Privacy Policy

How we collect, use, share, and protect personal information.

Last updated: 26 September 2026

1. Who we are and how to reach us

Service Centinel is a field-operations and project-management platform for commercial office-furniture dealers, installers, and service providers. It is operated by Centinel Technologies LLC, a limited liability company registered in the State of Arizona, with its registered address at 1502 E Hadley St, Suite 150, Phoenix, AZ 85034.

Privacy questions: [email protected]. Security reports: [email protected].

2. Two different roles we play

This distinction determines who you should contact about your information.

We are the controller for information about visitors to our website and people who join our waitlist. We decide why and how that information is used, and this policy governs it directly.

We are a processor for information inside a customer's account. When a furniture dealer or installation company uses Service Centinel to run its operations, that company decides what to put in, how long to keep it, and who may see it. We handle it on their instructions. That includes information about their employees, their clients, and their clients' sites.

3. What we collect

Information you give us directly (we are the controller)

• Waitlist and enquiries: email address, name, company name, job role, and a free-text description of your intended use.
• Support tickets: the subject, description, category, and priority you submit, plus your name, email, and role.

When you submit the waitlist form, we record your name, email, company, role, any optional notes, and when you agreed to be contacted about access. We also record your browser user-agent string and the referring website’s origin (not its path or query string). We store your submission in Supabase and send an internal notification to our team through Resend. Cloudflare Turnstile verifies the submission to help prevent spam. Abuse-prevention counters use keyed hashes rather than raw email or IP addresses.

Account information (we are a processor)

• Identity and access: name, email address, initials, assigned role, employing company, work location, account status, and whether two-factor authentication is enabled. Passwords are handled by our authentication provider and we never see or store them.
• Operational records: service requests, quotes and estimates, change orders, schedules, dispatch assignments, warehouse and receiving records, damage reports, punch items, and support tickets.
• Client and site information entered by our customer: client company names, contact names, phone numbers, email addresses, and job-site addresses.
• Field reports: daily reports including crew composition, arrival and departure times, break minutes, hours worked, percentage complete, itemised scope, issues observed, extra work, and site condition.
• Photographs of job sites, deliveries, and damage, uploaded from phones and tablets. Images are resized and compressed in the browser before upload.
• Signatures: client sign-off signatures captured on completion of work.
• Labour and pay-related data: hours worked per employee per day and job, overtime, role category, and hourly rates where the customer records them.
• Precise location data — see section 4, which explains this separately because of its sensitivity.
• Audit records: an append-only log of significant actions, including who performed them and when. This log is deliberately preserved for accountability, and is not erased by a deletion request.

Information collected automatically

• Technical and diagnostic data: browser type, device type, approximate region derived from IP address, error reports, and performance timings.
• Local storage on your device: we store your session, unsent daily-report drafts, queued offline changes, and interface preferences in your browser. Cached operational data is stored separately and erased when you sign out. We do not use advertising cookies or third-party tracking pixels.

4. Employee location data

Where a customer enables the GPS check-in feature, Service Centinel records the following each time a field worker checks in or out of a job:

• latitude and longitude, with an accuracy radius in metres
• the exact timestamp of the check-in or check-out
• the identity of the worker and the job they were working on

This is precise geolocation tied to an identified individual. Several laws treat it as a sensitive category, and some jurisdictions require employers to give notice before tracking employee location.

Separately, we convert job-site addresses into map coordinates so sites can be shown on a map and routed between. That relates to the site, not to a person.

5. Artificial intelligence processing

Service Centinel uses AI to summarise daily reports, extract line items from vendor documents, assist with estimating, and answer questions in the in-app assistant.

This means operational content leaves our systems and is sent to our AI provider, Anthropic, for processing. Depending on the feature, that content can include: daily report text, issues and extra work noted by crews, scope descriptions, hours and completion percentages, service request details, client names, and financial figures such as quoted amounts and margins.

• Requests are sent from our servers, so our AI credentials are never exposed to your browser.
• We do not send passwords, authentication tokens, or payment details to the AI provider.
• Content sent to Anthropic through its commercial API is not used to train its models.
• AI output is assistive. It can be wrong, and it does not make decisions on its own — quotes, change orders, and approvals all require a person to act.
• A company administrator can disable the AI features for their whole organisation.

