Privacy Policy

1. Scope

This Privacy Policy applies to the CommandPoint software platform, the CommandPoint Field mobile application, related websites, and support services (collectively, the "Services"). CommandPoint is a business operations platform intended for authorized employees, contractors, vendors, and other users provisioned by a subscribing organization.

Your organization may act as the business owner or controller of project, workforce, customer, vendor, and field-production information entered into CommandPoint. In those circumstances, your organization determines which users are authorized and how business records are used, subject to its agreement with CommandPoint and applicable law.

2. Information we collect

Account and organization information

We collect information needed to authenticate and provision users, including names, business email addresses, organization and crew affiliations, roles, permissions, onboarding status, and account activity.

Project and field information

Authorized users may submit project identifiers, assignments, production quantities, mapped segments and structures, daily reports, notes, schedules, approvals, invoices, time or expense information, and related operational records.

Location, photographs, and documents

When a user chooses a mapping or evidence feature, CommandPoint Field may collect precise or approximate device location, photographs taken with the camera, selected images, and uploaded documents. These items may include coordinates, timestamps, project context, and user-provided descriptions.

Connected services and communications

If an authorized user connects an email or other third-party account, CommandPoint may process the content and metadata authorized by that user to provide project intelligence, alerts, summaries, and requested actions. Use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Technical information

We and our service providers may process IP address, device and browser type, operating system, application version, diagnostic events, access timestamps, security logs, and similar information required to operate, secure, and troubleshoot the Services.

3. How we use information

• Authenticate users and enforce organization, module, role, vendor, crew, and project assignments.
• Provide mapping, production capture, evidence, reporting, workflow, billing, and collaboration features.
• Maintain audit history, approvals, compliance records, and data integrity.
• Operate, monitor, secure, support, and improve the Services.
• Generate AI-assisted summaries, classifications, recommendations, or proposed changes when an authorized user invokes those features.
• Comply with contractual, legal, tax, accounting, safety, and regulatory obligations.

4. Location, camera, and file permissions

CommandPoint Field requests location access to let users place installed production, structures, and field evidence on project maps. Location is collected only when the user activates a location or mapping feature while using the application. CommandPoint Field does not request continuous background location access.

Camera, photo-library, and file access are used only when a user chooses to capture or attach evidence, receipts, credentials, plans, or other business records. Users can deny or later revoke device permissions, although the related feature may then be unavailable.

5. How we disclose information

We disclose information only as needed to operate the Services or as directed by an authorized customer:

• Within the subscribing organization: authorized administrators, managers, project teams, vendors, and crews receive access according to assigned roles and projects.
• Service providers: infrastructure, authentication, storage, mapping, application delivery, payment, email, analytics, security, and AI providers process limited information on our behalf. These may include Supabase, Vercel, Expo, Google Maps Platform, Stripe, and OpenAI where the corresponding feature is used.
• Legal and safety purposes: we may disclose information when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or enforce agreements.
• Business transactions: information may be transferred as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.

6. Security and organization isolation

CommandPoint uses administrative, technical, and organizational safeguards designed to protect information. These include authenticated access, role and assignment controls, organization-scoped database policies, encrypted network transmission, service-provider access controls, and audit records. No system can guarantee absolute security, and users are responsible for protecting their credentials and devices.

7. Data retention

We retain information for as long as necessary to provide the Services, maintain required business and audit records, comply with legal obligations, resolve disputes, and enforce agreements. Retention may vary by record type and by the instructions or contractual requirements of the subscribing organization.

When information is no longer required, we delete, de-identify, or securely isolate it according to our retention practices and applicable law. Backup copies may remain for a limited period before routine deletion.

8. Account and data deletion

A user may request deletion of a CommandPoint Field account and associated personal data by emailing privacy@command-point.app with the subject "CommandPoint Account Deletion Request." Include the account email and organization name. We may verify identity and organizational authority before processing the request.

Because CommandPoint is a business record system, certain project, production, billing, safety, compliance, or audit records may belong to the subscribing organization or must be retained by law. Where deletion of a complete business record is not permitted or directed, we will delete or de-identify the requesting user's personal account data where appropriate and disable access. Subscription cancellation and account deletion are separate actions.

9. Your choices and rights

Depending on location and applicable law, users may have rights to access, correct, export, object to processing of, restrict, or delete personal information. Users may also revoke device permissions through operating-system settings and disconnect authorized third-party accounts through CommandPoint or the third-party provider.

Requests can be submitted using the contact information below. Organization-managed business records may also require coordination with the user's company administrator.

10. Children's privacy

The Services are intended for business use and are not directed to children under 18. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this Privacy Policy as the Services, providers, or legal requirements change. We will post the revised policy at this URL and update the effective date. Material changes may also be communicated through the Services or to organization administrators.

12. Contact CommandPoint