Privacy Policy

Last updated: October 2026

1. Introduction

Cevoriq LLC ("Company", "we", "us") operates the Cevoriq™ platform. This Privacy Policy explains how we collect, use, store, and protect your information when you use our Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your name, email address, and organization details. Authentication is handled through Clerk, our identity provider.

Partner portal users are the exception. People at your service partners whom your organization gives access to the partner portal do not have Clerk accounts. They sign in with a single-use link emailed to them, valid for 15 minutes, with no password. For each we store their name and email address, the partner they belong to, when they last signed in, and their portal sessions. Only a hash of each sign-in link and session cookie is stored, never the link or cookie itself.

2.2 Platform Data

Data you enter into the platform — contracts, assets, incidents, shipping records, catalog items — is stored in our database and associated with your organization (tenant). Files you upload — contract documents, purchase-order attachments, and the Field Service files listed below — are stored in object storage provided by Cloudflare R2, separately from the database, and are readable only through the platform.

Field Service. If your organization uses Field Service, the platform also stores the following, in the same database and object storage:

• Jobs and their evidence — work orders and tasks, checklist answers, and proof of service: photographs of the work or site, customer signatures (captured on a technician's phone or uploaded by a service partner), and other job documents.
• Technicians — each technician's working hours, skills and home country; the company an individual contractor works through, if recorded; and the hourly cost rate your organization enters for them. Recorded absences include their dates, their kind — leave, sickness, training or other — and an optional note.
• Labour, travel and parts — the labour and travel time and the parts recorded against each job by the technician or partner who did it, with costs where known.
• Vehicles in custody — which technician holds which vehicle, from when until when, with the odometer reading at hand-over and at return. If your organization connects a fleet or leasing system, we also store the odometer readings it sends and each vehicle's last reported location, as the text that system provides (for example a street address) with its time. Because the custody record shows who held each vehicle and when, these readings and locations can be related to the technician holding the vehicle at the time.
• Custody notifications to a lessor — if your organization sets up a fleet connection to receive them, each time a vehicle is taken, returned or becomes overdue we send that system the vehicle, the technician's name, the time and the odometer reading.
• Partner portal and compliance documents — the partner portal accounts described in Section 2.1, and documents your service partners upload, or you upload for them, to meet your requirements, such as insurance certificates, certifications and safety-training records, with their reference numbers, issue and expiry dates and review status. For background checks on partner staff, the partner submits an attestation only — who carried out the check, when it was completed and when it expires. The platform does not accept or store the check itself or any criminal-records data.
• Service knowledge — manuals, diagrams and safety sheets attached to a service, shown to whoever does the job.

On the technician's phone. The field app keeps a copy of the technician's own open jobs — each job's details, history and checklist — and their time off, and of the documents for those jobs (up to 25 MB), so that it works without signal. Actions and photos taken offline are queued on the phone — up to 50 MB or 7 days — until they can be sent. The technician can remove everything saved on the phone with "Clear this phone", and it is removed automatically if a different technician signs in on the same phone. The field app does not read the phone's location.

Push notifications. Where push notifications are enabled and a technician allows them, job notifications are delivered through the push service of the technician's browser. Each notification carries only the job's ticket number and time — no customer, site or address — and is encrypted so that the push service cannot read it.

2.3 Usage Data

Our hosting provider (Vercel) collects standard server request logs (timestamps, IP addresses, request paths) for reliability, performance, and security purposes. We do not currently use third-party web analytics or cross-site tracking tools.

2.4 Audit Logs

We maintain audit logs of actions taken within the platform (create, update, delete operations) for security and compliance purposes.

2.5 AI Processing Data

Several features send data to a third-party AI provider to produce a result. What is sent depends on the feature, and for some it is more than a summary:

• Contract Intelligence — the full contents of a contract document you upload are sent to the provider to extract its terms and assess risk. This includes counterparty names, pricing, liability and payment terms.
• Device health and refresh recommendations — asset and device records (model, age, incident and repair history, warranty status, and the name or email address of the person the device is assigned to, where recorded).
• Reporting assistant — your question, and the query results needed to answer it, drawn from your organization's data.
• Operational assistant — your question, and the records its read-only lookups return to answer it: incidents, their deadlines and handovers; partner scorecards (jobs, completions, missed deadlines, jobs handed away); customers' SLA summaries; technician schedules and time off, including the kind of absence (leave, sickness, training or other); job checklists and answers; job costs (labour, travel, parts and the vehicle used); which technician holds which vehicle; and technician hours.
• Partner routing — when a dispatch is set to AI auto-assignment, which a person chooses for that dispatch or sets in a dispatch rule (the default is to offer the job to partners instead): the job's service type and priority, and the top-ranked partner's name with its scoring — reliability from its past job outcomes, current workload, rate and coverage. If the resulting confidence reaches the threshold set in Settings (90% unless changed; 0 means always ask), that partner is assigned without a person approving it.
• Partner sourcing — when shortlisting service partners for a country and service, the candidates' names with scores built from their rates, SLA attainment and job counts; and, when an owner or admin approves a partner's price, the free-text pricing conditions the partner submitted, so the provider can propose structured price terms that take effect only once confirmed.

Whose account the data goes through. Your organization may instead configure its own provider and API key in Settings (Google Gemini, Anthropic, OpenAI, Azure OpenAI, or Amazon Bedrock in the AWS region you choose); data is then sent to your account under your agreement with the provider, and Cevoriq's account is not used.

In either case the provider processes the data on its own infrastructure, which may be outside the United States and outside the region described in Section 9, and under its own terms and privacy policy in addition to this one. AI processing is enabled by default for new organizations and can be disabled at any time in Settings > Compliance; without a provider, the platform uses a built-in rule engine that sends nothing to any third party.

