Privacy Policy

If you joined the original Early Access waiting list — which did not require an account — we collected:

• Your email address and name
• Your trade, crew size, and the tools you use today, so we can prioritise what we build and group launch messages sensibly
• A phone number, only if you tick the optional box asking us to text you
• The referral code you arrived with, if any, and the campaign tags in the link you clicked

We use this to email you about the launch and roughly monthly before it, and for nothing else. We do not sell it, and we do not share it with advertisers. Every email carries an unsubscribe link, and you can ask us to delete your entry at any time by writing to hello@measuretechpro.com — joining the list creates no account, so there is nothing else of yours attached to it.

A phone number given here is stored and not used. We will not send you a text message until our carrier registration is approved, and even then only if you ticked that box.

When you create an account, we collect:

• Email address (email/password sign-in)
• Name (display name, first/last name for reports)
• Phone number (phone sign-in or multi-factor authentication)
• Apple ID token (Sign in with Apple — we receive only the token; Apple may anonymize your email)
• Google account info (Sign in with Google — name, email, profile photo)
• Job title and company information you voluntarily enter (name, address, website, contact info, report title) — used only to populate professional reports you generate

• Floor plan drawings, sketches, CAD files, and annotations you create
• Measurement data (dimensions, labels, tags, notes) you enter
• Photos and videos you capture or import within the App
• Photo markup annotations (drawings, text, stickers)
• Document files you import (PDF, DXF, DWG, SVG, DOCX)

We collect location-related data in the following ways:

• Photo GPS: GPS coordinates are optionally attached to photos you capture within the App. This data is stored in your project files.
• Project addresses & coordinates: When you add a project address, we geocode it to latitude/longitude coordinates for map display. On iOS, this uses Apple's on-device geocoder. On the web dashboard, addresses are sent to the Google Maps Geocoding API. Coordinates and a geohash are stored in Firestore.
• Team member location: If you use the Project Map feature, your current device location may be shared with your team members in real time. Location data is written to Firestore under your team's namespace and is visible to all team members. Location snapshots older than 10 minutes are automatically filtered out of the display.
• Geofence notifications: The iOS app may monitor up to 20 project locations (200-meter radius) to send you local arrival notifications. This processing happens entirely on your device — no geofence data is sent to our servers.
• Weather forecasts: When viewing project locations on a map, we send the project's coordinates to the Open-Meteo weather API to display current weather conditions. No personal information is included in these requests.

Location data is never used for advertising or sold to third parties.

If you opt in through the App's separate analytics consent prompt or enable “Share Analytics” in Account settings, Google Analytics for Firebase collects usage information to help us improve the App, including:

• App session events (session start, session end, screen views)
• Feature usage events (which tools you use, export types, layout types)
• Performance timing (load times, sync durations)
• App version, platform, and account properties such as role and subscription tier

Optional analytics are disabled until you opt in. Analytics may be associated with your account ID and are not necessarily anonymous. You can stop future optional analytics collection by turning off Share Analytics in the App's Account settings.

Crash and error reporting: In release versions of the App, Firebase Crashlytics automatically collects crash reports, non-fatal errors, diagnostic logs, and app/device information to help us diagnose failures and improve reliability. When you are signed in, reports are associated with your account ID. Crash reporting operates separately from optional usage analytics and is not disabled by turning off Share Analytics or declining ATT.

We measure visits to public marketing pages separately from signed-in app activity. These measurements include page views, referral sources, campaign labels, approximate city/state/country, device category, and time spent with a page visible. Random browser and visit identifiers stored on your device help estimate visitors; they do not identify a person across devices. When a new account is created shortly after a recorded visit, we may record that the visit led to a signup without storing your name, email, or account ID in the website analytics report.

Our server sends the network IP address to GeoJS over HTTPS to estimate location. New analytics records do not store the raw IP address or precise coordinates. Network location is approximate and can reflect a VPN or mobile-network location. Detailed website events are retained for up to 90 days. We honor Do Not Track, Global Privacy Control, and a denied analytics preference on this browser. Recognized internal visits and automated traffic are excluded from the default acquisition report.

Subscription status (Free, Pro, Team, or Scale), entitlement identifiers, and renewal dates. Payments are processed by Stripe on our website — we never receive or store your payment card information. Stripe's handling of your payment details is governed by Stripe's privacy policy.

