Privacy Policy

This policy covers two kinds of accounts:

• Provider accounts — the business owner and their team (workers, branch managers, account managers) who use Sebafy to run jobs, invoicing, and dispatch.
• Customer accounts — the end customers of a provider, who use Sebafy to view their job history and, optionally, set up a customer wallet.

• Account information — name, phone number, and (for provider accounts) email address and a hashed password. Customer accounts log in by phone number; a password is only created if the customer chooses to set one up for their wallet.
• Business data a provider enters — job records, service descriptions, prices, invoices, notes, and the name, phone number, and address of their customers.
• Payment amounts, not payment details — Sebafy does not process payments. Providers log the amounts they've collected (cash, bank transfer, or a manual payment link they configure themselves, e.g. Zelle or Venmo). We never see or store card numbers, bank credentials, or other payment instrument data.
• Photos you choose to upload — e.g. job-completion photos or a customer's signature, which a provider's team may attach to a job record.
• Technician location, while on an active job — see Section 4 below for exactly when, how often, and who can see it.
• Usage data — we use privacy-focused, cookie-free page analytics (Vercel Analytics) to understand aggregate traffic to this site. It does not track you across other sites.

• To operate the core product — job dispatch, scheduling, invoicing, and the customer-facing booking page.
• To show a customer their technician's live position on the way to an active job (Section 4).
• To send account and notification emails — one-time login and password-reset codes, appointment updates, and quote, job, and service-agreement notifications — via our email provider, Brevo. Sebafy does not send marketing email, and every notification email has a one-click unsubscribe link.
• To send optional browser push notifications (for example, an appointment reminder) to people who have turned them on for their device. Sebafy does not currently send SMS/text messages.
• To keep the service secure — session cookies that keep you logged in, and fraud/abuse prevention.
• We do not sell personal data, and we do not use your data to train third-party AI models.

This section applies only to technician (worker) accounts — provider owners/managers and customers do not have their location collected by Sebafy.

• When it's collected — only while a technician has a job in progress that's assigned to them. Sebafy does not collect a technician's location outside of an active job, and never tracks a technician's location on their personal time.
• How often — a fresh GPS reading roughly every 60 seconds by default (the provider can adjust this, between 20 seconds and 5 minutes), for as long as that job stays in progress.
• What's stored — only the technician's most recent position. Each new reading overwrites the last one; Sebafy does not keep a location history or travel trail for a technician.
• Who can see it — the provider's own dispatch team (for scheduling and support), and the specific customer whose active job it is, for as long as that job stays in progress, via a private, time-limited tracking link. No one else — not other customers, not other providers — can see a technician's location.
• Your control over it — a technician can turn automatic location-sharing off at any time from their own dashboard ("Auto-share while on a job"), and can always see whether it's currently on. Turning it off may make it harder for your dispatcher or customers to know when you'll arrive.

A customer's job history and contact details are only visible to the specific provider(s) that customer has actually done business with — not to every business on Sebafy. Within a provider's account, access to customer and financial data is limited to that provider's own team, based on their role (owner, branch manager, account manager, or technician).

We share data with a small number of infrastructure and communication vendors strictly to run the service: our hosting provider (Vercel), our database infrastructure, and our email provider (Brevo). These vendors process data only on our behalf and under their own confidentiality and security obligations — we do not permit them to use it for their own purposes.

We use a small number of essential session cookies (one per account type — provider, customer, and referral partner) that keep you signed in. These are functional, not advertising or cross-site tracking cookies. We do not use third-party ad-tracking cookies. Our Cookie Policy lists each cookie, what it does, and how long it lasts.

We keep account and job data for as long as the account is active, so providers retain their business records. A provider can export their data (jobs, invoices, customer records) as CSV or PDF at any time. To request deletion of your account or personal data, contact us using the details below — we will act on the request, subject to any records we're legally required to retain.

We take specific, real measures to protect your data — not just a general promise:

• Each provider's data is isolated from every other provider's at the database level, on every request — not just hidden by the interface.
• Passwords are never stored in plain text — they're hashed with a salted, memory-hard algorithm, and an account is temporarily locked after repeated failed login attempts.
• Every link we send you to review or approve something (a quote, a service agreement, a live tracking page) is a cryptographically signed, time-limited token tied to that exact record — not a guessable web address.
• Access to production data is limited to the people who need it to operate the service.

No system is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify affected users as required by applicable law.

Sebafy is a business tool and is not directed at, or knowingly used by, children under 16.

We may update this policy as the product changes. We'll update the effective date above when we do. Material changes will be communicated to provider accounts directly.

Questions about this policy or a request about your data? Reach us at [email protected] or WhatsApp.