Privacy notice
DRAFT · 2026-10-20-draft · Not effective. Owner and qualified counsel review required before publication.
Who handles information
The service operator is [legal entity and address to be confirmed]. The privacy and rights-request contact is [monitored contact to be confirmed]. A moving company directs processing of its customers' and workers' operational information. The operator also handles account, support, security and billing information for operating its own service. Counsel must confirm the legal roles, applicable jurisdictions and grounds for each purpose before publication.
Information and purposes
Depending on enabled features and what users supply, records include names, phone numbers, email and move addresses; job notes, quotes, invoices and payment references; photographs and uploaded documents; crew records and access roles; job communications; vehicle locations; login and audit information; and support requests. The provider uses these to operate the configured service, manage access, diagnose problems, answer support requests and maintain the business relationship. The operator must verify actual logging, analytics and integration settings before the final notice describes them.
The signup record stores the new user identifier, company identifier, server time, document versions, document status, source and document hashes. The public email signup does not prove that the person who typed an address controls it; the welcome/reset link is a separate step. This implementation does not add marketing consent, analytics tracking, IP address collection or a browser fingerprint to the acceptance record.
Frappe uses session and authentication cookies. The product may keep application preferences and offline copies in browser storage. Before publication, inventory cookies and local storage on the actual deployment, document their purpose and lifetime, and obtain any separately required consent for optional tracking. Agreement to the service terms is not blanket consent to marketing or optional processing.
Recipients and security
Authorized company users can access information according to configured roles. The provider operates and administers the service. Optional delivery, payment, identity, booking, maps and hosting services may receive information if configured; the versioned subprocessor inventory must identify the actual recipients before live data goes to them. Do not treat an integration in source code as evidence of a contracted or active processor.
Payments a moving company takes through Vozanto are processed by Stripe, Inc. When you provide personal data in connection with such a payment, or in a moving company's Stripe setup, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy. Card and bank numbers are typed into Stripe's own forms; Vozanto's servers never receive them. Vozanto keeps Stripe's reference for each payment, its amount and fees, the job or bill it paid, and for a saved card its brand and last four digits.
The product includes role checks, company scoping, session revocation and time-limited support grants. Site administrators and infrastructure operators have privileged capabilities; support-grant controls do not eliminate that access. Verify encryption, backups, restoration, patching, monitoring and access review for the specific pilot instance before making security certifications or guarantees.
Retention and deletion: current implementation
The product's retention table currently describes these targets; it is not evidence that every category has an automatic expiry job:
| Category | Configured target | Current deletion behavior |
|---|---|---|
| Jobs, quotes and invoices | Seven years | Customer deletion keeps financial records and clears selected job contact fields. |
| Customer contacts | While the account exists | Clears selected customer fields; keeps an anonymized customer record. |
| Job photos | Two years | Customer deletion removes linked non-PDF files. |
| Signed documents | Seven years | The current routine retains PDFs; it does not classify every PDF as a signed record. |
| Customer text messages | Two years | Deletes matched text records. |
| Truck positions | 30 days | Separate pruning behavior needs deployment verification. |
| Crew documents | Table says account lifetime; rationale mentions employment plus one year | Resolve this inconsistency before publication. |
| API tokens | Until revoked, with a retained record | Revocation ends access; retention is separate. |
| Activity logs | One year | Customer deletion keeps logs. |
| Legal acceptance evidence | No automatic expiry implemented | App routes reject edits and deletion; a counsel-approved retention and restricted disposal process remains required. |
These are product settings and behavior, not a statement that Massachusetts or federal law requires seven years for all records. Tax retention varies by record and circumstances. The operator must approve a category schedule, legal holds and backup expiry with counsel. See the IRS recordkeeping guidance.
Access, correction, export and closure
Start with the moving company that holds your records or the operator's confirmed privacy contact. The operator must verify identity and scope, record the request, determine applicable exceptions and communicate the result. Do not submit additional sensitive information until a secure channel is agreed.
The customer export endpoint returns JSON for the customer and associated records, including file metadata; it does not provide a complete archive of all attachment bytes. Customer deletion clears specified contact fields and removes selected photos and texts. PDFs, financial records, some other tables, audit entries, backups and third-party copies can remain. A complete access/deletion request or company shutdown therefore needs operator review of all relevant stores. No fixed deletion deadline or full-erasure guarantee is established by this draft.
Review requirements
Confirm entity and contacts, exact deployed recipients and locations, international transfers, cookie/storage inventory, lawful purposes, rights available by jurisdiction, request deadlines and complaint channels. Resolve retention inconsistencies and test export/deletion scope. For Massachusetts personal information, review the required information security program and provider safeguards under 201 CMR 17.00. Counsel must determine applicability to this deployment.