If you are part of a team:

• Your assigned role (admin, manager, member, collaborator)
• Team membership, invitation records, and audit log entries
• Project presence indicators (which layout you are currently editing, approximate edit activity)
• Remote cursor position (grid coordinates, shared only within active collaborative sessions and not persisted)
• Real-time device location when using the Project Map feature (shared only with team members, auto-expires after 10 minutes of inactivity)

If you choose to sync your project schedule to Google Calendar, we request access to your Google Calendar via OAuth authorization. This allows us to:

• List calendars to locate app-created calendars and create a separate project calendar for each market in your Google account
• Read, create, update, and remove app-linked events for project phases and milestones, including their names, dates, status, and project context
• Manage calendar sharing for administrators and members assigned to the market, using their email addresses stored in your team profile
• Remove sharing from or retire a legacy app-created team calendar when migrating to market calendars

We store calendar and event identifiers, sync status, and the sharing grants the integration manages in your team's Firebase records. We read app-linked events to reconcile schedule changes; we do not import unrelated personal events.

If you use Business Tools (available on iOS and the web dashboard), we store:

• Customer records (name, email, phone, company, address) you enter
• Estimates and invoices (line items, amounts, dates, status)
• Recurring invoice schedules (frequency, next run date, auto-send preferences)
• Payment records (amount, method, reference number, date)
• Invoice template settings (logo, colors, footer text, payment terms)

This data is stored in Firebase Firestore under your team's or user's namespace and is accessible only to authorized users based on role permissions (admin and manager for invoices and payments; all members for customers and estimates).

If you connect a Stripe account to collect payments from your clients, the following data is processed:

• Stripe Connect account ID and onboarding status (stored in Firestore)
• Payment capability flags (charges enabled, payouts enabled, ACH enabled)
• Your clients' payment information (card numbers, bank account details) — collected and processed entirely by Stripe; we never see or store this data
• Invoice payment status and Stripe invoice IDs (synced back to Firestore when payments are completed)

If you connect QuickBooks Online, the following data is exchanged:

• OAuth tokens (access and refresh tokens stored in Firestore, used to authenticate API calls)
• QuickBooks company ID and realm ID
• Customer records synced to QuickBooks (name, email, phone, company, address)
• Invoice records synced to QuickBooks (line items, amounts, dates, customer reference)

Check-powered paychecks are a future release. If the feature becomes available to your workspace and you choose to use it, we may store:

• Worker records (name, email, phone, classification, hire date, pay rate)
• Tax withholding details (filing status, state, W-4 information)
• Last four digits of Social Security numbers (stored for identification purposes only)
• Timesheet entries (hours worked, project allocation)
• Pay run records (gross pay, tax calculations, deductions, net pay)
• Compliance documents (I-9, W-4, insurance certificates — completion status and dates only, not document contents)

If you use the lead management and marketing features, we process communication data to send messages and place calls on your behalf:

• SMS messages: When you or the auto-response system sends a text message to a lead or customer, we transmit the recipient's phone number and message content to Twilio for delivery. Twilio assigns a unique message SID for tracking delivery status.
• Voice calls: When you place an outbound call to a lead or customer through the App, we use Twilio to connect the call. Your business name is displayed on the recipient's caller ID via Twilio Branded Calling so customers can identify your business. We transmit the recipient's phone number and your registered business name to Twilio to facilitate the call. Call metadata (call duration, timestamp, and completion status) is logged in Firestore under your team or user namespace.
• Email messages: When you or the auto-response system sends an email to a lead or customer, we transmit the recipient's email address, subject line, and message content to Resend for delivery.
• Communication logs: Each sent SMS, voice call, or email is logged as an activity record in Firestore under your team or user namespace, including the communication type, summary, timestamp, and sender identity.
• Auto-response settings: If you enable auto-response, we store your message templates, frequency preferences, and enabled/disabled status on your team or user document in Firestore.

Users on the free plan are shown ads via Google AdMob. AdMob may collect device identifiers and usage data for ad personalization, subject to your ATT consent.

