Splash Office Privacy Notice

Who handles information and why

Splash Office LLC operates Splash Office. We determine the purposes of processing needed for our own business relationship with account holders, our public website and product inquiries, and genuinely independent protection of our service. Some account and security processing also occurs on a company’s instructions. The actual purpose determines our role.

When your service company uses Splash Office for customer records, staff work, time records, routes, location, communications or agreements, that company determines the operational purposes and we process information on its behalf. Its notice explains those purposes, authorized recipients and applicable retention choices. This notice explains our handling and does not replace the company’s customer or employer notice. Information about one person may be handled in both capacities.

Information processed

In the retention provisions below, Company means the service company whose records are involved. Depending on the features used, information includes account and contact details; service addresses, property and equipment details; schedules, work notes, photos and attachments; staff time records, work location and visit evidence; messages and assistant conversations; agreements and signing evidence; invoices, payment references and status; and relevant access, device and audit information.

Information comes from you, your service company, authorized users, enabled device features and connected services. Optional integrations can make additional records available according to the permissions granted. A feature’s availability does not mean every company has enabled it.

Uses and AI assistance

We use Company directed information to provide the functions it selects, including scheduling, routing, service records, quotes, agreements, billing, authorized communications, support and configured assistant features. We use information for our own relationship and website purposes as described above. Company content is not made available for unrelated purposes merely because it is stored in the Service.

AI features can process conversations, authorized incoming email and relevant records made available through selected tools. Outputs can be incorrect and require appropriate human oversight. Actual provider payloads and feature settings determine what is sent. The Company agreement and DPA limit permitted uses of Company information. The applicable provider disclosures explain the arrangements for enabled features.

Employer directed work location

When enabled by the company and permitted by your device, Native Crew shift location can operate during an active shift, including while driving or while the phone is locked. The feature is designed to stop shift collection at clock out. You can deny phone location permission and use manual work recording.

Detailed location trails are retained for thirty shop days, then reduced to five minute samples until 365 days. Arrival and departure pins saved with a visit are separate work records and can remain under the employer’s necessary work record retention criteria. Expiration of a trail does not erase visit evidence.

Your employer must explain its actual monitoring purposes, authorized viewers, retention criteria and request contact before collection where required. Device permission and a generic product explanation do not replace an employer notice or any separate permission required by applicable law. Browser or vehicle tracking, if used, needs its own accurate explanation from the company.

Communications and electronic agreements

Connected company mailboxes and messaging services process addresses, message content, attachments and delivery information needed for the company’s authorized communications. Signing features process the presented agreement, the adopted signature and related execution evidence. Email queueing, a provider acceptance response and confirmed recipient delivery are different states.

The company is responsible for its communication permissions and customer notices. Requests to stop marketing, withdraw future electronic record consent or revoke a payment authorization affect different permissions. Withdrawal of electronic record consent does not itself undo an existing signature or cancel the underlying service agreement. Contact the company using the details in its agreement or messages for those requests.

Disconnecting a mailbox ends the connection’s future access according to the feature’s operation. It does not necessarily erase information already saved in service records, attachments, correspondence or recovery copies. Those copies follow their applicable instructions and retention obligations.

Providers, payments and authorized disclosure

We use providers for hosting, configured AI functions, communications, maps and enabled voice features. Depending on configuration, the source inventory includes Render, Anthropic, Telnyx, ElevenLabs and Google services. Company connections can also include other mailbox providers, Stripe, Square and QuickBooks. Names here describe potential service relationships, not a statement that every provider receives every company’s information.

Providers receive information needed for their enabled function. Some operate on our behalf; others are independently selected by the company and have their own responsibilities and notices. Payment processors handle payment services under their applicable terms, while Splash processes relevant references and status. The payment service selected and the information entered determine the payment information involved.

Necessary disclosure to a communications or hosting provider is different from disclosure for that provider’s unrelated marketing. Company Personal Data is governed by the DPA restrictions on selling, sharing for cross context behavioral advertising and unrelated use. We may disclose information when law requires it or as lawfully necessary to protect rights and investigate misuse, limited to the applicable purpose. Changes in business ownership remain subject to applicable privacy and contractual restrictions.

