Privacy Policy

RoutePilot is a software-as-a-service (SaaS) platform that enables pool and spa service companies ("Subscribers") to manage their operations, including route planning, chemical tracking, customer management, and technician coordination.

If you are a homeowner accessing a pool service company's customer portal built on RoutePilot, your data is handled by that service company under their own privacy policy. We process it on their behalf as a data processor.

We do not sell your personal information to third parties. We are not in the business of advertising — we are in the business of building great software.

Account Information. When you register, we collect your name, email address, password (stored as a secure hash), and company name. We use this to create and manage your account.

Business Data. This includes customer records, pool information, chemical readings, service visit reports, photos, route schedules, inventory, and billing records that you create through the platform. This data is yours.

Location Data. We collect addresses and GPS coordinates for service locations to enable route optimization and map features. We also use your pool location to fetch local weather forecasts.

Usage Data. We collect standard server logs including IP address, browser type, pages visited, and timestamps. This helps us diagnose issues and improve performance.

AI Conversations. When you use the AI Assistant, your messages and the AI's responses are stored in your account to maintain conversation history. We do not use your conversations to train AI models.

Customer Portal Data. When homeowners access your customer portal, submit contact forms, or request services, that data is stored in your account's database. You are the data controller for this information.

Communications. If you contact us via email or support channels, we retain those communications to assist you and improve our service.

We use your information to:

• Provide, maintain, and improve the RoutePilot platform
• Optimize service routes and calculate arrival estimates
• Perform water chemistry analysis and generate treatment recommendations
• Send service notifications, invoices, and system emails on your behalf
• Fetch weather data relevant to your service locations
• Power the AI Assistant with your business context
• Generate your public-facing landing page and customer portal
• Detect and prevent fraud, abuse, and security threats
• Communicate with you about your account and platform updates

We do not use your business data for advertising, profiling, or any purpose unrelated to delivering the Service.

We do not sell your data. We share information only in these limited circumstances:

• AI Providers: Chat messages are sent to Anthropic (Claude) or OpenAI for processing. These providers do not retain your data for training. Your API key (if provided) is used directly.
• Weather Services: Pool location coordinates are sent to Open-Meteo (a free, open-source weather API) to fetch forecasts. No personally identifiable information is transmitted.
• Map Services: If you enable Google Maps, location data is sent to Google for map rendering. Otherwise, we use OpenStreetMap (no data sharing required).
• Geocoding: Addresses are sent to OpenStreetMap Nominatim for latitude/longitude conversion.
• Email Delivery: We use your configured SMTP provider (or our platform default) to send emails on your behalf.
• Legal Compliance: We may disclose information if required by law, court order, or to protect the rights, safety, or property of our users or the public.

We do not share your data with advertisers, data brokers, or any third party for their own marketing purposes.

We use essential cookies for authentication and session management. We use localStorage for theme preferences (dark/light mode) and UI state. We do not use third-party analytics, advertising cookies, or tracking pixels.

If you enable Google Maps on your account, Google may set its own cookies subject to Google's privacy policy.

We implement industry-standard security measures including:

• All data transmitted over HTTPS (TLS encryption)
• Passwords stored using bcrypt hashing (never stored in plain text)
• Database-backed sessions with configurable lifetime
• CSRF protection on all state-changing requests
• Role-based access control (tenant admin, agent, customer)
• Tenant data isolation — each company's data is logically separated
• API keys and sensitive settings encrypted at rest

No system is 100% secure. If you discover a vulnerability, please contact us at security@punchlistlabs.com.

We retain your data for as long as your account is active. If you cancel your subscription, your data is retained for 90 days in case you reactivate, then permanently deleted.

You may request immediate deletion of your data at any time by contacting us. AI conversation history is retained for 24 hours per session and limited to the last 200 messages.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at privacy@punchlistlabs.com.

RoutePilot integrates with the following third-party services. Each has its own privacy policy:

• Anthropic (Claude AI) — AI assistant conversations
• OpenAI (ChatGPT) — Alternative AI provider (tenant-configurable)
• Open-Meteo — Weather forecast data (free, open-source, no API key)
• Google Maps — Map rendering (optional, tenant-configurable)
• OpenStreetMap / CARTO — Default map tiles (free, no tracking)
• Google OAuth — Optional social login

Payment processing is handled by your own configured provider (PayPal, Stripe, Venmo, Zelle, etc.) — RoutePilot does not process payments directly.

RoutePilot is designed for business use by pool service professionals. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a prominent notice on the platform. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, contact us at:

Punchlist Labs
Email: privacy@punchlistlabs.com
Web: punchlistlabs.com