Privacy Policy

1. Who we are

Prospura ("Prospura," "we," "us") provides the Service Intelligence Engine — a business operating engine that connects to the systems small and mid-sized service businesses already run and turns their data into decisions, alerts, and ready-to-send work. This policy explains what data we collect, why, and the choices you have.

2. Data we collect

• Account data. Name, business name, email address, and phone number you provide when you contact us, book a demo, or create a workspace.
• Connected-system data. When you connect a source (accounting, CRM, field service, HR, and similar), Prospura syncs operational records — jobs, invoices, estimates, customers, schedules — through read-only access. We do not write data back to your systems.
• Credentials. OAuth tokens and API keys used to connect your sources are encrypted at rest with AES-256 and are never displayed back to anyone, including you.
• Usage data. Standard logs (pages viewed, features used, device and browser information) that help us keep the service reliable and secure.

3. How we use your data

• To operate the engine: your AI analysts read your synced data to produce insights, alerts, drafts, and recommendations for your workspace only.
• To provide support, respond to inquiries, and administer pilots and contracts.
• To secure the service, prevent abuse, and meet legal obligations.

We do not sell your data, and we do not use your business data to build products for anyone else. Your operational data stays inside your workspace.

4. Workspace isolation

Every customer workspace is isolated. Data synced from your systems is scoped to your workspace and is never visible to, or blended with, any other customer's workspace.

5. Your control: disconnect and purge

You can disconnect any connected source at any time. When you disconnect, you may request that every record synced from that source be purged from Prospura. You can also request deletion of your entire workspace.

6. GDPR and data-subject rights

Where the GDPR or similar laws apply, you (and the individuals whose data appears in your connected systems) have the right to access, export, correct, and erase personal data. Prospura supports data export and erasure requests as a built-in capability. To exercise any right, email ruthann@prospura.com and we will respond within 30 days.

7. Retention

We retain synced data while a source remains connected and for a short operational window afterward, unless you request an earlier purge. Account and contract records are kept as required for legal and accounting purposes.

8. Security

• Read-only connector access — nothing written back to your systems.
• AES-256 encryption for credentials and data at rest; TLS in transit.
• Per-workspace isolation and least-privilege internal access.

9. The Prospura mobile app (iOS and Android)

The Prospura mobile app is a companion to your web workspace and follows this same policy. Here is exactly what it collects and why.

• Your account. The app signs you in with the login your company's administrator set up. It shows what your role allows: an owner sees the whole business; a technician sees their truck and their work. Session tokens are stored in the operating system's secure keychain or keystore on your device.
• Notifications. If you turn on notifications, your phone gives us a push token so we can send you alerts. We attach it to your login and remove it when you sign out.
• Location — technicians only, on shift only. The app can share your truck's position with your company, but only when all of these are true: your company has turned location sharing on, you are signed in as a technician, and you have tapped Start shift. While you are on shift the app sends a position about once a minute, including when the app is closed or not on screen, and your phone shows its location indicator or a notification the whole time. Tapping End shift, signing out, or requesting account deletion stops it, and a shift left open is closed automatically after your company's shift limit. Positions are recorded against your truck, not against you as a person. We also keep a log of when you started and stopped sharing — times only, no positions. We keep the truck's latest position and a 24-hour trail; older points are deleted automatically. Your company decides whether to use this feature and may make it a condition of starting a shift; Prospura does not make that decision and does not collect your location outside a shift. Owners, administrators and managers never share location through this app.
• Camera. When you tap Identify parts from a photo on a truck's screen and take a photo, the photo is sent securely to our AI provider, Anthropic, to identify parts or read an equipment label. The result is a suggestion for you to confirm or correct — nothing is added to your inventory until you tap Confirm, and only parts already in your company's parts list can be recorded. Prospura does not store the photo, and the app deletes its copy from your phone right after. Anthropic deletes the photo from its systems within 30 days under its standard terms (longer only where the law requires or to enforce its usage policy) and does not use it to train its models. The app never reads your photo library.
• AI analysts. When you ask an analyst a question, the question and the business data it needs are sent to Anthropic, our AI provider, and the answer comes back to you. Anthropic does not use this data to train its models.
• Fleet map. The map on the Fleet tab is drawn by our server using Mapbox. Mapbox receives your trucks' coordinates from our server to draw the picture; it never receives your name, your login, or your phone's address.
• Crash reports. If the app crashes, a report goes to Sentry so we can fix it. Reports carry no name, email, or IP address.
• Updates. The app checks Expo's update service for small fixes we can ship without a store release. That check carries the app version and a device identifier Expo generates, and none of your business data.
• Face ID and fingerprint. If you use Face ID or a fingerprint to unlock the app, the check happens on your device. Prospura never receives your biometric data.
• What the app does not do. It does not read your contacts, photo library, or microphone, and it does not use your motion or fitness data. It has no ads and no advertising identifier, and it does not track you across other companies' apps or websites. We do not sell your data.
• Demo mode. Demo mode uses only fictitious sample data and requires no account; no personal information is collected in demo mode.
• Children. The app is a business tool and is not directed to children under 13 (or the equivalent minimum age in your jurisdiction).
• Deleting your account. Your login is managed by your company's administrator, who can remove it at any time. You can also request deletion in the app (Settings → Request account deletion) or by emailing privacy@prospura.com from the address on the account. A request stops location sharing and notifications on your phone and signs you out, and we complete the deletion within 30 days. Business records belong to your company and are kept or purged under your company's agreement with us.

Service providers for the mobile app.

• Anthropic — analyst questions and the business data needed to answer them; photos taken for part identification.
• Mapbox — truck coordinates, sent from our server, to draw the fleet map.
• Expo (Expo Application Services) — push tokens, app version, and update checks.
• Apple Push Notification service and Firebase Cloud Messaging — push tokens and notification content, to deliver notifications.
• Sentry — crash and diagnostic reports without user identifiers or IP addresses.
• Railway — hosts the Prospura API, so all app traffic, including the device's IP address, passes through it.

10. Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with a new "last updated" date.

11. Contact

Prospura
1 East Erie St, Suite 525-4346
Chicago, IL 60611
ruthann@prospura.com