Privacy Policy

This policy covers business users of 1Stop Service Pro: staff at property management companies who request and oversee work ("Clients") and staff at independent trade businesses who perform that work ("Providers"). It does not cover residents or tenants of the properties serviced through the platform. Residents and tenants are not 1Stop users and do not have accounts, but information about their unit, including its address and interior photographs taken during a work order, is stored by the system. That is addressed directly in this policy.

1Stop Service Pro is pre-launch. As of the date on this page it has no paying customers. This policy describes the system as it is built and as it is intended to operate, not a program that is currently serving anyone.

The table below lists the categories of information the platform stores, in plain terms, drawn directly from its database structure.

The platform does not process payments and does not store any of the following.

• No bank account number or routing number.
• No ACH transfer detail.
• No payment card data of any kind.
• No Social Security number.
• No Employer Identification Number.
• No background check results.

Information reaches the platform in four ways: entered directly by a Client or Provider user through the application, captured automatically by the Provider's mobile app at the moment a job is started or ended, generated by the system itself as a byproduct of using the platform, such as timestamps and audit rows, and uploaded as a compliance document by a Provider.

1Stop uses the information described above for the following purposes.
[counsel to confirm how to frame the legal basis for each purpose, and whether consent, contract or legitimate interest is the right frame in each state]

Providers take before and after photographs, and sometimes damage photographs, of the work area. These photographs are often taken inside private residential units, and a unit may be occupied by a resident or tenant at the time.

The resident or tenant whose home is photographed is not a 1Stop customer and has not agreed to anything with 1Stop. The Client that manages the property authorizes the Provider's entry and the taking of photographs, and is responsible for giving the resident or tenant any notice the law or the lease requires. Under Fla. Stat. 83.53, a landlord must give a tenant at least 24 hours notice before entry for the purpose of repair, with repair entry between 7:30 a.m. and 8:00 p.m.
[counsel to confirm the allocation of notice-of-entry duties, and the Georgia equivalent]

1Stop asks Providers to photograph the work area itself rather than personal belongings, and not to photograph people.
[a written photo-capture standard for Providers is still to be written]

The Provider's device records its coordinates at two moments only: when a job is started and when it is ended. Each pair of coordinates is tied to a specific work order. This is not continuous tracking. The platform does not track a Provider's location in the background, between jobs, or off shift.

Coordinates are stored at full precision as reported by the device. Because Fla. Stat. 501.702(31) lists precise geolocation data as sensitive data, 1Stop treats job start and end coordinates as sensitive information, even though the threshold that would bring 1Stop within that statute's controller definition is not met today.
[counsel to confirm worker notice and consent requirements for location capture in Florida and Georgia]

Information about a job is visible to the Client organization that requested the work and the Provider organization assigned to perform it. It is also shared with the vendors that operate the platform's infrastructure, listed on the subprocessor list, and may be disclosed where required by law or to defend a legal claim. 1Stop does not sell information and does not use it for advertising.

1Stop does not currently have an automated process to delete, purge or archive data. With the exception of one soft-delete column on the notes table, records persist in the database until someone removes them by hand. Session tokens and phone verification codes carry expiry timestamps that make them unusable after a period of time, but the rows themselves are not deleted. Property records, unit records, photographs, location coordinates, signatures and audit rows are all kept indefinitely today. This is a known gap that 1Stop intends to close.

Fla. Stat. 501.171(8) requires reasonable measures to dispose of customer records containing personal information once they are no longer to be retained.
[retention schedule to be set with counsel, balancing tax and construction record needs against Fla. Stat. 501.171's disposal requirement]

Passwords are stored as hashes, never in the clear. Phone verification codes are stored as hashes. Sessions expire. Access to data is scoped by the signed-in user's organization and role in the application's own code, using a role matrix: a Client sees its own organization's data, a Provider sees only the work assigned to it, and 1Stop staff can see across organizations. This scoping is enforced in application code, not by database row-level security.

The platform is self-hosted on a single server. No system is secure against every possible attack, and 1Stop does not represent that its systems are impenetrable. 1Stop does not hold a SOC 2 report, an ISO 27001 certification, or any similar third-party audit or certification.

Fla. Stat. 501.171 requires reasonable measures to secure personal information, notice to affected individuals following a breach, and notice to the Florida Department of Legal Affairs where a breach affects 500 or more individuals in Florida, no later than 30 days after determining a breach occurred, with up to 15 additional days available for good cause shown in writing. 1Stop will follow the notice requirements that apply to it if a breach occurs.

A user or an organization can ask what information 1Stop holds about them, or ask for it to be corrected or deleted, through the contact page. Some records cannot be deleted on request because they document work performed or paid for. This includes signature records, audit rows, invoices, and photographic proof of completed work, which may need to be kept for contractual, tax or dispute reasons. 1Stop will respond to a request within [response time to be set].

Florida. Fla. Stat. 501.171 applies broadly to businesses that handle the personal information of Florida residents, and its security and breach notice requirements are addressed above. The Florida Digital Bill of Rights, Fla. Stat. 501.702, defines a "controller" subject to most of its obligations as an entity that, among other conditions, makes in excess of $1 billion in global gross annual revenue. 1Stop is far below that threshold today.
[counsel to confirm which provisions of the Florida Digital Bill of Rights apply regardless of the revenue threshold]

California. The California Consumer Privacy Act, Cal. Civ. Code 1798.140(d), applies to a "business" that meets at least one of three thresholds: annual gross revenue over $25,000,000, buying, selling or sharing the personal information of 100,000 or more consumers or households, or deriving 50 percent or more of annual revenue from selling or sharing personal information. 1Stop meets none of these thresholds today. If it ever does, California residents who use the platform as staff or contractors of a Client or Provider would fall within the law's scope, because the law's earlier business-to-business and employee exemptions have expired.

Georgia. [Georgia's consumer privacy and breach notification position is being verified and this section is a placeholder]

1Stop Service Pro is a business tool for staff at Client and Provider organizations. It is not directed at children, and 1Stop does not knowingly collect information from children. A photograph taken inside an occupied home could incidentally include a child who is present at the time. Providers are told not to photograph people.

If this policy changes, an updated version will be published on this page with a new draft date. Questions about this policy can be sent through the contact page.

This document is a working draft pending review by a licensed attorney. See the notice at the top of this page.