6. How we use information

• To provide the platform and its features to the customer that owns the account.
• To authenticate users, enforce role-based permissions, and keep accounts secure.
• To send operational notifications — status changes, approvals needed, dispatch details.
• To generate documents such as quotes, change orders, closeout packages, and reports.
• To maintain audit logs for accountability and dispute resolution.
• To detect, investigate, and prevent abuse, fraud, and security incidents.
• To diagnose faults and improve reliability and performance.
• To respond to waitlist enquiries and support requests.
• To comply with legal obligations and to establish or defend legal claims.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

7. Legal bases (UK/EU)

Where the UK GDPR or EU GDPR applies, we rely on: performance of a contract for providing the service; legitimate interests for security, abuse prevention, service improvement, and responding to enquiries; consent where we ask for it, such as device location — which you may withdraw at any time; and legal obligation where retention or disclosure is required by law. Where we act as a processor, our customer determines the legal basis.

8. Who we share it with

We share personal information with the service providers below, each of which processes it on our behalf under contract. We do not sell personal information to anyone.

We may also disclose information where required by law, to enforce our terms, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets — in which case we will give notice before your information becomes subject to a different policy.

We will keep this list current. If we add a provider that handles personal information, we will update this page.

9. How long we keep it

• Account and operational data: for as long as the customer's account is active. On termination, data is deleted or returned in line with the customer's agreement.
• Waitlist enquiries: until you ask us to remove them, or 24 months after our last contact, whichever comes first.
• Audit logs: retained for accountability, including after a related record is deleted, for 24 months.
• Support session change records: when Service Centinel support makes a change inside a customer's account during a support session, the values before and after that change are kept for 90 days, so the change can be reviewed or undone, and are deleted with the account. A record that the change was made (which field, by whom, when) is kept in the audit logs.
• Company administrator handover records: who offered a company's administration to whom, and whether it was accepted, declined, cancelled or completed, for 24 months after the offer is resolved.
• Disaster-recovery archive of a deleted account: immediately before a customer's account is permanently deleted, we copy its data and uploaded files into private storage that only Service Centinel's platform administrators can reach. The copy exists only so that an account deleted in error can be restored. The customer cannot access it, it is not used for any other purpose, and it is deleted 90 days after it is made.
• Financial and labour records: retained as long as needed for tax, employment, and accounting obligations, typically 7 years.
• Backups: deleted data persists in encrypted backups for a limited period before being overwritten on the ordinary backup cycle.

10. Your rights and how to exercise them

Depending on where you live, you may have the right to access your information, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent. You will not be treated differently for exercising these rights.

Service Centinel has these tools built in, under Settings → Data & Privacy:

• Export my data downloads a machine-readable file of the information associated with your account, including your profile, service requests, field reports, labour entries, change orders, support tickets, and audit history.
• Request data deletion submits a request to your company administrator. On approval, your profile is pseudonymised, your name is replaced on reports and labour records, and your GPS location history is deleted.

To make a request directly, email [email protected]. We will respond within the period the applicable law requires, and we may need to verify your identity first. If your information is in a customer's account, we will refer you to that customer.

If you are in the UK or EU and are unhappy with our response, you may complain to your local supervisory authority.

11. California privacy rights

In the past twelve months we have collected the categories of personal information described in section 3: identifiers, customer records, commercial information, internet activity, precise geolocation, employment information, and audio, electronic, or visual information such as photographs and signatures. The sources, purposes, and recipients are set out in sections 3, 6, and 8.

We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the past twelve months.

California residents may request to know, delete, or correct their personal information, and may limit the use of sensitive personal information. We use sensitive personal information (precise geolocation) only to provide the service — verifying that crews arrived at the right job site and recording time on site — and not to infer characteristics about anyone. You may use an authorised agent to make a request.

12. How we protect information

• Encryption in transit using current TLS, with HTTP Strict Transport Security enforced.
• Encryption at rest for the database, file storage, and backups.
• Database-level tenant isolation, so one company's data cannot be read by another.
• Role-based access control, with permissions enforced on the server rather than only hidden in the interface.
• Private file storage — job photos and signatures are reachable only through short-lived signed links, never public URLs.
• Optional two-factor authentication, and single sign-on with Google or Microsoft.
• An append-only audit log of significant actions.
• A strict content security policy and a full set of browser security headers.
• Automated secret scanning and dependency checks in our build pipeline.

No system is perfectly secure. If you believe you have found a vulnerability, please write to [email protected] — we welcome good-faith reports and will not pursue researchers who follow responsible disclosure.

13. International transfers

We and our providers operate in the United States, and information may be transferred there and to other countries where our providers operate. Where we transfer personal information out of the UK or EEA, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK Addendum.

14. Children

Service Centinel is a workplace tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with information, contact us and we will delete it.

15. Changes to this policy

We will update this page when our practices change, and revise the date at the top. If a change materially affects your rights, we will give prominent notice — by email or in the application — before it takes effect.