3. How We Use Your Information

• To provide and maintain the Service
• To authenticate users and manage access
• To send service-related notifications (contract expiry, SLA alerts)
• To improve the Service and develop new features
• To respond to support requests
• To comply with legal obligations

4. Data Storage and Security

Your records are stored in a PostgreSQL database; uploaded files are stored in object storage. We employ:

• Encryption in transit (TLS)
• Encryption at rest for the database and for object storage
• Database-enforced tenant isolation — row-level security policies on the tables themselves, so a query that omits its tenant returns nothing rather than everything
• Role-based access control within the platform
• An adversarial test suite against the tenant boundary that runs on every code change and blocks release if any query returns data it should not

Our Security & architecture page describes each of these mechanisms, and states what Cevoriq does not yet claim.

5. Data Sharing

We do not sell your data. The providers below process it on our behalf. For each we state what it receives and where it processes, because a residency statement that names the database but not every other provider is incomplete.

We may also share data:

• With third-party systems you connect — only when your organization configures an integration, and only the data that integration needs. Connectors available today: IT service management (ServiceNow); HR systems (Personio), which send employee names, work email addresses, job title, department, location, manager's name and email, start and leaving dates; device management (Microsoft Intune and Jamf), read only, from which we read each device's serial number, name, enrolment and compliance state and last check-in, and match it to your assets; your vendors' and customers' own systems, through configurable connections for catalogs, availability, orders, order status and returns, and market price feeds; fleet and vehicle leasing systems, with configuration presets for Samsara and Geotab (not yet tested against those providers' live services) or a generic feed, which receive the custody notifications described in Section 2.2; and a service partner's own field-service management system (a ServiceNow Field Service Management preset, also not yet tested against a live instance, or a generic connection), which receives each job you dispatch to that partner, including its title, description and service instructions, the site name and address, the checklist and the scheduled window; and shipping services connected with your organization's own account (rates, labels and parcel tracking; EasyPost today), which receive the sender's and recipient's names, addresses, phone numbers and email addresses and the parcel's weight and size. A system you connect with your own account, including any carrier, shipping service, warehouse or freight provider, acts for your organization under your organization's own agreement with it; it is not our sub-processor (see Sub-processors). Listed in the product but not yet available: Jira Service Management, Zoho Desk, Freshservice and Zendesk (IT service management); Nexthink, ControlUp and Lakeside (digital-experience monitoring); FedEx, UPS and DHL (shipping carriers). Data flows to a connected system only after you supply its credentials.
• Legal requirements — If required by law, court order, or governmental authority

6. Data Retention

We retain your data for as long as your account is active. We do not currently operate automated, retention-schedule-based deletion: data is retained until you or your organization requests its deletion, or until your account is terminated and we delete it. Configurable, automatically enforced retention periods are on our roadmap, and we will update this policy before they take effect.

You can request deletion at any time as described in Section 7, and organization Owners and Admins can erase an individual data subject's personal data at any time from Settings > Compliance.

Deleting an entire organization follows a defined sequence rather than taking effect immediately: the organization is locked at once, there is a 90-day window in which the deletion can be cancelled, and permanent deletion is then carried out deliberately by our team rather than on an automatic timer. The one exception is an evaluation organization that was set up with an automatic deletion period: once its evaluation has ended and that period has passed, it is deleted automatically, without the 90-day window, unless a legal hold applies. Encrypted backups are never edited after the fact, so deleted data persists in them until those snapshots expire — at most 30 days for daily and 12 months for monthly snapshots — and any deletion requested in the meantime is re-applied if we ever restore from one. A limited set of business records (ledger, contracts, invoices, audit trail) is kept for up to seven years to meet accounting and legal obligations. Legal holds override every step. The full sequence, including which parts are enforced today and which are still being built, is set out in Data Residency, section 12.

7. Your Rights

You have the right to:

• Access your data through the platform or by requesting an export
• Correct inaccurate data
• Request deletion of your account and associated data by contacting privacy@cevoriq.com
• Export your data in CSV format
• Object to processing of your data for specific purposes

8. Cookies

We use essential cookies for authentication and session management on the platform itself. We do not currently use tracking or advertising cookies. You can control cookie preferences through your browser settings.

9. International Data Transfers

Cevoriq operates in US East (Virginia) and EU Central (Frankfurt). Your platform records and uploaded files are stored in the single region chosen when your organization was created, and are not stored in any other region. Which one that is, is shown in Settings > Compliance.

A region preference recorded in Settings does not move data that already exists; changing where an organization’s data is stored is a migration, not a setting. We will update this policy before any further region opens.

That statement covers storage, not every provider. Several categories of processing are not bound by it and are listed with their locations in Section 5: application compute (Vercel), which runs in the United States for every region; identity and sign-in (Clerk), email delivery (Resend), and AI processing (Section 2.5), where the provider may process data outside the United States; and push notifications to technicians' phones. A security review that needs the full processing chain should read Section 5 together with this section.

Our Data Residency page sets out our region strategy, which categories of data are held in your region and which are held globally, and the status of each planned region. Roadmap items described there are not commitments — see section 8 of our Terms of Service.

Where your organization’s region is outside your own country, using the Service involves transferring your data to that region. If your organization requires specific transfer safeguards or a Data Processing Agreement, contact legal@cevoriq.com.

10. GDPR & Data Processing Agreements

Organizations with EU data subjects can enable GDPR mode in Settings > Compliance, which lets you record a Data Controller and Data Protection Officer contact for your organization. If your organization requires a signed Data Processing Agreement, contact legal@cevoriq.com.

11. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. The "Last updated" date at the top indicates when the policy was last revised.

13. Contact Us

For privacy-related questions or requests, contact us at privacy@cevoriq.com.