Privacy Policy

This Privacy Policy explains how ManageSync (“ManageSync,” “we,” “us,” or “our”) handles information in connection with our multi-tenant field-service platform and marketplace (the “Platform”). ManageSync is a business-to-business service used by Locations (such as convenience stores, fuel sites, and facility operators), Contractors (service firms, their dispatchers, and technicians), and our own staff.

This policy applies to information processed through the Platform and our related websites. It does not cover the independent practices of third-party services you connect, or of the Locations and Contractors who use the Platform and act as the controllers of their own data.

For account registration, billing, security, and operating the Platform generally, ManageSync acts as a controller of the relevant information. For data that a customer organization submits or generates while using the Platform (such as Work Order content), ManageSync generally acts as a processoron that organization’s behalf and processes it according to that organization’s instructions and our agreement with them. If you are an Authorized User of an organization, requests about that organization’s data may need to be directed to that organization.

We collect the following categories of information:

• Account & profile information — name, email address, phone number, password (stored hashed by our authentication provider), notification preferences, and two-factor authentication settings.
• Organization & business information — company name, addresses, service areas, sites and offices, roles, territories, licenses, and similar operational details.
• Credit, billing & verification information — information you provide in credit applications, tax forms (such as W-9 details), insurance certificates, and business documentation, along with plan and billing records.
• Work Order content — service requests, scheduling, assignments, notes, messages, forms, job photos, and service ratings.
• Tank monitoring telemetry — tank-level readings, device data, and alarm events received from connected Veeder-Root TLS hardware.
• Integration data — information exchanged with connected third-party services such as QuickBooks Online (Intuit) and PDI for accounting and invoicing.
• Google account information — only if you choose to connect Google Calendar: your Google account email address and the authorization needed to add ManageSync site meetings to your calendar. See Google user data below.
• Usage, device & log data — IP address, browser and device information, pages and actions, timestamps, and diagnostic logs.
• Communications & email engagement — messages you send us, and email delivery and engagement events (such as delivery, opens, and clicks) from our email provider.
• Audit & access records — records of significant actions, including consented staff-access grants and administrative activity.

We use information to:

• provide, operate, maintain, and secure the Platform;
• create and manage accounts and organizations, and authenticate users;
• enable core features — dispatching, the marketplace, scheduling, compliance tooling, tank-monitoring displays and alarms, and accounting integrations;
• facilitate Work Orders, including sharing necessary information between the relevant Location and Contractor;
• process billing, credit applications, and invoicing;
• read compliance documents you upload (such as test reports) with an AI service, so the Platform can suggest results for you to review and confirm;
• send transactional and operational communications, alarms, and notifications (subject to your preferences);
• provide support and respond to inquiries;
• detect, investigate, and prevent fraud, abuse, and security incidents;
• improve and develop the Platform, and analyze usage in aggregate; and
• comply with legal obligations and enforce our terms.

We use cookies and similar technologies that are necessary to operate the Platform — for example, to keep you signed in and maintain your session — and we store limited preferences (such as your light/dark theme) in your browser’s local storage. We do not use the Platform to serve third-party advertising or to track you across unrelated websites for advertising purposes.

We share information in the following circumstances:

• Between Locations and Contractors — information reasonably necessary to coordinate and complete a Work Order is shared with the counterpart organization.
• With service providers and subprocessors — vendors that host and operate the Platform on our behalf, as described below, under confidentiality and data-protection obligations.
• With connected third-party services — when you enable an integration (such as QuickBooks Online, PDI, or Google Calendar), we exchange data with it at your direction.
• With our staff — ManageSync personnel may access data to operate, support, and secure the Platform, including through consented, time-limited access described below.
• For legal and safety reasons — to comply with law, legal process, or enforceable governmental requests, to enforce our terms, or to protect the rights, property, or safety of ManageSync, our users, or others.
• In a business transfer — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

If you opt in to text messages — by checking the text-message consent box and providing a mobile number at signup or in your profile settings — we use that number to send the account notifications you asked for, such as critical tank-alarm alerts and Work Order status updates. We do not send marketing texts. Message frequency varies with account activity, and message and data rates may apply. Reply STOP to opt out at any time or HELP for help, or turn text messages off in your profile settings.

A Location or Contractor may enter an on-site contact’s phone number on a site or Work Order so that person receives job-status texts (technician en route, on site, complete, or running late). The organization entering the number is responsible for having that person’s consent, and the recipient can reply STOP to any message to stop further texts.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging opt-in data and consent are excluded from every category of sharing described in this policy and will not be shared with any third parties, other than the service provider that delivers our messages (Twilio) on our behalf.

