Privacy Policy

When you create an account, we collect and store:

• Identity: Full name, email address, phone number, company name, business address, website
• Professional: Inspector license number, certifications, profession type (mold inspector, home inspector, remediator, plumber)
• Authentication: Email + password (hashed), or Google OAuth token. We never see your Google password.
• Branding: Company logo URL, company contact details for report headers

We use this to create and manage your account, display your branding on reports, and communicate with you about your subscription.

Inspectors enter client information into reports and appointments. This includes:

• Client name, email address, phone number, SMS carrier (for text receipts)
• Property address (full street, city, state, ZIP)
• Property type (residential / commercial)
• Client portal PIN (for self-service access)

Client data is used to generate inspection reports, send invoices and reminders, and provide client portal access. Each inspector's client data is private to that inspector — other inspectors cannot see it.

Reports contain professional findings, which may include:

• Photos (inspection, thermal, floor plans), uploaded as image files
• Environmental readings (temperature, humidity, moisture, VOC, wind speed)
• Lab results (mold species, spore counts, analysis methods, determinations)
• Findings, recommendations, risk assessments, scope narratives
• Service items and billing amounts
• Electronic signatures (signature image, signer name, timestamp, IP address, user agent)
• Remediation tables, plumbing checklists, home inspection section findings

This data is used to generate professional PDF reports for your clients and to track inspection history by property.

We do not store your full credit card number. Payment data is handled as follows:

• Subscription billing: Your card is tokenized via NMI Collect.js and stored as a vault token + last 4 digits + card type. The full card number never touches our servers.
• Payment processor credentials: Inspectors who configure their own Stripe or ECS account enter API keys, which are stored securely and used only to route client payments to the inspector's own merchant account.
• Bank details: Optional bank name, routing number, and last 4 digits of account — shown to clients as a direct transfer option.
• Transaction records: Payment amounts, dates, providers, and balance changes are logged for accounting and audit purposes.

When you use scheduling and route optimization:

• Property addresses are geocoded via OpenStreetMap to GPS coordinates (cached for performance)
• Live travel status (en route, paused, arrived) and elapsed travel time are logged per appointment
• Counties crossed are tracked for travel fee calculation
• Neighborhood risk analysis scans a 500m radius around properties using cached coordinates

GPS coordinates are derived from addresses — we do not track your real-time device location unless you explicitly use the travel status feature.

Your data is shared with these third parties to provide core functionality:

• Stripe / ECS (NMI): Process client payments and subscription billing. They receive payment amounts and vault tokens. Your card data is governed by their PCI-compliant infrastructure.
• Resend: Email delivery service for invoices, reminders, report links, and receipts. Receives recipient email addresses and email content.
• Google: OAuth login (if you choose "Continue with Google") and Google Calendar sync (if you connect it). Google receives your OAuth token and calendar event data per Google's privacy policy.
• OpenStreetMap / Nominatim: Address geocoding for route optimization and maps. Receives property addresses for coordinate lookup.
• AI / LLM providers: When you upload lab reports for AI extraction, the document content is sent to an AI model to extract structured data (lab name, species, spore counts, etc.). The extracted data is stored in your account.
• Carrier email-to-SMS gateways: When sending text receipts, we send an email to your client's carrier gateway (e.g. number@vtext.com). The carrier receives the phone number and message content.

We do not sell your data to any third party. We do not use your data for advertising.

Your data is retained as follows:

• Active accounts: All data is kept for as long as your account is active.
• Trial non-payment: If your free trial ends without payment, your account data is saved for 30 days (grace period). The day after that window, your account is permanently deleted.
• Cancelled accounts: If you cancel your subscription, your data remains accessible until the end of your current billing period, then enters the 30-day grace window before deletion.
• Deleted accounts: Once deleted, your data cannot be recovered. A fingerprint (name, email, company) is retained solely to prevent free-trial abuse — no inspection or client data survives deletion.

You have the following rights regarding your data:

• Access: You can view all your data through the app at any time.
• Export: Export your reports to CSV from the dashboard bulk-select menu.
• Delete: Cancel your subscription in Settings → Subscription. Your account enters the grace period and is permanently deleted after 30 days.
• Correct: Edit your profile, company info, and report data at any time within the app.
• Withdraw consent: Disconnect Google Calendar sync or payment processors at any time in Settings.

We protect your data with industry-standard measures:

• All data is transmitted over HTTPS (encrypted in transit)
• Payment card data is tokenized by NMI Collect.js — full card numbers never reach our servers
• API keys and secrets are stored server-side and never exposed to the client browser
• Each inspector's data is isolated — other inspectors on the platform cannot access your reports, clients, or settings
• An active security scanner monitors for malware, injection attacks, and data exfiltration patterns in stored data
• Row-level security enforces that users can only access their own records

SimpleScope is a professional business tool for licensed inspectors and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

To request immediate deletion of your account and all associated data (before the 30-day grace period expires), contact us using the information below. We will process your request within 30 days. Note that some data may need to be retained for legal/accounting compliance (e.g., payment records for tax purposes) where required by law.

If you have questions about this privacy policy or your data, please contact:

We may update this privacy policy from time to time. The effective date at the top of this page indicates when it was last revised. Material changes will be communicated through the app. Continued use of the service after changes take effect constitutes acceptance of the updated policy.