Privacy Policy

This Privacy Policy explains how APPtitude, LLC ("APPtitude," "we," "us") collects, uses, shares and protects information in connection with GetPAID Business Management. That includes the website at getpaidpro.app, the web app, the worker portal, and the links we send to subcontractors and property managers (the "Service"). It should be read together with our Terms of Service.

Two kinds of information. First, there is information about you as our customer, such as your account, billing and how you use the Service. Second, there is information that businesses put into the Service about their workers, customers and jobs ("Customer Data"). For Customer Data, the business that uses GetPAID decides what is collected and how it is used, and we process it on that business's behalf. If you are a worker or customer of a business that uses GetPAID, please contact that business first about your information.

The short version: we do not sell personal information, we do not share it for targeted advertising, there are no ads in the Service, and we do not use your data to train AI models.

Information you give us:

• Account information: name, email, password (stored only by our sign-in provider, as a secure hash), business name, business type, phone, address, time zone, and the plan you choose.
• Business records: workers and subcontractors, their pay types, rates, hours, clock-ins, pay history, advances and deductions; job sites, customers, scopes of work, quotes, invoices, schedules and routes; expenses, receipts and mileage; notes and messages between you and your crew.
• Tax information: legal names, Social Security or Tax ID numbers, and addresses entered for Form 1099-NEC. Tax ID numbers are shown masked wherever possible.
• Photos, documents and recordings: pictures of receipts, job sites, scopes, odometers, inspections and letters; documents you scan; and what you say to Velo when you use voice features (turned into text by your browser; we don't receive or store the recording).
• Worker portal information: workers' names, phone numbers, addresses, hours they submit, clock-ins and the job sites they work at.
• Support messages: what you send us when you ask for help.

Information collected automatically:

• Usage and device information: actions you take in the Service, pages viewed, approximate location from your IP address (used to confirm the Service is offered in your state), browser and device type, and error logs.
• Device location: only if a business turns on leaving-site reminders and the worker allows it. See section 7.
• Cookies and local storage: see section 9.

Information from others: from Stripe about your subscription and bank payments; from Plaid about linked bank accounts and transactions if you use Bank Matching; and from other GetPAID users who invite you, share work with you or send you invoices.

• To provide the Service: store your records, calculate hours, pay, overtime and taxes, create documents, send the emails and notifications you ask for, and run the features you use.
• To process billing and, if you use them, bank payments and Bank Matching.
• To keep the Service and its users safe: authenticate sign-ins, enforce permissions and usage limits, prevent fraud and abuse, and investigate security issues.
• To support you and to send service messages, such as security, billing and product updates.
• To understand and improve the Service, using usage information and de-identified, aggregated data.
• To meet legal obligations and enforce our Terms.

Some features send information to our AI provider, Anthropic, to produce a result for you. These features include Velo chat and voice, Velo Insights, voice quotes, Velo Vision, and receipt, scope, odometer, invoice and letter scanning. Depending on the feature, that information may be the image or document you capture, the words you type or say, and the records Velo needs to answer you (for example, an invoice you asked about), along with basic account context such as your plan and which screens you can use.

Our AI provider processes this information only to return the result. It is not used to train AI models, and we do not use it for advertising. Spoken requests are turned into text by your browser's speech service before they are sent to us. On some browsers, such as Chrome and most Android phones, the browser sends your voice to its maker's speech service (for example, Google) to do this, under that company's own privacy terms; we never receive or store the recording. Velo Vision uses your camera only while it is open.

Velo's voice on calls. When you call Velo, her spoken replies are turned into speech by our voice provider, ElevenLabs. Only the text of Velo's reply is sent to do this, and it can include details from your records that you asked about. ElevenLabs processes it to create the audio under its terms for business customers, and we do not keep the audio. If the voice service isn't available, your device's own voice reads the reply instead.