If a team administrator connects your Google Business Profile (Business Tools → Settings → Integrations), we use Google OAuth to provide review management and, when you choose it, publish business updates. With your authorization we access:

• Your Google Business Profile account and location information (account and location resource names, location titles and addresses) — used to list your locations and map each to a market
• Reviews on your mapped locations: the reviewer's public display name and profile photo, the star rating, the review text, and review and response timestamps
• Owner responses you write in the app, which we post publicly to Google on your behalf as your business's reply
• Business post content you create or schedule, including captions, media, publishing time and time zone, selected location, delivery status, and the Google post identifier or link returned after publishing

We use this data solely to provide the review, reply, publishing, scheduling, delivery tracking, and reputation-reporting features you enable. Synced reviews and publishing records are stored in Firebase Firestore under your team's namespace. A review removed on Google is hidden on your next sync.

If a team administrator connects Meta through Facebook Login for Business, we use the Meta Graph API to provide the features you authorize for the Facebook Pages and linked Instagram professional accounts you explicitly select. Depending on the features and permissions approved by Meta, we process:

• Your basic Facebook Login identity and the list of Facebook Pages you manage, including Page IDs, names, and Page access tokens
• The ID and username of an Instagram professional account linked to a selected Facebook Page
• Facebook Page recommendations made available through the API, including recommendation type, review text, the reviewer's public display name, and timestamps
• The publishing destination you select and non-secret connection details such as connection status, available capabilities, authorization and verification timestamps, and any connection error
• Content you create or schedule, including captions, hashtags, media, publishing time and time zone, and your Facebook and Instagram destination selections
• Delivery records such as publishing status, attempt and retry timestamps, provider post IDs, permalinks, and error messages returned by Meta

When you publish immediately or schedule automatic publishing, we send the selected content to Meta on your behalf. Media is made available to Meta through a short-lived signed download URL so Meta can retrieve it for publishing. Published Facebook Page and Instagram content is public and is then governed by Meta's terms and privacy policy.

Yelp review sync is a future release. If it becomes available and you enable it for a market, we may retrieve that business's public rating and recent review excerpts through the Yelp Fusion API for display and reputation reporting. Yelp access would be read-only and shown with attribution and a link back to Yelp.

If you connect Google Ads, we access the advertising accounts you authorize, account and campaign identifiers, campaign settings, and performance reports to display results and carry out campaign actions you request. Where available through the connected account, Local Services Ads lead details are imported into your workspace.

For conversion reporting, we send CRM outcomes such as lead qualification or sales, timestamps, transaction identifiers, values, currency, and available ad-click identifiers to the selected Google Ads account through Google Data Manager. If no click identifier is available and enhanced conversions for leads is enabled in that Ads account, we may send normalized, SHA-256-hashed email addresses or phone numbers for matching. Hashing does not make this information anonymous. Your business is responsible for the notices and permissions required for the customer data it supplies.

Account metadata, reports, and conversion delivery records are stored within your workspace. Google Ads credentials are encrypted with Google Cloud KMS in server-only records and removed when you disconnect. Disconnecting stops future access; it does not erase campaigns or conversions already held by Google. Google Calendar and Business Profile data are not used as advertising audiences or conversion inputs.

The App integrates the following third-party services, each with their own privacy policies:

Measure Tech PRO's use and transfer of information received from Google APIs — including Google Sign-In, Google Calendar, Google Business Profile, Google Ads, and Google Data Manager — adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We use Google user data only to provide or improve the user-facing features you enable and that this policy describes: sign-in, market-calendar scheduling and sharing, Business Profile reviews and publishing, and authorized Google Ads management and reporting
• Google Calendar, Business Profile, and Google Sign-In data are not used for ad targeting, advertising audiences, or customer conversion matching. The separate Google Ads connection uses authorized advertising-account data and CRM conversion records for the advertising features described in section 1.15
• We do not sell Google user data or transfer it except to provide those features, meet legal obligations, or complete a business transfer subject to this policy and applicable consent requirements
• We do not permit our personnel to read Google user data except with your consent (for example, to troubleshoot a support request), for necessary security purposes, or as required by law
• Google user data, including raw or derived Google Workspace data, is not used to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models. Optional AI features use our backend Google Vertex AI service to provide the requested result; they do not use your Google account's generative-AI quota. "Draft with AI" sends the selected review's text to that service to suggest a reply for you to review, edit, and post

• Local storage: Project files, drawings, and preferences are stored on your device in the app's sandboxed container and optionally synced via iCloud.
• Cloud storage: If you use team features, project data and photos are stored in Google Firebase (Firestore and Firebase Storage), hosted in the United States.
• Per-user isolation: Each user's data is stored in a namespace keyed to their unique user ID. Other users, including team members below admin level, cannot access your personal account data.
• Security measures: Data in transit is encrypted via TLS. Firebase Security Rules restrict read/write access to authenticated users and enforce role-based permissions. Connected-service credentials are encrypted with Google Cloud KMS, stored server-side, and denied to client applications. Multi-factor authentication (MFA) is available for additional account security.
• Retention: Your project data and account information are retained until you delete your account. Connected-service credentials are retained while the applicable connection remains active and are deleted when that connection is removed (for Meta, when no connected Meta destination remains for the applicable account scope). Deleted account data is purged from Firebase within 30 days. Content already published to Google or Meta remains with that provider until you delete it there.

