Privacy Policy

1. Information we collect

• Account information: first and last name, mobile phone number, email address, date of birth (used for the birthday bonus), and the language you prefer.
• Service information: the service address, what needs repair, photographs of the appliance taken by you or by the technician, the estimate, your signature on the estimate and on the service agreement, and payment records.
• Chat messages: the messages you exchange with a company in the in-app chat, and their automatic translations into your language and the company’s language.
• Loyalty information: points earned and redeemed, your membership level, your referral code and who invited you.
• Consent records: the date, the method, the language and the exact text of the consent you gave to receive text messages.
• Technical information: device identifiers used to deliver push notifications; the IP address and device type of each sign-in session, of a password reset request and of the record of your consent to text messages. The QMaster app does not collect the location of your device.
• Location of staff on shift: if you work for a service company and use QMaster Pro, the app sends the precise location of your device, with speed and direction, about every two minutes while your shift is open and the app is open on the screen. When the app is in the background or closed, location is not collected or used. The company uses it to see where its technicians are and to plan visits. This applies to company staff, not to customers.
• Location at order steps: when a technician marks a step of an order in QMaster Pro (for example, arrival on site or completion of the work), the app records the location of the device at that moment — only if the technician’s shift is open and the device provides it — and stores it with that step of the order. It is recorded once per step, not continuously. It shows the company where the step was performed.
• AI consent: whether you agreed to the processing of your data by AI, when, under which version of the consent text, and when you withdrew it — see section 7.
• Sign-in security: the email address a one-time sign-in code is sent to, the code itself (stored only as a one-way hash) and the list of your trusted devices with their names and the dates they were added and last used — see section 8.
• Calls to a company’s voice assistant: your phone number, the time and length of the call, the recording of the call, its transcript and the service request taken during it — see section 9.
• We do not collect or store payment card numbers. Card payments are processed by Stripe, and the card data goes directly to Stripe.
• We do not collect fingerprints, face scans, or any other biometric identifiers.

2. The service address

The address attached to an order is the service address — the place where the work is to be performed. It is not, by itself, a record of where you live. It is often the same as the address in your profile because that is the convenient default, but you may give a different address for any order: a relative’s home, an office, or a property you rent out.

The profile address is optional. You can leave it empty and give the address only when you place an order.

3. Why we use it

• To create and protect your account, and to confirm that a phone number belongs to you.
• To schedule visits, perform the work, prepare estimates, take payments and keep the record of what was done.
• To run the loyalty program: earn and redeem points, apply your membership level, and credit referrals.
• To notify you about your orders and your points, through the channels you agreed to.
• To meet legal, tax and accounting obligations, and to defend a claim if one is made.

4. Text messages

We do not sell, rent, or share your mobile phone number or SMS opt-in consent with third parties or affiliates for their own marketing or promotional purposes. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. We share your number only with vendors who send text messages on our behalf and only to deliver the QMaster messages you requested or consented to.

You can stop text messages at any time by replying STOP. We keep a record of your consent and of your withdrawal — see section 10. See our SMS Terms for the full program description.

5. Signatures: electronic, not biometric

When you sign an estimate or a service agreement with your finger on a screen, you are giving an electronic signature within the meaning of the federal ESIGN Act (15 U.S.C. § 7001) and New York State law. By signing this way you agree that an electronic signature has the same legal effect as a handwritten one.

What we store is an image of the mark you drew, together with the date, the document it belongs to, the version of the text you signed and, if the device provides it, the GPS location where the document was signed. That location is kept together with the signed document, for the same period (see section 10). We do not analyse the drawing, we do not extract any measurement from it, and we do not use it to identify you. It is a record of your agreement, not a biometric identifier: it is never used for authentication, and it is not run through any recognition system.

6. Who can see your information

QMaster is a platform of independent service companies. Your account is one; the companies are separate.