Velo's memory. To follow up like someone who knows your business, Velo saves a short memory for the person using it: goals you set (and when you reach them), things you ask her to remember or that will clearly matter later (such as "doesn't work Sundays"), and a one- or two-sentence summary of each Velo chat and call. Each person's memories are visible only to them. You can see and delete any of them in Settings → "What Velo remembers," or tell Velo to forget something. Velo keeps the latest 60 chat summaries and 60 call summaries; goals and other memories are kept until you delete them or close your account.

Facebook Page posts. If a business owner connects a Facebook Page (Settings → Facebook Page), we use Facebook Login to get permission to see the Pages they manage and to post to the one they choose. We keep only that Page's ID, its name and its access token, encrypted, on our servers; the token is never shown in the app. Velo can write a draft post, but nothing is posted or scheduled until the owner taps Post now or Schedule. To delete this data, tap Disconnect in Settings → Facebook Page (the Page and its token are erased at once), or remove GetPAID in Facebook's Settings → Business Integrations; you can also contact us to have it deleted.

AI-assisted support. When you contact support, Velo may read your support conversation and basic account details (such as plan, trial status and business type) to write private notes that help our team fix the problem. Velo does not read the records inside your account for this, and its notes are visible only to our team.

We do not sell personal information, and we do not share it for cross-context behavioral (targeted) advertising. We share information only in these cases:

• Service providers who help us run the Service and may use information only to provide their services to us. They include our database, sign-in and file storage provider (Supabase); our hosting provider (Vercel); Stripe for billing and bank payments; Plaid for Bank Matching; our email delivery provider; our AI provider (Anthropic); our voice provider for Velo calls (ElevenLabs); the U.S. Census Bureau and OpenStreetMap address-lookup services; and the push notification services built into browsers and phones.
• People you choose to share with. When you send something to a worker, subcontractor, customer, accountant or property manager, or share a scope with another GetPAID business, they receive what you chose to send. Workers never see prices, and subcontractors see only their own prices.
• Within a business. A business owner and the managers they authorize can see the business's records, including the hours and information its workers submit.
• Legal and safety reasons: to comply with law, a subpoena or other legal process; to protect the rights, property or safety of APPtitude, our users or others; or to prevent fraud.
• Business transfers: as part of a merger, acquisition, financing or sale of assets, under a commitment that keeps this policy's protections in place.
• With your consent, or at your direction.

Bank payments (Stripe). When you set up bank payments, you enter your bank and identity details on Stripe's screens, and Stripe verifies them. We never see or store full bank account numbers or bank logins. We keep Stripe's reference IDs, the bank name and last four digits, setup status, and each payment's amount, fees, dates and status, so we can show them to you and the person you pay. Stripe's handling of your information is described in the Stripe Privacy Policy.

Bank Matching (Plaid). If you link a bank account for Bank Matching, you sign in to your bank on Plaid's screen, and we never see your bank login. Plaid shares account and transaction information with us, which we use only to find deposits that match your open invoices and show them to you for confirmation. We keep the matched deposit's date, amount and description. The access token Plaid issues is stored on our servers and never sent to your browser. You can unlink a bank at any time in Settings, and banks are unlinked automatically if Bank Matching ends. See the Plaid End User Privacy Policy at plaid.com/legal.

Workers who join through an invite submit their own information, such as their name, phone, address and hours, through the worker portal. The business that invited them can see it, and that business's own policies also apply.

Leaving-site reminders. If a business turns this on for a worker, the worker portal asks the worker for permission to use their device location. Location is checked only on the worker's device, only while they are clocked in to a job site with the portal open, and only to compare their distance from that job site, so the portal can ask whether they need to clock out or track mileage. Location readings are not stored or sent to the business. The only thing saved is the time the portal first asked during a shift, so the business can see when the worker left and, if they forgot to clock out, clock them out at that time. Workers can turn off location permission in their browser at any time.

Maps. To place job sites on a map, a job site's address is sent to a public address-lookup service (the U.S. Census Bureau geocoder or OpenStreetMap), and the map coordinates it returns are stored with the job site.

