Privacy Policy

StringBean is a tool your employer uses to run buildings. Most of what it holds is about work: a job, a photo of a cracked hinge, the time somebody arrived. Some of it is about you, because a record of work is not worth much if it cannot say who did it.

We do not sell any of it. We do not advertise. We do not track you across other apps.

Because you signed in. Your name, your email address, the organisation you belong to and what you are allowed to do in it. This comes from you or from whoever invited you.

Because you did the work. The jobs you are given, what you answered on them, the notes you wrote, the photos and files you added, and the messages you sent to colleagues about a job.

Where you were. When you start and finish a job, the app reads your location once, so the record can show the work was done at the building. It is read only at those moments. It is never read in the background, and never when the app is closed. You can refuse, and the rest of the app keeps working.

What you said out loud. If you record a spoken note, the phone turns it into text. We keep the text with the job.

How the app behaved. Crashes, and which screens get used. This is to find what is broken. It is not linked to advertising and it never leaves our systems.

• To run the service your organisation asked for: showing you your work and recording that you did it.
• To keep the record your organisation may be legally required to keep about its buildings.
• To keep the service secure and working.
• Because you agreed, for the camera, the microphone and your location. Each of those asks first and each can be refused.

Your colleagues. People in your organisation see the work you record. That is the purpose of the product. Managers see more than technicians.

Companies that run it for us. We use Supabase to store the data and Vercel to run the website, and a model provider to answer the assistant when somebody asks it something. They act on our instructions only. Each is under a written contract that requires them to protect your data to the same standard this policy sets, and none of them may use it for anything of their own.

Nobody else. We do not sell or rent personal information, and we do not share it with advertisers. If we are ever legally compelled to hand something over, we will tell the account holder unless we are forbidden from doing so.

Data is stored on servers in the United States. If you are outside the United States, using StringBean means your information is transferred there and handled under this policy.

Records of work are kept for as long as your organisation keeps its account, because that record is the thing it is paying for. When an organisation leaves, we make its data available to export and then delete it within 90 days.

If you delete your own account, we remove your name, your email address and your sign-in within 30 days. Work you did stays in the record, because your organisation may be required to keep it and because removing it would make the record dishonest. It is no longer connected to a name.

Crash and usage statistics are kept for 12 months.

You can turn off the camera, the microphone and location in your phone's settings at any time, and the rest of the app carries on.

You can delete your account from inside the app, under your profile, or from the deletion page without installing anything. Both do the same thing.

Depending on where you live you may also have the right to ask for a copy of what we hold, to correct it, to object to us holding it, or to complain to a regulator. Write to privacy@stringbean.tech and we will answer within 30 days.

StringBean is a tool for people at work. It is not for children, it is not directed at them, and we do not knowingly collect anything from anybody under 16. If you think we have, write to us and we will remove it.

Everything travels encrypted and is stored encrypted. Access is decided row by row in the database, so one company cannot read another's work even if something else goes wrong. If we ever have a breach that puts you at risk, we will tell affected account holders and the relevant regulator as the law requires.

If we change this policy in a way that matters, we will tell account holders before it takes effect and change the date at the top.