contents of the user's Gmail mailbox. PortaPro Software does not send email from the user's Google account without an explicit action taken by that user within PortaPro Software, or without an automation the user has explicitly configured within PortaPro Software (such as a sales sequence they have enabled and populated with content).

How Google user data is stored. PortaPro Software stores an encrypted OAuth refresh token and short-lived access token for the connected Google account, in order to maintain the connection between PortaPro Software and Google. These tokens are encrypted at rest and stored in PortaPro Software's Supabase database with access restricted through row-level security. PortaPro Software also stores the connected account's email address, display name, and connection status so that users can identify and manage their connected accounts in settings. PortaPro Software stores standard email activity metadata (such as recipient address, subject line, timestamp, message ID, thread ID, and delivery status) inside the user's own PortaPro Software workspace so that sent emails appear in the customer activity timeline. PortaPro Software does not maintain a separate archive of Google user email contents beyond what is required for this activity logging.

How Google user data is shared. PortaPro Software does not share Google user data with third parties, other than as necessary to provide the feature (for example, transmitting the message payload to Google's servers to complete the send). PortaPro Software does not sell Google user data. PortaPro Software does not use Google user data for advertising purposes. PortaPro Software does not use Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

Limited Use compliance. Specifically, and consistent with the Google API Services User Data Policy Limited Use requirements:

• PortaPro Software uses Google user data only to provide or improve user-facing features that are prominent in the PortaPro Software user interface.
• PortaPro Software does not transfer Google user data to third parties except as necessary to provide or improve user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with appropriate notice to affected users.
• PortaPro Software does not use Google user data for serving advertisements, including retargeting, personalized advertising, or interest-based advertising.
• PortaPro Software does not allow humans to read Google user data unless PortaPro Software has obtained the affected user's affirmative agreement for specific messages, doing so is necessary for security purposes such as investigating abuse, the data is required to comply with applicable law, or PortaPro Software's use is limited to internal operations in which the data (including derivations) has been aggregated and anonymized.

How users can revoke Google access. Users can disconnect their Google account from PortaPro Software at any time by visiting Settings → Email Accounts inside PortaPro Software and clicking Disconnect. Users can also revoke PortaPro Software's access directly through Google at https://myaccount.google.com/permissions. When access is revoked, PortaPro Software immediately marks the connection as inactive and stops attempting to send email through that account. Encrypted tokens are deleted from PortaPro Software's active database within a reasonable period, generally within 30 days, subject to standard backup cycles. PortaPro Software retains audit records of connection and disconnection events for security and support purposes.

11.3 Microsoft User Data and Outlook / Microsoft 365 Integration

PortaPro Software's use of information received from Microsoft APIs is governed by Microsoft's Services Agreement and the Microsoft Privacy Statement. PortaPro Software applies commitments substantially similar to those described for Google in Section 11.2 to Microsoft user data.

How Microsoft user data is accessed. When a user connects their Microsoft account (Outlook.com, Hotmail, Live, or Microsoft 365) to PortaPro Software, they are directed to Microsoft's standard OAuth 2.0 consent screen, where they authorize PortaPro Software to access specific Microsoft Graph API scopes. PortaPro Software never receives, stores, or processes a user's Microsoft password.

Microsoft Graph API scopes requested. PortaPro Software requests only the minimum scopes required to provide the feature. Currently, this includes:

• Mail.Send: permission to send email on behalf of the connected user
• openid, email, profile, and User.Read: to identify the connected account and display it in PortaPro Software's settings
• offline_access: to obtain a refresh token so PortaPro Software can maintain the connection without repeatedly prompting the user to sign in

PortaPro Software does not currently request read access to a user's Outlook or Microsoft 365 inbox contents, message metadata beyond what is required for send confirmation, calendar, contacts, or files. If PortaPro Software introduces features that require additional Microsoft Graph scopes in the future, users will be prompted to grant those scopes explicitly through Microsoft's consent flow, and this Privacy Policy will be updated accordingly before those scopes are used.