Cookies and browser storage

The Service uses authentication and security cookies or comparable storage needed to operate protected sessions. The website also uses a first party campaign source code retained for thirty days to understand how an inquiry reached Splash. This campaign attribution is distinct from a claim that every site visitor is subject to advertising tracking.

Browser controls can limit storage but may interfere with sign in or other functions.

Routine record retention

Detailed staff location trails and visit records follow the distinct periods explained above. Outbox bodies, HTML and attachment bytes generally clear after 365 days; metadata remains for 1,825 days. Pending and failed outbox items retain their bodies until the five year deletion to support retry. Other saved copies are not necessarily removed by outbox cleanup.

Sessions expire from the registry after fifteen inactive days. Replay receipts and content security policy reports generally remain for ninety days. Completed or discarded drafts remain for thirty days. Many customer, financial, audit, legal and work records have no automatic expiry in current category jobs. This does not authorize keeping them indefinitely; they remain subject to necessary purposes, lawful instructions, preservation duties and account closure requirements.

A routine retention period does not override an earlier valid deletion instruction or an applicable legal requirement. Information retained for a dispute or other legal duty must be limited to what that purpose justifies. Separately held Splash agreement or billing evidence does not justify retaining an entire company’s operational history.

Account closure, exports and recovery copies

After termination, Company has thirty days to obtain its data through the available database export and any recovery copies already configured, or through secure delivery arranged with Splash. After that export period, Splash will delete Company Personal Data from active systems, subject to documented legal retention requirements, including applicable requirements for executed agreements and payment records. A signed document is not exempt from deletion merely because it is signed. Splash will restrict retained records to their justified purpose and remove them when that basis ends, unless another lawful requirement applies. Data will not be retained indefinitely merely because Company might return.

The ordinary offsite recovery policy retains the seven newest verified daily bundles and four older weekly selections. This is a count based policy, not a guaranteed time to expiry. Failed or interrupted backup runs can leave older copies in place. Account closure requires explicit manual removal of nonexempt Splash controlled recovery copies rather than reliance on future backup runs. Recovery copies retained for a documented legal requirement must remain restricted to that purpose. Before restored data returns to ordinary use, applicable completed deletions and closure restrictions must be reapplied.

The current database export does not by itself establish that every attachment, photograph, executed PDF or signing evidence file has been included. Splash and Company must identify and arrange the necessary additional files during the export period. Company is responsible for its downloaded exports and copies held in its own connected accounts. Splash does not promise to erase copies outside its control. These provisions do not shorten an existing contractual export or deletion obligation.

Account closure cleanup requires manual action. The available database export may need to be supplemented with files and signing evidence. Automatic company Drive setup and scheduled uploads are currently unavailable; historical copies or downloaded exports may still exist in company controlled accounts.

Security and processing locations

The disclosed safeguards include encrypted network transport, encrypted storage of connected account credentials and access limited by company roles. These measures reduce risk but do not guarantee absolute security. This notice does not claim that every database is encrypted at rest, that a particular certification exists or that all processing occurs only in the United States.

The company agreement and DPA govern security responsibilities and incident assistance for Company Personal Data. The provider information supplied with the company agreement identifies applicable processing arrangements.

Requests, employer contacts and changes

For records controlled by your service company or employer, contact that company through its privacy or employment contact. Splash can help route the request and provide assistance under its agreement. For Splash’s own processing, use the Splash privacy contact supplied with this notice and the Company Agreement. We may need proportionate information to verify identity and authority.

Depending on residence, role, information and applicable law, rights can include access, correction, deletion, portability, restrictions or objections to particular uses, and an appeal of a denied request. We will explain the applicable response or appeal route when responding. Not every right applies to every employment or business context. We will not retaliate for exercising a protected right.

Material changes will be identified and notified under the governing agreement, including at least thirty days’ actual notice where required by it. Prior versions and applicable effective dates will remain identifiable. Publication of a new notice does not silently remove an existing binding commitment.