Privacy Policy

This Privacy Policy explains how D&S Tech LLC (“D&S Tech,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with the MEPSub platform and the website at mepsub.org (together, the “Service”). MEPSub and the MEPSub logo are trademarks of D&S Tech LLC.

1.Scope of this policy

This policy applies to information we process when you visit our website, create or use a MEPSub account or workspace, or otherwise interact with the Service. It does not apply to third-party websites, applications, or services that we do not control, even if they link to or from the Service.

If you use MEPSub as an employee, contractor, or member of an organization that has its own MEPSub workspace (your “Workspace Administrator”), that organization controls the workspace and its data, and its own privacy practices may also apply to you.

2.Our role: controller and processor

Depending on the data, we act in one of two roles:

• Controller. For account registration data, billing information, website usage, and communications with us, D&S Tech is the controller and this policy governs how we handle that data.
• Processor. For the content you and your team put into a workspace — including information about your customers, sites, equipment, jobs, invoices, and documents (“Customer Data”) — we act as a processor on behalf of your organization. Your organization is the controller of that Customer Data and is responsible for having a lawful basis to collect and use it. We process it under your instructions and our Terms of Service.

3.Information we collect

Information you provide

• Account & profile data: name, email address, phone number, password (stored only as a hash), workspace name, role, and company details.
• Access requests: if you request access, the name, email, company, phone, and message you submit.
• Customer Data: the records you enter or upload — customers, sites, equipment, appointments, work orders, estimates, invoices, projects, files, photos, and related notes.
• Billing data: if a paid plan applies, billing contact details. Card and bank details are collected and stored by our payment processors, not by us.
• Communications: messages you send us (support, sales, email) and content of in-app messages you choose to send.

Information we collect automatically

• Usage & device data: log data such as IP address, browser and device type, pages viewed, actions taken, and timestamps.
• Essential cookies: a session cookie to keep you signed in and secure the Service (see §7).

We do not sell personal information, and we do not use third-party advertising trackers on the Service.

4.How we use information

• Provide, operate, secure, and maintain the Service and your workspace.
• Authenticate users and prevent fraud, abuse, and unauthorized access.
• Process transactions and send transactional messages (e.g., invoices, appointment reminders, password resets) by email and, where enabled, SMS.
• Respond to your requests and provide customer support.
• Understand usage to improve features, reliability, and performance.
• Comply with legal obligations and enforce our Terms of Service.

Where we use optional AI features, your prompts and the relevant records are sent to our AI provider solely to generate the requested output (for example, drafting an estimate). We do not permit that content to be used to train third-party foundation models.

5.How we share information

We share information only as described here:

• Within your workspace: Customer Data is visible to authorized members of your workspace according to their roles and permissions.
• Service providers & sub-processors: vendors that help us run the Service, under contracts that limit their use of the data (see §6).
• Integrations you enable: when you connect a third-party service (e.g., QuickBooks, Google, Dropbox), we exchange data with it at your direction. Its use of the data is governed by its own terms and privacy policy.
• Legal & safety: to comply with law, respond to lawful requests, or protect the rights, property, or safety of D&S Tech, our users, or others.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not sell or rent personal information to third parties.

6.Service providers & sub-processors

We use trusted providers to deliver the Service. Categories and representative providers include:

Purpose	Providers
Payments (customer invoice payments)	Stripe, Square (Block), PayPal, Intuit QuickBooks Payments
Accounting sync	Intuit QuickBooks Online
Calendar & file storage (when connected)	Google, Microsoft, Dropbox
SMS & messaging	Telnyx
Email delivery	Our transactional mail service
Hosting & infrastructure	Our cloud hosting and storage providers

Providers only receive the data needed for their function and are bound by confidentiality and data-protection obligations. We can provide a current list of sub-processors on request.

7.Cookies & similar technologies

The Service uses a single essential cookie to maintain your authenticated session and protect against cross-site request forgery. It is required for the Service to function and cannot be switched off from within the app. We do not use advertising or cross-site tracking cookies. Your browser can block or delete cookies, but the Service may not work correctly if you block the essential cookie.

8.Data retention

We retain account and workspace data for as long as your account is active. If your account or workspace is closed, we retain data for a limited period to allow recovery and to meet legal, tax, and accounting obligations, after which it is deleted or anonymized. You or your Workspace Administrator can request export or deletion of Customer Data as described in §10, subject to those obligations.

9.Security

We use technical and organizational measures designed to protect information, including encryption in transit (HTTPS), hashed passwords, role-based access controls, per-workspace data isolation, and regular backups. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and keep your credentials confidential.

10.Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of California (CCPA/CPRA) and the EEA/UK (GDPR) have specific rights, including the right not to receive discriminatory treatment for exercising them.

For personal information we hold as a controller, contact us at support@mepsub.org and we will respond as required by applicable law. For Customer Data held within a workspace (where we act as processor), please direct your request to your Workspace Administrator; we will assist them in responding.

11.International data

We are based in the United States and process data there. If you access the Service from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your country. Where required, we rely on appropriate safeguards for such transfers.

12.Children’s privacy

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it.

13.Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice (for example, by email or an in-app notice). Your continued use of the Service after an update means you accept the revised policy.

14.Contact us

If you have questions about this policy or our privacy practices, contact: