Privacy Policy

1. Introduction

iTenance ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our maintenance management system.

2. Information We Collect

We collect the following types of information:

• Personal Information: Name, email address, phone number
• Account Information: Username, password (encrypted), role, and preferences
• Work Information: Group assignment, shift schedule, machine assignments, hourly rate
• Usage Data: IP address, browser type, access times, and pages viewed
• Session Data: Login sessions, authentication tokens
• Billing Information: Company name, billing address, tax number, and subscription history. Card details are entered directly with our payment processor and never reach our servers.

3. How We Use Your Information

We use the collected information for:

• Providing and maintaining our service
• Managing your account and authentication
• Assigning and tracking maintenance tasks and work orders
• Sending notifications about work assignments and updates
• Analyzing usage patterns to improve our service
• Ensuring security and preventing fraud
• Complying with legal obligations

4. AI Processing

Some features of the service are powered by AI. We describe this separately because it is the only processing that sends the content of your records to a provider outside the European Union.

• Who processes it: Google, through the Gemini API on a paid commercial plan. Google acts as our processor and only on our instructions.
• What is sent: Only the context needed for a single request — for example a machine name, a fault description, or recent work order history. Where a feature reads an uploaded photograph, that image is sent for that one request. We never transmit your database, user list, or files in bulk.
• Not used for training: Under Google's terms for the paid Gemini API, prompts and responses submitted through it are not used to train or improve their models.
• Legal basis: Processing is carried out to perform our contract with your organisation. Transfers outside the EU rely on the European Commission's Standard Contractual Clauses.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information with:

• Within Your Organization: Other users in your tenant can see your name, role, and work-related information
• Service Providers: A named set of processors who act only on our instructions: Laravel Cloud (hosting and storage, Frankfurt), Cloudflare (edge network and DNS), Google (AI processing), Pusher (real-time updates), Mailgun (transactional email), and Stripe (subscription payments). The current list is published in full on our Security page.
• Legal Requirements: When required by law or to protect our rights

6. Your GDPR Rights

Under GDPR, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing of your personal data
• Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, please contact your system administrator or use the data export and account deletion features in your profile settings.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of passwords and sensitive data
• Secure HTTPS connections
• Regular security updates and monitoring
• Access controls and authentication
• Multi-tenant data isolation

8. Data Retention

We retain your personal data only as long as necessary for the purposes set out in this Privacy Policy, or as required by law. When you delete your account, we will either delete or anonymize your data within 30 days, unless we are required to retain it for legal purposes.

9. Cookies and Tracking

We use essential cookies for authentication and session management. For more information, please see our Cookie Policy.

10. International Data Transfers

Your records are stored on servers in Frankfurt, Germany, and stay within the European Union. Two transfers leave the EU and we name them rather than describing them in general terms: traffic to the platform passes through Cloudflare's global edge network, which handles connection metadata such as your IP address; and AI features transmit the content of an individual request to Google, as described in section 4. Both transfers rely on the European Commission's Standard Contractual Clauses.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

12. Contact Us

For questions about your own account and who in your organisation can see your records, contact your system administrator — they control access within your tenant. For questions about this policy, a Data Processing Agreement, or to exercise the rights described above, write to us at support@itenance.com.