Privacy Policy

HVAC Permit Tracker (the “Service”) is operated by First Penguin Apps(“we”, “us”). We are the data controller for the personal data described in this policy under the EU General Data Protection Regulation (GDPR). You can reach us at indybouzu0107@gmail.com.

When you connect your Jobber account, we receive and store:

• your Jobber account name and account identifier, and API tokens that let the Service act on your behalf;
• job records from your Jobber account (job title, job number, status, job type, creation date, and a link to the job in Jobber). Job titles may contain personal data, such as customer names, if you use them that way in Jobber.

When you use the Service, we store the data you enter:

• permit and inspection details (jurisdiction, permit number, application/approval dates, inspection results, and correction notes).

When you subscribe to a paid plan:

• payment is handled by Stripe. Your card details are entered directly on Stripe's payment pages and never pass through or get stored on our servers. We store only your Stripe customer reference, subscription reference, plan, and subscription status.

The Service uses only strictly necessary cookies: a session cookie that keeps you signed in. We do not use analytics, advertising, or tracking cookies.

• To provide the Service — importing your jobs, tracking permit stages, syncing stages back to Jobber, and managing your subscription (performance of a contract, Art. 6(1)(b) GDPR);
• To operate and secure the Service — error logging and abuse prevention (legitimate interests, Art. 6(1)(f) GDPR);
• To meet legal obligations — bookkeeping and tax records relating to payments (Art. 6(1)(c) GDPR).

• While your Jobber account is connected, we keep the data needed to provide the Service.
• If you disconnect the Service from your Jobber account, your data is retained for 30 days (so that reconnecting restores your tracking history) and then deleted.
• Records we must keep for accounting or tax purposes are retained for the statutory periods required by applicable law.

We use the following service providers to run the Service. They process data on our behalf under data-processing agreements:

• Supabase — database hosting (our database is hosted on Supabase infrastructure, which may be located in the United States);
• Vercel — application hosting and delivery;
• Stripe — payment processing and subscription management;
• Jobber — the platform your data originates from and, where applicable, is synced back to.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

Some of our processors store or process data outside the EU/EEA, in particular in the United States (for example, Supabase database hosting and Vercel infrastructure). Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards under Chapter V GDPR, such as the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework adequacy decision.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have your data erased (“right to be forgotten”);
• restrict or object to certain processing;
• receive your data in a portable format.

To exercise these rights, contact us at indybouzu0107@gmail.com. You also have the right to lodge a complaint with a supervisory authority — in Sweden, the Swedish Authority for Privacy Protection (IMY, imy.se) — or with the authority in your country of residence.

We may update this policy from time to time. Material changes will be announced in the app before they take effect. The date at the top of this page shows when it was last revised.

First Penguin Apps · indybouzu0107@gmail.com