Privacy policy

Who this policy covers

Contactor — HVAC Portal is provided by DECODATION LLC. This policy covers the Contactor app and its connected services. Questions or requests about personal information can be sent to support@decodation.com.

Information used by the app

• Account and profile: account identifiers, email, name, phone number, company, profile photo, and professional information that you provide, including license information. Firebase Authentication and optional Apple or Google sign-in support account access.
• Supplier information: business name, contact details, address, map coordinates, description, photos, promotions and refrigerant prices. Information submitted to a supplier listing can be visible to other app users.
• Bookings and community: booking requests and updates, the supplier or technician involved, messages, forum topics, replies and associated author information. A booking requires sharing the relevant request with its participants. Forum contributions and their author information are visible to other members.
• Field work: equipment manufacturer, model, serial number, site label, photos, service visits, readings, notes, parts, checklists and reports that you choose to save. Some records are stored on your device; equipment and connected service records can be stored in your account on our servers. Reports can be exported or shared when you choose to do so.
• AI requests: text submitted for AI assistance, drafts, manual searches and related context described below. Do not include customer personal information, passwords or secrets.
• Purchases: account and purchase identifiers, selected plan, transaction or entitlement status, and verification information needed to provide paid access. Apple, Google Play and RevenueCat process relevant purchase data. Stripe can process card and checkout data through its checkout or payment SDK, including the native payment-sheet paths included in the app. Contactor does not store full card details in its own database; payment details are processed by the payment provider. Purchase history and account-linked RevenueCat data support functionality and purchase analytics.
• Device and service operation: notification tokens, device or installation identifiers, platform and app information, interaction events, performance information, IP addresses and technical logs processed by the app or service providers. Firebase Analytics events in the current app include your Firebase account identifier. Firebase Performance measures service performance; Maps can process crash and operational metrics. Included SDKs may process advertising identifiers according to their platform permissions and configuration. These records support app operation, diagnostics and usage measurement. The current app does not provide a dedicated in-app analytics opt-out.

Avoid storing sensitive customer information in a site label, note, photo or public post. Where the app permits sharing or export, recipients receive the information you include.

Why information is used

Information is used to authenticate accounts; show suppliers and prices; operate bookings, profiles and community features; save field records; deliver requested notifications; provide AI and document assistance; verify paid access; measure app usage and performance; prevent misuse; and answer support requests.

AI assistance and OpenAI

When you agree to the AI notice and send a question, the current question and up to three previous exchanges are sent to OpenAI through the Contactor server. A diagnostic snapshot or other text you include is part of that request. Manual search sends the submitted manufacturer, model and search context; its provider may use web search to find manufacturer documents. AI draft tools send the text you ask them to process.

The current server requests store: false for its OpenAI Responses calls and sends a hashed account identifier for safety and usage controls. This setting does not mean zero retention. OpenAI may retain API data for abuse monitoring, ordinarily for up to 30 days under its published API data policy, with applicable exceptions. See OpenAI API data controls.

Support chat history and drafts are saved for the current account in protected storage on that device. You can delete exchanges or start a new chat. Those actions do not erase copies already processed by a provider. Contactor keeps request identifiers, content hashes and usage receipts for duplicate prevention and usage accounting; this is different from a server archive of full support conversations. AI answers can be wrong and must be reviewed.

Permissions and your choices

• Location: used for nearby suppliers, distances, maps and location-based features when permission is granted. Business coordinates or locations you submit to a listing may be stored and displayed. Location permission can be revoked in device settings; location-based features may then be unavailable. The policy does not require location permission for every feature.
• Camera and photos: used when you choose to add a profile, listing, promotion or equipment image. You can decline or revoke device permissions.
• Notifications: used for relevant booking and message updates. Notification delivery records can include account/sender references, sender name, message excerpts and device tokens. You can disable them in device settings. A notification preview can show sender or booking information on the lock screen; adjust preview settings if your device is shared.

You can stop sending new AI requests, edit information through available app controls, remove local records through their controls, and request access, correction or deletion by contacting support@decodation.com. We may need to verify that a request relates to your account, without asking for your password.

Service providers and disclosure

Contactor uses Google/Firebase for authentication, database and cloud storage, analytics, performance and messaging; Supabase for supplier, promotion and support records; Google Maps for map features; OpenAI for requested AI processing; RevenueCat and the app stores for purchase verification; and Stripe for payment processing in supported checkout flows. Website checkout uses Stripe, and the app bundle also includes Stripe payment SDK paths. Providers process the information needed for their service. Their service locations may differ from yours. Their policies include Google, Supabase, OpenAI, RevenueCat and Stripe.

Information that you post publicly, send to a booking participant, export or share is also disclosed to that recipient. We may disclose information where required by law or to address security, fraud or misuse. Provider contracts and regional privacy obligations must be considered when processing requests.

Handling and current limitations

The app uses HTTPS for its connected services and account-based controls for supported private server operations. Local protected storage is used for saved chat and field data. No security system can guarantee absolute protection.

Contactor includes legacy supplier, support and forum data paths whose access controls and account-cleanup behavior are being revised. In particular, information in a legacy forum author profile can be accessible to other signed-in members. Do not put confidential information in these profiles, public listings or messages. This policy does not represent that every legacy record is private or that the pending security work is complete.

Retention and account deletion

Local chat and field records remain until removed through their controls, app/device data is cleared, or otherwise removed by the device. Server profiles, listings, forum records, booking history, support records, equipment records, usage receipts and payment records can have different retention behavior. There is currently no single published automatic deletion period covering all these records.

Deleting the sign-in account alone does not currently establish that all linked records have been removed. Some legacy profiles, forum, booking or shared-database records can remain and require review. Request account and associated-data deletion through the deletion page or support@decodation.com; identify the account email and requested scope. We will assess which records can be removed or anonymized and explain any retention needed for legal, transaction, security or fraud-prevention purposes. No fixed completion deadline or blanket retention exemption is promised by this document.

Deleting an account does not, by itself, confirm cancellation of an App Store or Google Play subscription. Manage renewal with the provider described on the deletion page. Provider transaction and legally required records may be handled under their own requirements.

Audience and changes

Contactor is an HVAC field-work and learning application, not a service directed to young children. If you believe a child provided personal information, contact support@decodation.com. This policy may be updated as data practices change. The dated version is available on this page.