Privacy Notice

This notice explains how NC Consulting, Castries, Saint Lucia ("we", "us"), handles personal information in RepairDesk360 at repairdesk360.com (the "Service"). Questions and requests go to [email protected].

1. Our role

• We are the controller of the information about people who sign up for and use the Service, and about how they pay for it.
• Our customers are the controllers of the records they keep in the Service, including the reports their tenants send through a request link. We process that information only for them and on their instructions. If you're a tenant who reported a problem, the property manager or landlord who gave you the link decides how your report is used; please contact them first. We'll help them answer you.

2. What we collect

• Account details: name, email address, password (stored only as a secure hash), optional two-factor and passkey settings, your role in your organization, and when you agreed to our terms.
• Organization details: name, address, phone, contact email, logo, tax number, settings, plan and billing status.
• Records you add: properties, requests, work orders, inspections, assets, parts, purchasing, notes, photos, documents and audit history. These may include names, contact details and descriptions of people, such as tenants, staff and vendors.
• Tenant reports: what a tenant types on a request form (name, email, phone, unit, description and photos), and the star rating and comment they may give once it's fixed. Their IP address is used briefly to limit abuse and for Cloudflare's bot check, and isn't saved with the report.
• Billing: Paddle collects payment details directly. We receive the name and email billed, the plan, amounts, invoice numbers and payment status. We never see full card numbers.
• Technical information: IP address, browser and device type, pages requested and error logs, used to run and protect the Service.

3. Why we use it, and our legal basis

• To provide the Service you signed up for, including sending the emails it sends: performing our contract with you.
• To bill you through Paddle and keep financial records: our contract, and our legal obligations.
• To keep the Service secure and stop spam and abuse, including limits on public request forms: our legitimate interest in protecting the Service and its users.
• To answer support requests and tell you about important changes: our contract and legitimate interests.
• To meet legal obligations and handle legal claims.

We don't sell personal information, use it for advertising, or use it to train AI models.

4. Who receives it

We share personal information only with the service providers who help us run the Service, under contracts that protect it:

• Paddle (Paddle.com Market Ltd), our reseller and Merchant of Record, which handles checkout, payments, tax, invoices and refunds as a controller under its own privacy notice.
• Postmark (ActiveCampaign), which delivers the Service's emails.
• Cloudflare, whose Turnstile check protects public request forms from bots.
• OpenAI, only for organizations that switch on an AI feature, and only the information that feature needs: a request's subject and description; an asset's details, notes, history and manuals with the question asked; or a voice memo and the job it's for. OpenAI doesn't use this information to train its models. Reporters' contact details aren't sent.
• Our hosting and infrastructure providers, which store the Service's data and backups.

We may also share information with professional advisers, a buyer of the business (under these same protections), or authorities when the law requires it.

5. International transfers

We are based in Saint Lucia, and our providers may process information in other countries, including the United States, the United Kingdom and the European Union. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's standard contractual clauses.

6. How long we keep it

• Your account: until you delete it yourself in Settings → Profile. Deleting it takes effect at once: your name and email address are removed, your password and sign-in methods are erased, you're signed out everywhere, and you leave every organization. Work you did stays in each organization's records, shown as "Deleted user"; a few history entries keep the name they were written with. An organization's only owner first makes someone else an owner.
• Organizations and their records: while the organization exists, until the customer deletes them. Customers can also clear the files on finished requests. An owner closes an organization in Settings → Organization: an owner confirms it at least 7 days after it's requested, and its records and files are then deleted at once, except billing records. On a paid plan, owners can download a full copy of the data there first.
• Voice memos for the AI closeout feature: deleted as soon as they've been typed out.
• AI repair assistant conversations: deleted 7 days after the last message, or sooner when their summary is saved as a note or the job is cancelled.
• Billing records: as long as tax and accounting law requires, usually up to 7 years.
• Backups: overwritten within 90 days.

7. Your rights

Depending on where you live, you may have the right to access your information, correct it, delete it, restrict or object to how it's used, receive a copy in a portable format, and withdraw any consent you gave. You can change your name, and delete your account, at any time in Settings → Profile. To use any of the other rights, email [email protected]. We'll answer within one month, and may need to confirm who you are first. For records a customer keeps about you, we'll pass your request to that customer.

You can also complain to the data protection regulator where you live or work. We'd appreciate the chance to sort out your concern first.

8. Security

We protect information with encryption in transit, hashed passwords, optional two-factor sign-in, strict separation between organizations, access limited to people who need it, and backups. No system is perfectly secure; if a breach affects your information, we'll tell you and the relevant authorities as the law requires.

9. Cookies

The Service uses only the cookies it needs to work:

• a session cookie that keeps you signed in, and a security cookie that protects forms;
• a "remember me" cookie, if you choose it when signing in;
• your light or dark theme choice, saved in your browser;
• Cloudflare Turnstile on public request forms, to tell people from bots.

We don't use advertising or analytics cookies. The pages people see after reporting an issue may show a promotion, labelled Sponsored, for a company related to us. It is a plain link that we host: it and its image set no cookies, and we count that a promotion was clicked, not who clicked it.

10. Children

The Service isn't meant for children under 16, and we don't knowingly collect their information.

11. Changes

We'll update this notice when our practices change, and change the date at the top. For significant changes we'll tell account holders by email or in the Service.

12. Contact

NC Consulting, Castries, Saint Lucia.
Email: [email protected]