How Microsoft user data is used, stored, and shared. PortaPro Software uses Microsoft Graph access solely to send email messages that the user composes or authorizes within PortaPro Software. Storage, sharing, and AI-training commitments are substantially the same as those described in Section 11.2 for Google user data. PortaPro Software does not use Microsoft user data for advertising, does not sell Microsoft user data, and does not use Microsoft user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

How users can revoke Microsoft access. Users can disconnect their Microsoft account from PortaPro Software at any time by visiting Settings → Email Accounts inside PortaPro Software and clicking Disconnect. Users can also revoke PortaPro Software's access directly through Microsoft at https://account.live.com/consent/Manage (personal Microsoft accounts) or through the Microsoft 365 admin center or https://myapps.microsoft.com (work or school accounts). When access is revoked, PortaPro Software immediately marks the connection as inactive and stops attempting to send email through that account. Encrypted tokens are deleted from PortaPro Software's active database within a reasonable period, generally within 30 days, subject to standard backup cycles.

11.4 Other Email Providers (Yahoo, AOL, iCloud, Zoho, GoDaddy, and Custom SMTP Mailboxes)

For email providers that do not offer third-party OAuth suitable for outbound sending, or where a user prefers to connect a custom or business-hosted mailbox, PortaPro Software supports connection through the user's own SMTP server credentials or a provider-specific app password (for example, a Yahoo, AOL, or iCloud app password generated by the user, or a Zoho, GoDaddy, or hosted business mailbox SMTP username and password).

What PortaPro Software collects for SMTP-based connections. The user provides:

• The connected email address
• The SMTP server hostname and port
• The SMTP username
• The SMTP password or app-specific password
• The preferred security setting (STARTTLS or implicit TLS)

PortaPro Software may also record the display name and connection status.

How SMTP credentials are used, stored, and shared. PortaPro Software uses the provided SMTP credentials solely to relay email messages that the user composes or authorizes within PortaPro Software through the user's own mail server. PortaPro Software stores SMTP passwords and app-specific passwords encrypted at rest inside PortaPro Software's Supabase database, with access restricted through row-level security and additional application-level encryption. PortaPro Software does not share SMTP credentials with third parties. PortaPro Software does not read the user's inbox for SMTP-based connections; SMTP is used exclusively for outbound sending. PortaPro Software does not use SMTP credentials or the contents of sent emails to develop, improve, or train artificial intelligence or machine learning models.

Provider-specific requirements. Some providers (including Yahoo, AOL, iCloud, and certain Google Workspace and Microsoft 365 configurations) require the user to generate an app-specific password rather than using their main account password when connecting through SMTP. PortaPro Software will guide users through this process in the settings interface. Users remain responsible for managing their own provider accounts, including two-factor authentication settings, app password generation, and app password revocation.

How users can revoke SMTP-based access. Users can disconnect an SMTP-based connection from PortaPro Software at any time by visiting Settings → Email Accounts inside PortaPro Software and clicking Disconnect. Users can also revoke access by rotating their app-specific password or SMTP password directly with their email provider, which will cause future PortaPro Software send attempts to fail until the connection is updated or removed. When a user disconnects an SMTP-based connection, PortaPro Software deletes the associated encrypted credentials from its active database within a reasonable period, generally within 30 days, subject to standard backup cycles.

11.5 Content of Sent Emails

For all connected email accounts described in Sections 11.2 through 11.4, PortaPro Software processes the content of each outbound message (recipient addresses, subject line, message body, attachments, and headers) only for the purpose of composing and delivering that message through the connected provider. PortaPro Software may store standard activity metadata for each sent message (such as recipient address, subject line, timestamp, message identifiers, and delivery status) inside the tenant workspace so that the message appears in the customer or lead activity timeline. Full message bodies may be retained inside the tenant workspace where required to display the sent message within PortaPro Software's activity or thread views, subject to the same customer-owned operational data protections described elsewhere in this Privacy Policy.

11.6 No Advertising and No AI Training Use of Connected Email Data

PortaPro Software does not use data obtained from any connected email provider, including Google, Microsoft, Yahoo, AOL, iCloud, Zoho, GoDaddy, or any custom SMTP mailbox, for advertising, retargeting, personalized advertising, interest-based advertising, or the training of generalized or non-personalized artificial intelligence or machine learning models.

11.7 Contact Regarding Connected Email Integrations

Questions about how PortaPro Software handles data from connected email providers, including specific questions about Google or Microsoft user data, can be sent to:

PortaPro Software is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children under 16.

We may update this Privacy Policy as PortaPro Software evolves. When we make changes, we will update the Effective Date at the top of this page.

For material changes, we may provide additional notice, such as notifying organization owners or displaying a notice within the platform.

Material changes to Section 11 (Connected Email Accounts and Third-Party Email Provider Integrations), including any change to the OAuth scopes PortaPro Software requests from Google, Microsoft, or any other email provider, will be reflected here before those changes take effect for connected users.