Privacy Policy

This Privacy Policy explains how Oil To Go, LLC, an Iowa limited liability company doing business as Mobile Service Sync ("Mobile Service Sync," "we," "us," or "our"), collects, uses, shares, and protects information in connection with the Mobile Service Sync hosted CRM application, related APIs, mobile applications, customer-facing portals, and any other software or services we make available under the Mobile Service Sync brand (collectively, the "Service").

This Policy is part of, and incorporated into, our End User License Agreement (the "EULA"). Capitalized terms used but not defined here have the meanings given in the EULA. A separate privacy notice covering our public marketing website and pre-launch waitlist is available at mobileservicesync.com/privacy.

Mobile Service Sync plays two different roles depending on the data involved.

• Account data (we are the controller). For information about the businesses that subscribe to the Service and their Authorized Users - such as account registration details, billing information, and how Authorized Users interact with the Service - we determine the purposes and means of processing and act as the controller.
• Customer Data (we are the processor). For the Customer Data that you and your Authorized Users submit to or generate through the Service - including records about your end customers - we act as a service provider and processor on your behalf. You are the controller of that data. You are responsible for having a lawful basis to collect it, for giving your end customers any privacy notices the law requires, and for obtaining any consents needed (for example, for SMS messaging, geolocation, or photos). We process Customer Data only as described in the EULA and on your documented instructions.

We collect the following categories of information:

• Account and Authorized User information. Name, business name, email address, mobile phone number, role, and authentication credentials. Sign-in and identity are handled by our authentication provider, Clerk; we do not store your password.
• Customer Data. Information you, your Authorized Users, or your end customers submit to or generate through the Service, including customer records, vehicles, work orders, estimates, invoices, photos, notes, and contact details.
• Payment information. Subscription billing is processed by Stripe, and your customers’ card and bank payments (where you use Sync Pay) are processed by Rainforest. We do not store full payment card numbers; we retain limited details such as the last four digits, card brand, and transaction status.
• Location data. When you enable location features, we collect geolocation from Authorized Users’ devices to power dispatch, routing, on-the-way alerts, and arrival estimates. See Section 6.
• Communications data. SMS and email opt-in status, the date and source of any consent, and message metadata and delivery status for messages sent through Twilio (SMS) and Resend (email).
• Device, log, and usage data. IP address, browser and device identifiers, pages and features used, timestamps, and diagnostic and error logs. We use cookies and similar technologies as described in Section 10.

We use information to:

• provide, operate, maintain, secure, and improve the Service;
• authenticate Authorized Users and protect accounts;
• process subscription billing and, where enabled, customer payments;
• send transactional communications about your account, including service notices, billing reminders, security alerts, and support messages;
• send product updates and marketing messages where you have opted in, and let you opt out at any time;
• power location-based features such as dispatch, routing, and arrival estimates when enabled;
• detect, prevent, and respond to fraud, abuse, security incidents, and technical problems; and
• comply with legal obligations and enforce our agreements.

We may generate de-identified, aggregated statistics from use of the Service (for example, average jobs per truck, route density, or feature-usage metrics) and use them for any lawful purpose, including improving the Service. Aggregated data does not identify you, any Authorized User, or any end customer.

By creating an account, you agree to receive transactional electronic communications from us about your account, including service notices, billing reminders, security alerts, and support messages. You may also opt in to receive product updates and marketing messages by email or SMS.

• Message frequency: Varies depending on your account activity and the features you use.
• Message and data rates: May apply. Charges are billed by and payable to your mobile service provider.
• Opt out: Reply STOP to any marketing message to unsubscribe, or click the unsubscribe link in a marketing email. Reply HELP for help, or email support@mobileservicesync.com.
• Carriers: Carriers are not liable for delayed or undelivered messages.

Consent to receive marketing SMS messages is not a condition of purchasing or using the Service.

Messages your Authorized Users send through the Service to your end customers (such as appointment reminders, on-the-way alerts, or marketing campaigns) are sent on your behalf. As described in the EULA, you are the "sender" for purposes of the Telephone Consumer Protection Act (TCPA), the CAN-SPAM Act, and similar laws, and you are responsible for obtaining and retaining documented consent from each recipient and for honoring opt-out requests promptly.

When location features are enabled, the Service collects geolocation from an Authorized User's device - including in the background while the mobile app is in use for dispatch - to support routing, on-the-way alerts, arrival estimates, and visit verification. Location collection depends on the device permission you and your Authorized Users grant, and it can be turned off through device settings or by disabling the related features, though doing so may limit dispatch and routing functionality. Mapping and geocoding are powered by Mapbox.

The Service lets Authorized Users capture and upload photos and other media (for example, of a vehicle, a job site, or completed work) as part of Customer Data. Photos may contain metadata such as the time taken and, depending on device settings, embedded location coordinates. You are responsible for ensuring you have the right to capture and upload any media and for obtaining any consent required from the people or property depicted.

We do not sell personal information. We share information only as described below:

• Service providers and subprocessors. Vendors that process data on our behalf under contractual confidentiality and data-protection obligations, including Clerk (authentication), Twilio (SMS), Resend (transactional email), QuickBooks Online (accounting synchronization), Rainforest (customer card and bank payments), Stripe (subscription billing), and Mapbox (maps and geocoding), along with our hosting and database infrastructure providers. Use of a third-party service is also governed by that provider’s own terms and privacy policy.
• At your direction. We share Customer Data as you instruct through the Service - for example, when you send an SMS or email to an end customer, sync an invoice to QuickBooks, or take a customer payment.
• Legal requirements. When we believe disclosure is required to comply with a law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of any person.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

Mobile information sharingNo mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All categories above exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties.

The Service is operated in the United States, and the information we collect is processed and stored in the United States and in other countries where our service providers operate. Those countries may have data-protection laws that differ from those of your jurisdiction. Where required, we rely on appropriate safeguards for cross-border transfers.

The Service uses first-party cookies and similar technologies for sign-in sessions, security, and preferences. We may use privacy-respecting analytics to understand aggregate usage and improve the Service. We do not use third-party advertising cookies.

We retain account data for as long as your account is active and as needed to provide the Service, and we retain certain records as required by law (for example, tax and transaction records). We retain Customer Data on your behalf for the duration of your subscription. As described in the EULA, after termination we make Customer Data available for export for thirty (30) days on request, after which we may delete it from active systems, although residual copies may persist in backups for up to ninety (90) days before being overwritten.

We implement reasonable administrative, physical, and technical safeguards designed to protect information, including encryption in transit, encryption at rest for sensitive credentials, access controls, and routine backups. No method of transmission or storage is perfectly secure, however, and we cannot guarantee absolute security. You are responsible for the security of your Authorized Users' devices and credentials. Report any suspected unauthorized access to security@mobileservicesync.com.

Authorized Users can review and update their account information in the Service, and can opt out of marketing communications as described in Section 5. Depending on where you live, you may have rights to access, correct, delete, or port the personal information we hold about you as a controller, and to object to or restrict certain processing. To exercise these rights, email privacy@mobileservicesync.com.

If you are an end customer of a business that uses the Service and you want to access, correct, or delete information held about you, please contact that business directly. Because we process end-customer data as a processor on the business's behalf, we will refer your request to the relevant business and assist them in responding.

The Service is intended for use by businesses and is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date above. If a change is material, we will provide additional notice - such as by email or in-app notice - and, where the change affects the agreements bound at sign-up, may require re-acceptance before it takes effect.

Questions about this Privacy Policy? Email privacy@mobileservicesync.com or write to Oil To Go, LLC dba Mobile Service Sync, Linn County, Iowa.