Work Orders App · AA Labs

Privacy Policy

Last updated: 2026-07-10

This policy describes what the Work Orders App collects, how it is used, who it is shared with, and how it is protected. The "What information we collect" and "How we use it" sections reflect what the app actually does, based on a review of the codebase and the running service — not a generic template. If the app changes, this document will be updated before the change ships.

1. Who we are

Work Orders App is provided by AA Labs (the "platform operator", "we", "us"). Your company or organization uses the app to manage maintenance work orders, preventive maintenance, equipment, parts, QR-based problem reports, shift handoff notes, and related records. The platform is a generic multi-tenant service; this policy describes how data is handled across all customer organizations.

Customer organizations are not the platform operator. Each business or organization that uses the app is a separate customer organization (tenant) that manages its own workspace, users, roles, facilities, equipment, and operational records. Inside the app, a "company owner" or similar administrative role refers to a user authorized to manage a customer organization's workspace. It does not indicate ownership of the Work Orders App platform, software, intellectual property, or AA Labs.

Access is by invitation only. Accounts are created and managed by each customer organization's administrator; there is no public sign-up. The one exception is the public QR "Report a Problem" page described in Section 3.4, which accepts anonymous maintenance reports without an account.

Roles for data-protection purposes. Each customer organization determines the purposes for which its own workforce and maintenance records are processed and is the controller of that content. AA Labs processes that tenant content on the organization's behalf to provide the contracted service, acting as a processor. Separately, AA Labs determines the purposes of certain limited platform-level processing — such as securing the service, preventing abuse, administering and supporting the service, and complying with legal obligations — and acts as a controller for that limited processing. These roles are set out in more detail in the agreement between AA Labs and each customer organization (and its data-processing terms where applicable). A customer organization's own controller details are available from that organization's administrator.

Contact for privacy questions: support@workordersapp.app. The platform operator's identity and contact details are set out in Section 12.

2. Scope

This policy covers the Work Orders App mobile app (iOS App Store, Google Play Store) and its companion web / PWA version. It does not cover:

• Any other system, website, or application your organization uses;
• Third-party services your organization may use internally that are not integrated with this app.

3. What information we collect

The app collects only the information required to operate the maintenance workflow.

3.1 Account information

• Email address — used as a sign-in identifier and for password-reset flows.
• Username — where your organization enables username sign-in, a username you use to sign in.
• Password — stored hashed and salted by our authentication provider (bcrypt). Neither AA Labs nor your organization ever sees your plaintext password.
• Display name — the name you (or an administrator) enter on your profile, shown to teammates in work-order assignments, shift handoffs, and the audit log.
• Role — assigned by an administrator (e.g., technician, lead, supervisor, plant manager, owner). Used to control what you can see and do within the app.
• Preferred language — English or Spanish, used to localize the interface.

3.2 Device and session information

• Device key — when you use PIN sign-in on a shared device, the app creates a random identifier (a value generated in your browser and kept only in that browser's local storage) so an administrator can approve that specific device for PIN sign-in. It is random, is not derived from your hardware or browser characteristics, is specific to this app, and is not used for advertising or cross-app tracking.
• Device type label — a short, coarse label such as "iPhone · App" or "Windows PC · Chrome", shown to administrators reviewing device approvals. The app stores only this coarse label, not your full browser user-agent string.
• Sign-in activity — sign-in timestamps and the platform (iOS app, Android app, or web) for audit purposes.
• IP addresses. The app does not store raw client IP addresses in the application database for normal app actions. Our infrastructure providers (hosting, authentication, and content delivery) may process IP addresses transiently in their own server logs as a normal part of delivering the service. For abuse prevention on sign-in, a one-way, irreversible hashed value is used only to rate-limit repeated attempts; the raw IP address is not retained.

3.3 Work-related content you create

• Work-order data — descriptions, statuses, assignments, priority, due dates, completion notes, parts used, and downtime records that you or a teammate enter.
• Machine and asset notes — observations and history you add to specific equipment.
• Shift notes — handoff messages, acknowledgements, and follow-ups.
• Preventive-maintenance form responses — checklist answers and form submissions tied to PM tasks.
• Photos and attachments — images and files you upload to attach to work orders, machine records, or shift notes. Files are selected through your device's standard file/photo chooser; the app only receives the specific files you choose and does not scan or access your photo library. Uploaded photos and files may contain embedded metadata (such as camera or file details, and for some formats, location) that is stored together with the file. The original filename you assign is also stored with the record. Files are kept in private storage and served only through short-lived, expiring links.

3.4 Anonymous QR problem reports

A machine or facility may display a QR code that opens a public "Report a Problem" page. Anyone who scans it can submit a maintenance report without signing in or creating an account. When they do, the app stores, as a work-order record: the name or line the person types, the problem summary and any details they add, the machine or area selected, the priority, the language, and a timestamp.

This information is not linked to any app account. The QR report page does not collect an IP address, a device identifier, or a login; it uses only a hidden anti-spam field and basic form-timing checks to reduce automated abuse, and those signals are not retained as identifying information. Because a person who submits a QR report may not be an app user, the name and free text they enter are stored as part of your organization's work record — see Sections 7 and 8 for retention and how to raise a request about it.

3.5 Operational logs

• Audit log. For accountability and record integrity, the app records meaningful actions (creating, updating, completing, assigning, or deleting work-related records, and security events such as sign-ins and device approvals). Each entry records who performed the action (including a snapshot of their name and role at that time), what changed (which may include before-and-after values of the changed fields), a human-readable summary, the affected record, and a timestamp. Because these entries exist to preserve the integrity of the operational record, they may contain personal information — for example, names, email addresses, the name a QR reporter typed, and work-related free text such as problem descriptions or notes. Event, entity, tenant, role, and timestamp facts are append-only. When an account deletion completes, the deleted subject's direct name/email/username fields are redacted through a narrowly controlled privacy path without changing those facts. Audit entries are visible only to manager-level users and above within your organization.
• Client error log. When something fails in the app, a short technical diagnostic entry (the error message, the page where it happened, and whether the device was online) is stored locally on your device, in the app's own storage, to help with troubleshooting. This on-device log is limited in size and is overwritten over time; it is not transmitted to or stored on our servers. It does not record passwords, message bodies, photo contents, or other free-form input. (If we add server-side error reporting in the future, we will update this policy before that change ships.)

3.6 What we do not collect

• Location — the app does not request or record GPS, Wi-Fi positioning, or cell-tower location.
• Contacts, calendar, microphone, or motion sensors.
• Cross-app tracking identifiers (IDFA on iOS, Android Advertising ID).
• Third-party analytics or crash-reporting SDKs — no Mixpanel, PostHog, Google Analytics, Amplitude, Segment, Sentry, Hotjar, or similar are used.
• Marketing or behavioral profiling data.
• Payment information — the app has no in-app purchases or financial transactions.

This is a closed workforce tool. Data flow is intentionally minimal.

Support and customer-service information

When you contact support or submit a support ticket through the in-app Support Center, we collect the information you provide — including the ticket subject, description of the issue, your replies, screenshots or files you choose to attach, and related correspondence.

To help diagnose technical problems, the app may also include limited technical information with a support request, such as the app version, operating platform, device type, current app page or feature, network status, timestamps, and identifiers for relevant recent errors. We do not attach your password, authentication tokens, IP address, full user-agent, unrelated work-order content, or any records outside the support ticket.

Support requests are visible only to authorized users based on their role and the ticket's visibility — for example, account- and access-related tickets are visible only to you and our support personnel — and to authorized AA Labs personnel who need access to provide support, investigate security or reliability issues, or administer the service. We use this information to investigate reported problems, communicate with you about the request, improve reliability and security, and keep a history of support provided.

4. How we use this information, and our legal bases

We use the information described above only to:

• Provide the service. Sign you in, route work to the right people, show in-app notifications about jobs assigned to you (in the app's notification inbox), and let supervisors see the state of operations. We do not currently send push notifications or notification emails for these events; if we add them, we will update this policy and disclose the providers involved.
• Maintain the integrity of the work record. The audit log is the source of truth for what happened on a maintenance job, by whom, and when.
• Support and troubleshooting. Diagnose issues you report and identify recurring failures.
• Security. Detect and respond to suspicious sign-in activity, enforce role-based access, rate-limit abuse, and revoke compromised devices.
• Legal and compliance. Retain records to comply with applicable laws and respond to legitimate legal requests.

We do not use your information for advertising, behavioral profiling, sale to third parties, or any purpose unrelated to running maintenance operations.

Legal bases (where the GDPR or similar laws apply). We and the relevant customer organization process personal data on one or more of these bases: performance of a contract (to provide the service to your organization); legitimate interests (operating, securing, and improving a maintenance-management tool, where not overridden by your rights); compliance with legal obligations; and, only where we specifically rely on it, your consent. We do not rely on consent as a general basis for operating the service.

5. Who we share it with

We share information only with the providers necessary to operate the app:

• Supabase (supabase.com) — our database, authentication, and file-storage provider, which hosts the data described in Section 3 and acts as a processor / sub-processor under AA Labs's instructions, governed by Supabase's Data Processing Agreement. Privacy policy: supabase.com/privacy.
• Web hosting / CDN — the web/PWA version and these public pages are served by our hosting provider(s) (currently Netlify, and Vercel where used). As part of normal operation, a host processes request logs, which include IP addresses and request paths, under that provider's own retention.
• Apple and Google — when you install the app from the App Store or Play Store, Apple/Google collect basic installation and crash data under their own platform policies. We do not directly receive personal information from these stores beyond aggregate install and crash reporting.
• Email delivery — account and password-reset emails are sent through our authentication provider's email service (currently Supabase). If we configure a separate transactional email provider, we will list it here before that change ships.
• Asana (asana.com) — optional integration, off unless your organization enables it. If your organization's administrator connects Asana, work-order details (summary, description, priority, status, due date, machine and facility names, and the name of the assigned user) and preventive-maintenance titles are sent to your organization's own Asana workspace so your team can view and track them there. The sync is one-way (Work Orders App → Asana); Asana never writes back to the app, and no Asana account is required to use the app. For that data, Asana acts as a processor / sub-processor engaged at your organization's direction, under Asana's own terms and privacy statement (asana.com/terms/privacy-statement).

Other than the sub-processors and infrastructure providers necessary to deliver the service (such as those above, and — where relevant — our domain/DNS provider), and disclosures required by law, we do not share personal information. We do not sell personal information, and we do not share it with advertisers, data brokers, or marketing services.

If AA Labs is acquired, merged, or reorganized, personal data may transfer to the successor entity, which will be bound by this policy (or equivalent terms) until updated.

6. Where data is stored, and international transfers

• Database, authentication, file storage: Supabase cloud infrastructure.
• Static web hosting (PWA) and these pages: our hosting provider's global CDN.
• Mobile app installs: on your iOS or Android device (local cache, offline state, and files you have not yet uploaded).
• Asana (optional integration): if your organization enables Asana, a copy of the work-order details described in Section 5 is stored in its Asana workspace, under Asana's own infrastructure and retention.

Our providers operate cloud infrastructure that may process and store data in the United States and other regions those providers use to deliver their services. Where personal data is transferred internationally — for example, for users in the European Economic Area, United Kingdom, or Switzerland — we rely on appropriate safeguards recognized under applicable law, such as adequacy decisions or Standard Contractual Clauses, as offered by the relevant providers. If we change providers or regions in a way that materially affects this, we will update this policy.

7. How long we retain data

• Account information — retained for the duration of your authorized access, plus a period necessary to satisfy operational and legal record-keeping obligations, after which it is deleted or de-identified on request (see Section 8).
• Work-order and maintenance data — retained as part of your organization's operational records for as long as needed for maintenance, business-record, and audit-integrity purposes, and for any period your organization or applicable law requires.
• Audit-log entries — retained as immutable records to preserve the integrity of the operational record; because of that purpose they are generally not deleted on an individual request (see Section 8).
• Photos and attachments — retained alongside the work record they are attached to.
• Client error log — stored only on your device in a small, self-overwriting buffer; not retained on our servers.
• Sign-in sessions — access tokens are short-lived and refreshed automatically according to the service's authentication configuration; sessions end on sign-out, and an administrator can revoke a device or sign a user out. An access token already issued may remain valid until it expires (a short period) after a sign-out or revocation.

When data is no longer needed for an operational, legal, or audit purpose, it is deleted or de-identified.

8. Your rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete (most fields, including your display name and password, can be updated directly in the app).
• Delete your personal information, subject to limits required by audit, legal, or contractual obligations. Deletion and anonymization are carried out manually by an administrator; some work-order, maintenance, and audit-log records created under your account may need to be retained to preserve the integrity of the operational record or to meet legal obligations, and are dissociated from your personal identifiers where practical.
• Restrict or object to certain processing.
• Receive a copy of your data in a portable format (handled on request).
• Withdraw consent where processing is based on consent.

To exercise these rights, contact us at support@workordersapp.app. We will respond within 30 days (or sooner where required by law). Because this app is a workforce tool, some rights — particularly deletion — may be limited by your organization's obligation to maintain accurate operational records, and your organization may need to authorize deletion of workforce records. To request deletion of your account specifically, see Account Deletion.

If you are in the European Economic Area, United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local data protection authority.

California. If the California Consumer Privacy Act (CCPA/CPRA) applies to our processing of your personal information, you may have rights to know about, access, correct, and delete certain personal information, and to receive information about our data practices. We do not sell or "share" (as those terms are defined by that law) personal information. Whether the law applies depends on statutory thresholds; where it does not strictly apply, we still aim to honor reasonable privacy requests sent to the contact above.

9. Security

We protect your information with industry-standard measures:

• All connections to the app use HTTPS / TLS.
• Passwords are hashed and salted by our authentication provider (bcrypt).
• Database access is restricted by Row-Level Security policies that enforce role-based, tenant-scoped permissions.
• Sign-in abuse is rate-limited; administrators can revoke device approvals and sign sessions out remotely.
• Uploaded files are kept in private storage and served only through short-lived, expiring links.
• We do not embed third-party tracking SDKs or remote-code-loading mechanisms.

No system is perfectly secure. We commit to notify affected users and organizations promptly if a breach occurs, in line with applicable breach-notification laws.

10. Children's privacy

This app is a workforce tool for adults. We do not knowingly collect information from anyone under 16 years of age. If you believe a minor's information has been provided to us, contact us at support@workordersapp.app and we will delete it.

11. Changes to this policy

We may update this policy when the app changes or when laws or service providers change. When we make a material change, we will:

• Update the Last updated date at the top of this document; and
• Where the change materially affects how personal data is collected or used, notify users via an in-app notice or email.

This Privacy Policy is a transparency notice. The terms that govern your use of the app — including any acceptance of terms — are set out in our Terms of Service and, for customer organizations, in the agreement between AA Labs and the organization.

12. Contact us

For any privacy question, request, or complaint:

• Email: support@workordersapp.app
• Operator: Alberto Arizmendi, operating under the AA Labs brand ("AA Labs" is a brand, not a separate legal entity; no LLC or DBA is claimed).
• Mailing address: available on request via the email above.

Work Orders App is a software product operated by Alberto Arizmendi under the AA Labs brand. This policy is content-complete and pending independent legal review before publication.

We aim to respond to all privacy inquiries within 30 days.

Work Orders App · Privacy Policy · Updated 2026-07-10