Privacy Policy

1. Who we are

Poolbench ("we", "our", "us") operates the Poolbench application and website. We build software for pool-service companies. This policy explains what personal data we collect, why we collect it, and the choices you have about it. It applies to everyone who uses Poolbench — company owners, technicians, and homeowners whose data is stored in the system by a pool-service company.

2. Scope

Poolbench is a business-to-business tool. A pool-service company uses it to manage its own customers: it enters a homeowner's pool address, email, phone, service notes, and water-chemistry readings. That company is the data controller for its homeowners' data and is responsible for having a lawful basis to store it. Poolbench acts as the data processor for that data — we store and transmit it so the company can run its service, but we do not control how the company collects it or use it for our own purposes, except as described in this policy. This policy covers how Poolbench itself handles data.

3. Information we collect

We collect the following categories of personal data depending on how you interact with the service:

• Account data: name, email address, phone number, and role (company owner, technician, or admin). Passwords are handled by Supabase Auth and are never stored by us in plain text.
• Company and billing data: company name, business email, business phone, business address, company logo, and billing identifiers such as Stripe and PayPal customer/subscription IDs. We do not store full payment card details.
• Customer and pool data entered by tenant companies: pool address, homeowner email and phone, service notes, and water-chemistry readings used to calculate water-health scores and reports. This data is shared with us by the pool-service company that controls it.
• Device data: push-notification tokens (Firebase Cloud Messaging for Android, Apple Push Notification service for iOS) so we can send service alerts.
• User-submitted content: feedback and support messages you send us.
• Uploaded images: company logos, stored for display in the application.
• We do not collect precise GPS or location data from any device.

4. How we use information

We use the information we collect to:

• Operate the service: authenticate users, manage accounts and companies, and keep tenant data isolated between companies.
• Generate water-health scores and shareable service reports from the readings a company records.
• Bill for subscriptions through our payment providers (Stripe and PayPal).
• Send transactional email — such as password resets, account notifications, and service communications — through Resend.
• Send push notifications for service events where a user has chosen to receive them.
• Triage support requests and review feedback to improve the product.

5. How we share information

We share personal data only with the service providers needed to run Poolbench. Each processes data on our behalf and is contractually obliged to protect it:

• Supabase — authentication and database hosting.
• Stripe — payment processing (billing only; we store only Stripe customer/subscription IDs).
• PayPal — payment processing (billing only; we store only PayPal subscription identifiers).
• Resend — transactional email delivery.
• Cloudflare R2 — storage of company logo images.
• Firebase Cloud Messaging (Google) — Android push notifications.
• Apple Push Notification service — iOS push notifications.
• Google — OAuth sign-in (only if you choose to sign in with Google; Google receives your email, name, and avatar).
• We do not sell personal information. We do not use analytics or advertising trackers, and we do not share data with advertisers. If that changes, we will update this policy first.

6. Cookies

We use essential cookies for authentication only. Supabase session cookies are set when you sign in and are required for the service to function. The cookie-consent banner on this website stores your choice in your browser's local storage — not in a cookie. We do not use tracking, analytics, or marketing cookies.

7. Data retention

We keep personal data while an account or company is active. When an account is closed or deletion is requested, we delete or anonymize the associated data within a reasonable period, subject to legal obligations we may have. Because the pool-service company controls the customer data it enters, it can request deletion of that data at any time. We do not keep personal data longer than we need it to provide the service.

8. Your rights

You have rights regarding the personal data we hold about you, including the right to:

• Access a copy of the data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data.
• Restrict or object to certain processing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent where processing is based on consent.
• For users in the European Economic Area (EEA): our legal bases are contract performance (to provide the service you signed up for) and legitimate interest (to keep the service secure and functioning). Data is processed primarily in the United States; where personal data is transferred out of the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses.
• To exercise any of these rights, use the contact options on poolbench.com, and we will respond as required by applicable law.

9. Children's privacy

Poolbench is not directed at children and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us personal data, contact us using the contact options on poolbench.com and we will delete it.

10. Security

We apply reasonable technical and organizational measures to protect personal data: authentication and session management via Supabase, tenant data isolation by company ID, encryption in transit (TLS), and role-based access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. International transfers

Your data is processed primarily in the United States, where Poolbench and most of its service providers are based. For users in the EEA, we rely on appropriate safeguards, including Standard Contractual Clauses, for transfers of personal data to our sub-processors. By using the service, your data may be transferred to and processed in the United States.

12. Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date below. If changes are material, we will give you notice through the application or at the contact options on poolbench.com. Continued use of the service after changes take effect constitutes acceptance of the updated policy.