We protect information with safeguards that include:

• Encryption in transit (HTTPS) everywhere, and encryption at rest by our infrastructure providers.
• Database rules that keep each business's records separate from every other account and limit each person to what their role allows.
• Payment and bank credentials handled by Stripe and Plaid. Secret keys are kept only on our servers.
• Browser security headers, usage limits on sensitive features, and a permanent activity log of changes to pay records.
• An app PIN that is stored on the device only as a scrambled (hashed) value, plus a privacy mode that hides names, addresses and amounts on screen.

No method of storage or transmission is completely secure. If a security breach affects your personal information, we will notify you and any authorities as the law requires.

We use only what the Service needs to work. There are no advertising cookies or third-party trackers.

• Sign-in session: keeps you signed in on your device.
• "Uses the app" cookie: remembers that this device uses GetPAID, so the web address opens the app instead of the public home page.
• Settings on your device: preferences such as light or dark mode, the business you last opened, privacy mode, and your app PIN (hashed).
• App files: parts of the app saved by your browser so it loads quickly. Records loaded directly from our database are never stored for offline use. Signing out ends access to them.

You can clear these in your browser settings. Doing so signs you out and resets your device settings.

Deleting your account. You can delete your account at any time in the app (menu → ⚙️ Settings, or 👤 Account for crew → Delete my account, at the bottom) or at getpaidpro.app/delete-account. That cancels your subscription and permanently deletes your account and the data you entered (including photos) right away; it can't be undone. Copies in our backups are overwritten on their normal schedule, and payment records that our payment processor (Stripe) is required to keep stay with them.

We keep Customer Data while your account is active and as needed to provide the Service. After an account closes in another way, we keep it as long as needed to comply with legal obligations (for example, tax and payment records), resolve disputes and enforce our agreements, and then delete or de-identify it. Backups are overwritten on a rolling schedule. Some information has set retention periods:

• Photos: kept for 7 days if a quote is declined; otherwise until 6 months after the job is marked complete.
• Support conversations: kept for 6 months after the last message, then deleted automatically.
• Velo's memory: the latest 60 chat summaries and 60 call summaries per person; goals and other memories until you delete them (Settings → "What Velo remembers") or close your account.
• Archived property-manager requests: quote requests and scopes a property manager archives or cancels are kept for 7 years after archiving, then deleted automatically. They can be exported as a PDF at any time from the Archive tab, and Velo reminds you each December. Contractors' own job sites, invoices and pay records are not deleted by this.
• Pay records and activity logs: kept for the life of the account, because they are the record of what was paid.
• Bank payment records: also kept by Stripe under its own legal obligations.

You can view and update most of your information in the app. You can also ask us to:

• Give you a copy of your personal information, or export your records.
• Correct inaccurate information.
• Delete your account and personal information, except records we must keep by law.
• Explain how we use your information.

Email support@getpaidpro.app from the email on your account. We may need to verify your identity before acting. We respond within 45 days, or sooner where the law requires. If we decline a request, we will tell you why, and you may appeal by replying to our response. We will not treat you differently for exercising your rights.

State privacy laws. Depending on where you live, you may have additional rights under your state's privacy law, such as the right to opt out of the sale of personal information, targeted advertising or profiling. We do not sell personal information or use it for targeted advertising or profiling, so there is nothing to opt out of, but you may still contact us with any request.

Workers and customers of a business: because the business controls its records about you, we will usually pass your request to that business, or ask you to contact it directly.

Emails and notifications: you can turn phone notifications off in the app, and unsubscribe from any marketing email using its link. Service messages, such as security and billing notices, are sent while you have an account.

Do Not Track and Global Privacy Control: we do not track you across other websites, so these signals do not change how the Service works.

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

The Service is offered only in the United States, and information is stored and processed in the United States by us and our service providers.

We may update this Privacy Policy, and we will post the new version with a new "Last updated" date. For material changes, we will also notify you by email or in the Service before they take effect. If you keep using the Service after changes take effect, you accept the updated policy.

APPtitude, LLC · GetPAID Business Management · support@getpaidpro.app