Privacy Policy

This Privacy Policy explains how D&S Tech LLC (“D&S Tech,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with the MEPSub platform and the website at mepsub.org (together, the “Service”). MEPSub and the MEPSub logo are trademarks of D&S Tech LLC.

1.Scope of this policy

This policy applies to information we process when you visit our website, create or use a MEPSub account or workspace, or otherwise interact with the Service. It does not apply to third-party websites, applications, or services that we do not control, even if they link to or from the Service.

If you use MEPSub as an employee, contractor, or member of an organization that has its own MEPSub workspace (your “Workspace Administrator”), that organization controls the workspace and its data, and its own privacy practices may also apply to you.

2.Our role: controller and processor

Depending on the data, we act in one of two roles:

• Controller. For account registration data, billing information, website usage, and communications with us, D&S Tech is the controller and this policy governs how we handle that data.
• Processor. For the content you and your team put into a workspace — including information about your customers, sites, equipment, jobs, invoices, and documents (“Customer Data”) — we act as a processor on behalf of your organization. Your organization is the controller of that Customer Data and is responsible for having a lawful basis to collect and use it. We process it under your instructions and our Terms of Service.

3.Information we collect

Information you provide

• Account & profile data: name, email address, phone number, password (stored only as a hash), workspace name, role, and company details.
• Access requests: if you request access, the name, email, company, phone, and message you submit.
• Customer Data: the records you enter or upload — customers, sites, equipment, appointments, work orders, estimates, invoices, projects, files, photos, and related notes.
• Billing data: if a paid plan applies, billing contact details. Card and bank details are collected and stored by our payment processors, not by us.
• Communications: messages you send us (support, sales, email) and content of in-app messages you choose to send.

Information we collect automatically

• Usage & device data: log data such as IP address, browser and device type, pages viewed, actions taken, and timestamps.
• Essential cookies: a session cookie to keep you signed in and secure the Service (see §7).
• Location data: when your workspace enables GPS or live-map features, we process the device location of field users while they are clocked in, to show crew location and route work.
• Calls & messages: when your workspace enables telephony or SMS, we process call logs, call recordings (where the workspace turns recording on), and message content, to deliver and log those communications.
• Website analytics: on our marketing site we use a first-party analytics signal (page path, referrer, and campaign source) stored via your browser’s session storage — not advertising cookies — to understand site traffic.

We do not sell personal information, and we do not use third-party advertising trackers on the Service.

4.How we use information

• Provide, operate, secure, and maintain the Service and your workspace.
• Authenticate users and prevent fraud, abuse, and unauthorized access.
• Process transactions and send transactional messages (e.g., invoices, appointment reminders, password resets) by email and, where enabled, SMS.
• Respond to your requests and provide customer support.
• Understand usage to improve features, reliability, and performance.
• Comply with legal obligations and enforce our Terms of Service.

Where we use optional AI features, your prompts and the relevant records are sent to our AI provider solely to generate the requested output (for example, drafting an estimate). We do not permit that content to be used to train third-party foundation models. Where free-text prompts are stored, they are kept only for a limited period (currently up to 45 days) to prevent misuse, and are then deleted. Some AI features are metered and may be billed against your plan’s AI allowance or credits.

5.How we share information

We share information only as described here:

• Within your workspace: Customer Data is visible to authorized members of your workspace according to their roles and permissions.
• Service providers & sub-processors: vendors that help us run the Service, under contracts that limit their use of the data (see §6).
• Integrations you enable: when you connect a third-party service (e.g., QuickBooks, Google, Dropbox, OneDrive, Procore) or import data from another system, we exchange or ingest data at your direction. That third party’s use of the data is governed by its own terms and privacy policy.
• Legal & safety: to comply with law, respond to lawful requests, or protect the rights, property, or safety of D&S Tech, our users, or others.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not sell or rent personal information to third parties.

6.Service providers & sub-processors

We use trusted providers to deliver the Service. Categories and representative providers include:

Purpose	Providers
Payments (customer invoice payments)	Stripe, Square (Block), PayPal, Intuit QuickBooks Payments
Accounting sync	Intuit QuickBooks Online
Calendar & file storage (when connected)	Google, Microsoft, Dropbox
Project management (when connected)	Procore
SMS & messaging	Telnyx
Telephony & call recording (when enabled)	3CX
AI features (when used)	Our AI provider(s) (e.g., Anthropic, OpenAI)
Maps (live technician map)	Our map & map-tile provider
Email delivery	Our transactional mail service
Hosting & infrastructure	Our cloud hosting and storage providers

Providers only receive the data needed for their function and are bound by confidentiality and data-protection obligations. We can provide a current list of sub-processors on request.

7.Cookies & similar technologies

The Service uses a single essential cookie to maintain your authenticated session and protect against cross-site request forgery. It is required for the Service to function and cannot be switched off from within the app. We do not use advertising or cross-site tracking cookies. Your browser can block or delete cookies, but the Service may not work correctly if you block the essential cookie.

8.Data retention

We retain account and workspace data for as long as your account is active. If your account or workspace is closed, we retain data for a limited period to allow recovery and to meet legal, tax, and accounting obligations, after which it is deleted or anonymized. You or your Workspace Administrator can request export or deletion of Customer Data as described in §10, subject to those obligations.

9.Security

We use technical and organizational measures designed to protect information, including encryption in transit (HTTPS), hashed passwords, role-based access controls, per-workspace data isolation, and regular backups. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and keep your credentials confidential.

10.Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of California (CCPA/CPRA) and the EEA/UK (GDPR) have specific rights, including the right not to receive discriminatory treatment for exercising them.

For personal information we hold as a controller, contact us at support@mepsub.org and we will respond as required by applicable law. For Customer Data held within a workspace (where we act as processor), please direct your request to your Workspace Administrator; we will assist them in responding.

11.International data

We are based in the United States and process data there. If you access the Service from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your country. Where required, we rely on appropriate safeguards for such transfers.

12.Children’s privacy

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it.

13.Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice (for example, by email or an in-app notice). Your continued use of the Service after an update means you accept the revised policy.

14.Contact us

If you have questions about this policy or our privacy practices, contact: