Privacy Notice and Privacy Policy

1. Xelyvo and your company workspace

Xelyvo is a business service for participating companies, their employees and contractors, and customers who interact with service documents or payment links. Your company administers its workspace, creates user accounts, assigns access, and determines how its work records are used. We process those records to provide the service to that company.

Xelyvo LLC is responsible for operating the platform and handling information used for account administration, security, support, and our business relationship with participating companies. If you use an employer-managed account, your employer also has responsibilities for its use of your information. This notice does not replace your employer’s workplace or timekeeping policies.

2. Information we process

The information processed depends on your role, the features your company enables, and the information you or authorized users provide. It can include:

• Account and business contact information: name, work email, phone number when provided, company membership, user identifiers, role, and account preferences.
• Work and customer records: assignments, schedules, customer contacts and service addresses, instructions, equipment details, reports, notes, comments, approvals, and signatures.
• Time and employment-related records: job labor, travel time, payroll clock punches, breaks, corrections, and work-related performance or career records maintained by your company.
• Location information: latitude and longitude, accuracy, capture time, and the account, clock punch, or visit associated with a reading.
• Content you submit: selected photos, videos and their recorded audio, receipt images, equipment-tag images, documents, and information extracted from those files.
• Financial records for enabled business features: invoices, quotes, expenses, receipts, payment status, and account or transaction information obtained through an authorized banking connection.
• Technical and support information: IP address, device and browser information, authentication sessions, notification registration tokens, activity and audit records, errors, and communications with support.

3. How we receive information

We receive information when you use Xelyvo, submit content, grant a device permission, or contact us. Your company and other authorized workspace users can provide information about you, assignments, customers, and work. When an authorized administrator connects a service such as banking or payments, we receive the information needed for that integration.

Technical records are generated as the service operates. Only upload information you are authorized to provide and that is relevant to the work. Avoid including unrelated personal information in photos, receipts, notes, or documents.

4. Why we use information

We use information to:

• Authenticate users and manage company access and permissions.
• Schedule and coordinate service work, display assignments and service locations, and support routing.
• Document work, equipment, service history, customer approvals, job hours, travel, and payroll time.
• Process receipts and equipment scans, and support expenses, quotes, invoices, payments, and financial reporting.
• Deliver work notifications and service communications.
• Provide support, troubleshoot problems, improve reliability, maintain audit records, prevent misuse, and meet legal obligations.

5. Location and automatic job clock-in

With your device’s location permission, Xelyvo can save your location, accuracy, and capture time with a payroll clock-in or clock-out. This lets authorized company staff review where a punch was recorded.

Job location monitoring is separate from payroll punches. After you start travel for an assigned visit, Xelyvo can collect repeated location readings while the app is open and the relevant work screen is visible. Readings are linked to your account and visit and may continue during active work. Authorized company users can review the recorded job location activity according to their permissions.

Geofencing compares accurate readings with the service location to detect arrival and start a job timer. Arrival may also start time records for the assigned crew. This is a job timekeeping feature; it does not by itself clock everyone into a payroll shift. Location errors can affect the result, so users and company administrators can review or correct time records.

The current mobile apps do not run a native background location-tracking service. Job monitoring depends on an open, visible app screen and may pause when you switch apps or lock the phone. This notice does not describe continuous tracking while the app is closed.

You can deny or revoke location permission in your device or browser settings. Automatic arrival detection then cannot work. You can use the manual Arrived action for job timekeeping, and payroll punches can be recorded without a location. Revoking permission stops future permitted collection; it does not erase earlier readings. Your employer’s management of a company-owned device is separate from Xelyvo’s collection described here.

6. Camera, photos, videos, and signatures

You can take or select photos and videos to document service work, equipment, or receipts. Camera access is used for capture, and microphone access, where supported, is used for video audio. The app does not continuously record camera or microphone activity. Selected files and collected signatures are stored with the relevant company records.

Providing access to a photo picker does not mean your entire photo library is uploaded. Xelyvo uploads the files you select or capture for submission. You can change camera, microphone, and photo permissions in your device settings; affected capture or upload features may then be unavailable.

