Privacy Policy

Opzaco LLC ("Opzaco," "we," "us") provides a maintenance-tracking platform for managers and the workers they invite, accessible at https://opzaco.com. This policy describes what information we collect, how we use it, who we share it with, and the choices you have.

• Account information: name, email address, phone number, role (owner, supervisor, worker, or client), preferred language, and the organization you belong to.
• Service log content: the text responses, ratings, dates, times, photos, and notes you submit when completing a maintenance form, plus the asset and property the log is attached to.
• Demo requests: if you fill in the contact form on our website, the name, email address, phone number, and message you provide, which reach us as an email. You do not need an account to contact us.
• Expense receipts: if your organization enables the receipts feature, the photo of the receipt, the category you pick, and any note you add.
• Authentication metadata: sign-in timestamps, the device that signed in, and verification events. Authentication itself is operated by Clerk.
• Technical logs: IP address, user-agent, request paths, and server timestamps in the ordinary course of running a web application.
• Product analytics: pseudonymous events about which pages and features you use, captured via PostHog. These are keyed to an account identifier, not to your name or email address. PostHog also records session replays — a reconstruction of what was on screen as you used the app — with the contents of form fields masked before they leave your browser. We do not collect keystrokes.

• To operate the platform: render pages, save service logs, render history.
• To authenticate you: verify sign-ins via email magic links, phone one-time passcodes, or passkeys.
• To send you transactional SMS: a one-time welcome message containing a sign-in link when your manager invites you, and a one-time passcode when you sign in. We do not send marketing or promotional SMS.
• To send transactional email, only when your organization enables the relevant feature: expense receipts to your organization’s own inbox, and — to a property owner your organization has invited — alerts when a worker flags a problem, and work proposals awaiting their review.
• To improve the product: aggregate analytics about which features are used. We do not sell, rent, or trade analytics data.
• To power “Ask the Manual,” which answers a worker’s question about a piece of equipment from that equipment’s own manual. It runs only when a worker asks a question. When they do, the manual, the question, any photos they attach, and a short excerpt of recent service notes for that equipment are sent to Anthropic through Vercel’s AI Gateway solely to generate the answer — never to train models, and under zero-data-retention terms, meaning neither provider stores them after the answer is returned.

We use the following third parties to operate Opzaco. Each current provider receives only the data needed to perform its function on our behalf and is bound by its own privacy obligations. A former provider is noted for historical transparency.

• Clerk — authentication, sign-in, session management.
• Twilio (former provider) — used for worker sign-in SMS until July 29, 2026. The account is retained but inactive; Opzaco no longer sends customer data to Twilio.
• Resend — transactional email delivery.
• Neon — managed Postgres database where account, asset, and service-log data are stored.
• Vercel— hosting, edge network, platform observability, and page-usage and performance analytics. Vercel’s AI Gateway also routes requests for the AI feature described above.
• Vercel Blob — storage for service-log photos.
• Anthropic — large-language-model inference for optional AI features. Inputs are sent only when the feature is invoked.
• PostHog — product analytics and session replay.
• Cloudflare — bot and abuse protection on the sign-in page.
• Apple — delivery of push notifications to the iPhone app. When a worker submits a service log, Apple receives the device token and the text of the notification, which names the worker, the equipment, and the property it belongs to.

We do not sell your personal information. We do not share it with advertisers or data brokers.

By providing your mobile number to your manager for use with Opzaco, you consent to receive transactional SMS related to your account: a one-time welcome message containing a sign-in link, and one-time passcodes when you sign in.

• Frequency: low — typically only when a manager invites you, and when you sign in.
• Marketing: we do not send marketing, promotional, or recurring informational SMS.
• Opt out: reply STOP to any Opzaco SMS to stop receiving messages. You can also ask your manager to remove your account, which permanently stops all messages.
• Help: reply HELP for assistance.
• Carrier charges: message and data rates may apply.

Photos uploaded as part of a service log are stored privately on Vercel Blob. They are visible to workers and managers within your organization, and to a property owner your organization has invited, for the specific equipment assigned to them. We strip location data from photos after upload. Photos are kept for as long as the service log they belong to; when a manager deletes a service log, its photos are permanently deleted along with it after a seven-day grace period.

• Service logs, asset records, and photos: kept indefinitely, so the maintenance history stays useful. A manager can delete an individual service log; it and its photos are permanently removed seven days later.
• Account information: retained until your manager removes you from the organization, at which point your account and personal information are deleted.

• You can ask your manager to remove your account at any time. We will delete your personal information, retaining only the de-identified shape of past service logs needed for the organization's history.
• You can request a copy of your personal information by contacting us at the address below.
• You can opt out of SMS at any time by replying STOP.

Opzaco is not intended for use by anyone under 16. We do not knowingly collect personal information from children.

We may update this policy. When we do, we will post the revised version here and update the “Last updated” date at the top.

Questions, requests, or concerns? Email hello@opzaco.com.