• A service company sees your information only after you join it yourself, place an order with it, or give your details to it directly. Before that, the company does not know that you exist.
• A company sees only its own relationship with you: your orders with that company and your points with that company. Your history with any other company is never shown to it.
• Service providers acting on our behalf: Stripe (payments), Twilio (text messages, phone calls, call recording and speech recognition), Resend (email), Google (maps and geocoding), Firebase (push notifications), Anthropic PBC (AI translation of chat messages, replies of the chat and voice assistants, reply drafts for staff, reading appliance labels from photos — see sections 7 and 9), and our hosting provider. They may process your data only to provide these functions to us, and not for their own purposes.
• OpenStreetMap: some maps in the app are loaded from OpenStreetMap servers (tile.openstreetmap.org). Your device connects to them directly, so OpenStreetMap receives your IP address and the area of the map being shown.
• Law enforcement or government agencies, when we are legally required to disclose information.
• We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

7. Processing by artificial intelligence (Anthropic)

Some QMaster features use an AI model (Claude) provided by Anthropic PBC, a U.S. company. Anthropic processes the data on our behalf as a service provider, only to return the result to us; it does not use the data to train its models and may not use it for its own purposes.

• What is sent, if you are a customer: the text of your chat messages with a company, so that the company’s assistant can answer and the messages can be translated; photos of an appliance nameplate when you choose to scan one; the details of your service request that the assistant needs to answer.
• What is sent, if you work for a company: the chat with a customer when you ask for a translation or a reply draft; the nameplate photo you scan; the appliance model, the symptom and the part name when you search for a part.
• Phone calls: what a caller says to a company’s voice assistant, as text, so that the assistant can answer — see section 9.
• What is never sent: payment card details, passwords and sign-in codes.
• Why: so that you get an answer right away, including at night; so that you and the company can write each in your own language; so that the model and serial number are read from a photo instead of typed by hand.
• Consent: before the first use of these features the app shows what is sent and to whom and asks for your consent. We record the date and the version of the text you agreed to. If you do not agree, the app works as before: company staff answer your messages, messages are not translated, and nameplate details are typed by hand.
• Withdrawal: you can withdraw consent at any time in the app settings or by writing to us. From that moment nothing more of yours is sent to Anthropic. Withdrawal does not affect the rest of your account.

8. Sign-in code and trusted devices

• When you sign in to the QMaster app with your username and date of birth on a new device, we send a one-time 6-digit code to the email address on your account. The code is valid for 10 minutes and allows 5 attempts; we store it only as a one-way hash.
• After you enter the code, the device can become trusted. We store a random device token, the device name (for example, “iPhone 15”) and the dates the device was added and last used. Signing in from a trusted device does not require a code for 180 days after the last sign-in; after that the code is asked again.
• You can see your trusted devices in the app and remove any of them; the next sign-in from a removed device will ask for a code.
• If your account has no email address, a dispatcher, manager or owner of your service company can add or change it in your customer card at your request, after checking that you are the customer — by your orders, not by your date of birth alone. We use this address for sign-in codes and messages about your account.

9. Voice AI assistant on phone calls

• A service company on QMaster may connect an AI voice assistant to its phone number. The assistant answers when nobody at the company picks up within the time the company has set, or outside business hours; a company may also have the assistant answer every call first.
• At the start of the call the assistant says that it is an AI assistant and that the call is recorded. It takes your request — the appliance, the problem, the address and a convenient time — and passes it to the company. It does not quote prices. You can ask for a person at any time: the assistant ends the call and a dispatcher calls you back.
• The call is recorded and transcribed. Speech recognition, voice synthesis and the recording are provided by Twilio; the transcribed text is sent to Anthropic so that the assistant can answer (see section 7). We store your phone number, the time and length of the call, the recording, the transcript and the service request, and the company you called sees them.
• By staying on the line after the notice you agree to the recording and to this processing. If you do not agree, hang up or ask for a person. You can ask us to delete a recording at any time — see section 11.
• A text message confirming the request is sent only if you say “yes” when the assistant asks; see section 4 and the SMS Terms.

10. How long we keep it

We keep each kind of record only as long as there is a reason to:

• Account information: while your account exists, and up to 30 days after you ask us to delete it.
• Loyalty points and the history of how they were earned and spent: while your account exists, and 3 years after it is closed — points are a liability we may have to account for.
• Payment records and receipts: 7 years from the payment, as tax and accounting practice requires.
• Order records — what was done, when and at what address, including the location recorded when a step of the order is marked in QMaster Pro: 7 years from the completion of the order, like payment and accounting records.
• Signed estimates and service agreements, including the signature image and the location where the document was signed: 7 years from the date of signature, the period within which a claim about the work can still be brought.
• Photographs attached to an order: 3 years from the completion of the order; they are evidence of the condition of the appliance before and after the work.
• SMS consent records: 4 years after consent is withdrawn or the account is closed, because a complaint about text messages can be brought within that period. This is the record that protects you as much as us: it shows exactly what you agreed to.
• AI consent record — the date, the version of the text and the date of withdrawal: while your account exists.
• Sign-in codes: until used, and never longer than 10 minutes. Trusted devices: 180 days after the last sign-in from the device, or until you remove it.
• Recordings and transcripts of calls with a voice assistant: 1 year from the call. A service request taken during a call is kept like other order records.
• Location of staff on shift: 90 days from the moment it was recorded.
• Server logs: 90 days.

11. Your rights

You may exercise any of these rights free of charge, once we have confirmed your identity.

• Access and export: ask for a copy of the personal information we hold about you. We answer within 45 days and provide it in a readable, portable format.
• Correction: ask us to correct information that is wrong. We correct it or explain why we cannot.
• Deletion: delete your account in the app — tap Profile → Delete account — or ask us to delete your account and your personal information. Step-by-step instructions, including how to do it without the app, are at https://qmasterclub.com/delete-account/. We act on a request within 30 days and tell you what we are required by law to keep — normally the financial record of paid orders and the signed documents listed in section 10, without the details that are no longer needed.
• Withdraw SMS consent: reply STOP to any message, or turn it off in the application, at any time and without giving a reason. Withdrawal does not affect anything else in your account.
• Withdraw AI consent: turn off the AI assistant in the app settings, or write to us, at any time and without giving a reason. From that moment nothing more of yours is sent to the AI provider; everything else in your account keeps working.
• Complain: if you believe we have handled your information wrongly, write to us first. You may also contact the Office of the New York State Attorney General.

12. How to reach us about your data

Write to [email protected] from the email address on your account, or call +1 929 703-7117. Put “privacy request” in the subject line. We confirm every request when we receive it, and we tell you what we did when we are done.

13. How we protect it

We maintain a data security program with administrative, technical and physical safeguards appropriate to the size and complexity of our business and to the sensitivity of the information, as required by the New York SHIELD Act. In particular:

• Encryption in transit: all traffic between your device and our servers travels over TLS (HTTPS). Nothing personal is sent over an unencrypted connection.
• Encryption at rest: the database, the uploaded photographs and signatures, and the backups are stored on encrypted storage.
• Passwords are never stored in readable form; they are stored as a one-way hash (bcrypt).
• Access is limited by role and by company. Staff of one company cannot see the customers, orders or money of another company.
• Working sessions can be revoked. When a staff member leaves, their access ends immediately rather than at the end of a token’s life.
• The database and the file storage are not reachable from the public internet; only the web entry point is.
• We designate an employee to coordinate the security program, we review who has access and remove access that is no longer needed, and we select service providers capable of maintaining appropriate safeguards.
• We dispose of private information within a reasonable time after it is no longer needed, in a way that makes it unreadable.

14. If there is a breach

If we discover that private information has been acquired by, or disclosed to, an unauthorized person, we will notify the affected people in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and with any measures necessary to determine the scope of the breach and restore the integrity of the system.

The notice will describe what happened, what information was involved, what we have done about it, and how to reach us. Where the SHIELD Act requires it, we will also notify the New York State Attorney General, the Department of State and the Division of State Police, and, where the numbers require it, the consumer reporting agencies.

15. Children

Our services are intended for adults. You must be at least 18 years old to create an account or order work — see the Terms of Service. The service is not directed to anyone under 18, and we do not knowingly collect personal information from minors. If you believe a minor has given us information, write to us and we will delete it.

16. Changes

If we change this policy we will post the new version on this page and update the date at the top. Material changes will also be announced in the application before they take effect.

17. Contact

QMaster LLC, a New York limited liability company

1820 Avenue M #814, Brooklyn, NY 11230

[email protected] · +1 929 703-7117

qmasterclub.com