ManageSync offers an optional Google Calendar connection. It is off unless you turn it on under Settings → Notifications → Calendar → Google Calendar → Connect, and only you can connect your own Google account.

What we access. When you connect, Google asks you to grant ManageSync:

• Your Google account email address (the openid and email permissions), so we can show which Google account is linked.
• Permission to see, create, change, and delete events on Google calendars you own (the calendar.events.owned permission). We use it only to create, update, and delete the events ManageSync itself adds to your primary calendar. It does not reach calendars other people share with you.

We do not read, copy, or store your other calendar events, your contacts, your email, or any other information in your Google account.

How we use it. While you are connected, each ManageSync site meeting you are invited to is added to your Google Calendar with its date, time, location, project name, and a link back to ManageSync. When the meeting is rescheduled or edited, we update the event. When the meeting is canceled or archived, or you are removed from it, we delete the event. That is the only use we make of Google user data.

What we store. We store your linked Google email address, the access and refresh tokens Google issues (encrypted at rest), the identifiers of the events we created, and the times and any errors of recent updates.

How we protect it.Google user data travels only over encrypted (TLS) connections between Google, ManageSync, and our hosting providers. Google’s access and refresh tokens are encrypted at rest with AES-256-GCM, and each connection is used only for the user who created it: no other user or organization can read or use it. ManageSync staff access is limited as described below.

How long we keep it. We keep the tokens and event identifiers only while you are connected. When you disconnect, they are deleted (see below). The linked Google email address stays as a record of the past connection until you ask us to delete it.

Sharing. We do not sell Google user data, use it for advertising, or use it to build user profiles. We do not use it to develop, improve, or train artificial intelligence or machine-learning models. We do not share or transfer it to anyone, except: to the hosting providers that store it on our behalf (listed below), as necessary to provide the calendar feature you turned on; to comply with applicable law; or as part of a merger, acquisition, or sale of assets, with notice to you. ManageSync staff do not read Google user data unless you ask us to (for example, for support), it is needed to investigate security issues or abuse, or the law requires it.

Disconnecting and deletion. You can disconnect at any time under Settings → Notifications → Calendar. When you do, we delete the events ManageSync added to your calendar, revoke our access with Google, and delete the stored tokens. You can also remove ManageSync’s access from your Google Account permissions page. To have the remaining record of the connection (the linked email address) deleted, contact support@managesync.com.

Limited Use. ManageSync’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We rely on a small set of trusted providers to deliver the Platform. The principal ones are:

This list may change as our services evolve. We will keep it current and can provide additional detail about our subprocessors on request to support@managesync.com.

To provide support and resolve issues, ManageSync staff may need to access an organization’s data. Where the Platform provides a consented staff-access mechanism, such access is intended to be granted by the customer, limited in time, scoped to what is needed, and recorded in an audit log. We log administrative and access actions to support accountability and security.

We retain information for as long as needed to provide the Platform, to maintain account and organization records, to comply with legal, accounting, and regulatory obligations, to resolve disputes, and to enforce our agreements. Certain records — such as audit logs and Work Order status history — are kept as part of the integrity and accountability of the Platform. When information is no longer needed, we delete or de-identify it in the ordinary course.

We use administrative, technical, and organizational measures designed to protect information, including encryption in transit, access controls, tenant data isolation, optional two-factor authentication, and audit logging. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for safeguarding your credentials and for configuring access within your organization appropriately.

Depending on your location and role, you may have rights to access, correct, update, delete, or obtain a copy of certain personal information, or to object to or restrict certain processing. You can update much of your profile and notification preferences directly within the Platform, and you can unsubscribe from non-essential emails using the link in those messages or via your notification settings. Security and authentication messages (such as password resets, access requests, and critical alarms) are always sent and cannot be turned off.

To exercise a right, contact us at support@managesync.com. If the information relates to an organization for which we act as a processor, we may direct your request to that organization or assist it in responding. We will verify requests as appropriate and respond as required by applicable law.

ManageSync operates in the United States, and information we process may be stored and handled in the United States or other countries where we or our service providers operate. Where required, we take steps to ensure appropriate safeguards for cross-border transfers of personal information.

The Platform is intended for business use by adults and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us so we can take appropriate action.

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you, such as by posting the updated policy with a new “Last updated” date or notifying you within the Platform. Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, contact us at support@managesync.com, or by mail to ManageSync, Maryland.