7. AI-assisted receipt and equipment scanning

When you choose to read a receipt or equipment tag with AI, the selected image and extraction instructions are sent to OpenAI to identify printed details, such as vendor, date, amounts, purchased items, manufacturer, model, or serial number. The image may contain personal information if that information appears in the photo. Extracted results are saved in the relevant company workspace.

AI results can contain errors and should be reviewed before use. You can enter information manually instead of using AI scanning. Information sent to an AI provider is processed under the applicable service terms and settings; this notice does not promise that provider copies are deleted immediately.

8. Who receives information

Your company’s authorized users receive information according to workspace permissions and assignments. Company administrators may access account and work records, including time and location information. Your company may share relevant service reports, attachments, approvals, quotes, invoices, or payment records with customers or other authorized recipients.

Service providers process information needed to operate enabled features. These include Supabase for authentication, database and file storage; Vercel for hosting and delivery; OpenAI for AI image extraction; Resend for service emails; and Google Firebase and browser push services for enabled notifications. Stripe processes payments, and Plaid supports bank connections when an authorized company user enables those features. Sharing with providers is limited to the relevant service, and is governed by applicable service agreements and data-protection requirements.

We may disclose information to comply with a lawful request, protect rights and security, investigate misuse, or complete a business transfer subject to appropriate protections. We do not sell personal information or share it for cross-context behavioral advertising. Employee location and job photos are not used for targeted advertising.

9. Cookies, device storage, and notifications

Xelyvo uses authentication cookies and local device or browser storage to maintain sessions, preferences, and supported offline functionality. Supported offline features may keep workspace information on your device until it is synchronized or cleared. On shared devices, sign out and clear relevant site or app data before giving someone else access.

If you enable notifications, we store a push registration or subscription associated with your account and device to deliver work alerts. Notification text may be visible on a lock screen depending on your settings. You can disable notifications or limit lock-screen previews through device or browser settings.

If you follow a link to a map, payment page, bank connection, or another external service, that provider’s privacy notice also applies to information it receives directly.

10. Security and processing locations

We use encrypted network connections, authenticated accounts, and company and role access controls to protect information. Access for service operation and support is limited to authorized purposes. Protect your account credentials and promptly report suspected unauthorized access.

Xelyvo and its providers may process information in the United States and other countries where services are operated. Where applicable law requires safeguards for international transfers, those requirements apply to the relevant processing.

11. Retention and deletion

Retention depends on the type of record, your company’s instructions, the purpose of processing, and legal requirements. Account information is retained as needed to administer access. Work, location, time, payroll, customer, and financial records may be retained as part of the company’s service history, timekeeping, accounting, legal obligations, or dispute records. Security and audit information may be retained to investigate misuse and protect the service.

Removing an account does not automatically erase every company business record associated with that person. We assess deletion requests with the company responsible for the records and applicable legal requirements. Data that is no longer needed can be deleted or anonymized; records subject to a legal obligation or legal hold may need to be retained. Ask us or your company administrator about the retention that applies to a particular record.

Deletion from active systems may not immediately remove copies in backups or records held by an independent provider. Those copies are subject to the applicable backup lifecycle, provider terms, and legal retention requirements.

12. Your choices and privacy requests

You can manage device permissions, disable notifications, choose manual entry instead of AI scanning, and sign out. Depending on applicable law, you may request access to, correction of, a copy of, or deletion of personal information, or object to or request limits on certain processing. These rights can be subject to legal exceptions.

For employer-managed work records, contact your company administrator. You may also send account deletion or other privacy requests directly to accounts@xelyvo.com, including if you can no longer sign in. Identify Xelyvo, your company, the email used for your account, and the request. Do not send your password, full payment card details, or bank login credentials.

We may need to verify your identity and coordinate with the company responsible for the records. We will explain applicable limitations or required retention when responding. Disabling access is different from deleting personal information. Deleting or uninstalling the mobile app alone does not submit an account deletion request.

13. Children

Xelyvo is intended for authorized business users and is not directed to children under 13. If you believe a child has provided personal information through the service, contact us so we can review it and take appropriate action.

14. Updates and contact

We may update this notice as features, practices, or legal requirements change. The updated notice will show its effective date. For material changes, we will provide any additional notice or obtain any consent required by applicable law.

Privacy questions and requests: Xelyvo LLC, accounts@xelyvo.com. The current notice is available at https://www.xelyvo.com/privacy.