You can permanently delete your account and associated App data from within the App: Account → Delete Account. This removes your Firebase Auth credentials, Firestore user document, team membership records, and queued uploads. Content already published to a third-party service is not automatically deleted from that service; delete it through the provider or contact us for assistance.

Your project files are stored locally on your device and can be exported at any time via the App's export features (PDF, PNG, DXF). You may contact us at the address below to request a copy of your account data held in Firebase.

You can stop future optional usage analytics collection at any time by turning off Share Analytics in the App's Account settings. This does not disable crash reporting or change your advertising tracking permission. Turning off analytics does not itself delete previously collected data; contact us using the details below to request deletion of data associated with your account.

If you have connected Google Calendar, you can revoke access at any time by visiting Google Account → Third-party apps and removing Measure Tech PRO. Previously synced calendar events will remain in your Google Calendar but no new events will be created or updated.

If you have connected a Stripe account, you can disconnect it from the web dashboard settings. This removes the Stripe account link from your team record. Existing invoices and payment history remain in Firestore for your records. To fully close the Stripe Express account, visit your Stripe Dashboard.

If you have connected QuickBooks Online, you can disconnect it from the web dashboard settings. This revokes the stored OAuth tokens and stops all future syncs. Previously synced data in QuickBooks is not affected. You can also revoke access from Intuit Account → App connections.

You can disconnect review integrations from Business Tools → Settings → Integrations. You can manage publishing connections from Growth → Content → Connections. Disconnecting stops future syncing and automatic publishing for that destination. Google credentials are revoked and deleted when Google Business Profile is disconnected. For Meta, the selected destination is removed immediately and the encrypted Meta credentials are deleted when no connected Meta destination remains for the applicable account scope.

You can also revoke Measure Tech PRO directly from Google Account permissions or Facebook Business Integrations. Revoking at the provider invalidates its credentials but does not remove published posts, reviews, or business data retained by that provider. Delete published content through Google, Facebook, or Instagram. To request deletion of stored Meta connection data or publishing records, email privacy@measuretechpro.com with the subject “Meta Data Deletion Request.” We will verify your identity and process the request within 30 days, subject to legal retention requirements.

Recipients of SMS messages sent through Measure Tech PRO can opt out at any time by replying STOP to any message. Twilio automatically processes opt-out requests and prevents further messages from being delivered to that number. You can also disable auto-response and follow-up messages from your account settings. Message frequency varies based on your communication preferences. Standard message and data rates may apply.

Recipients of voice calls can request not to be called at any time. Business users can mark any contact as "do not contact" in the CRM, which prevents future calls and messages to that number. All outbound calls display the business name via Twilio Branded Calling so recipients can identify who is calling. Calls are placed only to customers with an existing business relationship or leads who have voluntarily submitted their phone number.

Adjust your ATT preference via Settings → Privacy & Security → Tracking on your device. Upgrading to a paid plan removes all advertising from the App entirely.

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the "sale" of personal information (we do not sell personal data)
• Non-discrimination for exercising your privacy rights

To exercise these rights, contact us at the address in Section 8.

If you are located in the European Economic Area, you have the right to access, rectify, erase, restrict processing, and port your personal data. Our legal basis for processing is:

• Contract performance — account creation and app functionality
• Legitimate interest — security, fraud prevention
• Consent — analytics, advertising, and optional connected-service authorizations (withdrawable at any time)

To exercise GDPR rights, contact: privacy@measuretechpro.com

Measure Tech PRO is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will update the "Last Updated" date and notify you of material changes. Before accessing a new type of Google user data or using it for a new purpose, we will explain the change and request your consent. Updating this policy does not itself grant new access to your Google account.

If you have questions, concerns, or requests regarding this Privacy Policy: