1. Who we are
JobOS ("we", "our", "us") is a job-management, quoting and invoicing app for trade businesses, operated from Cape Town, South Africa. This policy explains what personal information we collect, how we use it, who we share it with, and your rights. We are the responsible party under the Protection of Personal Information Act (POPIA). Contact us at team@jobos.pro.
2. Information we collect
- Account information: your name, email address and business details. If you sign in with Google we receive your name, email address and profile picture from Google.
- Business data you enter: clients (names, phone numbers, email and physical addresses), jobs, quotes, invoices, payments you record, inventory, notes and job photos.
- Voice: when you use the voice assistant, your audio is streamed live through our voice server to Google’s Gemini AI to understand your request. We do not record or store the audio. We do store the text transcript of the conversation and the actions taken, so the assistant can work, so you can review what happened, and so we can check and improve its accuracy (including automated quality scoring).
- Staff (appie) data: if you add staff, their name and contact details; when a staff member checks in at a job, the time and location of that check-in.
- Payment information: subscriptions are paid through Paystack. We do not see or store your card number; we keep the plan, status and payment references.
- Usage and device data: pages and features used, device type, browser and app version, and error reports. Website analytics are only collected with your consent.
3. How we use your information
- To provide the service: store your records, create quotes, invoices and job cards, and carry out the voice and AI features you ask for.
- To sync jobs with Google Calendar, if you connect it (see section 4).
- To send service emails such as account, billing and onboarding messages. You can opt out of non-essential emails at any time.
- To keep the service secure, prevent abuse, fix errors and improve accuracy.
- To meet legal, tax and accounting obligations.
We do not sell your personal information, and we do not use it for third-party advertising.
4. Google user data (Google Sign-In and Google Calendar)
This section explains what data JobOS gets from Google, how we use it, who we share it with, how we protect it, and how long we keep it. Google Calendar is optional: it is a Premium feature, and JobOS only asks for it when you choose to connect your calendar.
Data accessed
- Google Sign-In (openid, email, profile): your name, email address and profile picture.
- Google Calendar, permission
https://www.googleapis.com/auth/calendar.events.owned ("See, create, change, and delete events on Google calendars you own"). JobOS only works with your primary calendar. It reads the title, start and end time, description and all-day setting of the events on the dates you are viewing, and it creates, changes and deletes the events for jobs you schedule in JobOS. - OAuth tokens: a refresh token and short-lived access tokens that let JobOS reach your calendar.
Data usage
- Sign-In data is used only to create your JobOS account and recognise you when you sign in.
- Calendar events are read only to show them to you next to your jobs on the JobOS Calendar page.
- For each job you schedule, JobOS keeps one event in your primary calendar: it is created when you schedule the job, updated when you change the job, and removed when you unschedule or delete the job. The event holds the job title, the client name, the job status and the job notes, at the job's date and time.
- We do not use Google user data for advertising, we do not sell it, we do not send it to any AI model, and we do not use it to develop, improve or train AI or machine-learning models.
Data sharing
- We do not sell, share, transfer or disclose Google user data to anyone, except as listed here.
- Service providers that run JobOS for us and may use the data only for that: Supabase (our database: it stores your sign-in profile, the encrypted refresh token and the event ID linked to each job) and Netlify (runs the server function that exchanges the refresh token for an access token).
- Where the law requires it, to investigate abuse or a security issue, or as part of a merger, acquisition or sale of our business, and then only with your prior consent.
- The calendar events you view go straight from Google to your browser. They do not pass through our servers and are not stored there.
Data storage and protection
- All data travels encrypted (HTTPS/TLS).
- The refresh token is stored encrypted at rest in Supabase Vault. Only our server function can read it; it is never sent back to your browser. It is used only to get short-lived access tokens for your own calendar, and only for requests signed with your JobOS sign-in.
- A refresh token is only accepted if it belongs to the Google account linked to your JobOS account.
- Access tokens expire after about an hour and are kept only in your browser, tied to your JobOS account.
- Database access is restricted per account with row-level security, and the table that holds the tokens cannot be read from the app at all.
- People at JobOS do not read your calendar data, except with your permission, to investigate a security issue or abuse, or where the law requires it.
Data retention and deletion
- Calendar events JobOS reads are not stored. They are only shown on screen.
- The only calendar data we keep is the event ID linked to each job, so the event can be updated or removed later. It is deleted when the job or your account is deleted.
- The refresh token is kept until you disconnect Google Calendar. Disconnecting deletes it immediately and revokes it at Google. It is also deleted when Google reports it revoked or expired, and when your account is deleted.
- Sign-In data is kept while your account is active and deleted within 30 days of your account being deleted (see section 8).
- You can revoke JobOS's access at any time at myaccount.google.com/permissions, and ask us to delete your data at team@jobos.pro.
JobOS’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect Google Calendar at any time in JobOS settings or at myaccount.google.com/permissions. Calendar events already created stay in your calendar unless you delete them.
5. Who we share information with
We use trusted service providers to run JobOS. They process data on our behalf and only for these purposes:
- Supabase: database, file storage and sign-in.
- Google Cloud (Vertex AI / Gemini): voice and AI features, including the text and audio of your requests.
- Fly.io and Netlify: hosting for our voice server and web app.
- Paystack: subscription payments.
- Brevo: sending service emails.
- Sentry: error reports, so we can fix problems.
Documents you choose to send (for example a quote shared on WhatsApp or by email) go to the people you send them to. We may also disclose information where required by law or to protect our users and service.
6. International transfers
Some of these providers process data outside South Africa. Where they do, we rely on providers that apply appropriate safeguards to protect your information, as POPIA requires.
7. Security
Data is encrypted in transit and stored with our database provider. Access is restricted per account using row-level security, so your business records are only available to you and the staff you give access to. No system is perfectly secure, and we will notify you and the Information Regulator of a breach as required by law.
8. Retention
We keep your information while your account is active. If you delete your account or ask us to, we delete your personal information within 30 days, except records we must keep by law (for example payment records for tax purposes). Voice audio is never stored; transcripts are deleted with your account.
9. Your rights
Under POPIA you may ask to access, correct or delete your personal information, object to its processing, or withdraw consent. Email team@jobos.pro and we will respond within 30 days. You may also complain to the Information Regulator (South Africa) at inforegulator.org.za.
10. Children
JobOS is a business tool and is not intended for anyone under 18.
11. Changes to this policy
We may update this policy. We will show the new date at the top and tell you about significant changes in the app or by email.