Privacy Policy

1. Who we are and what this covers

Peak Director LLC is a Colorado limited liability company. It makes Peak Director, business software for field service companies. Peak Director includes the owner and office screens, the technician app, the customer portal, and the website at PeakDirector.com.

This policy explains what information Peak Director handles, why, who it is shared with, and the choices available. "We" and "us" mean Peak Director LLC. A "company" is a business that uses Peak Director. A "user" is a person who signs in for a company, such as an owner, office staff member or technician. A "customer" is a person or business that a company serves.

2. Whose information this is

Each company decides what information about its own staff, customers, properties and jobs it enters into Peak Director and how it uses that information. For those business records, the company is the controller of the information and Peak Director LLC is its processor and service provider: we process the information only on the company's behalf, under its instructions and the Terms, and not for our own purposes.

Peak Director LLC is responsible for the information it uses to run the service itself, such as company account details, user sign in records, billing records for Peak Director subscriptions, and support correspondence.

If you are a customer of a company that uses Peak Director, that company's own privacy practices also apply to you. Questions about your records are best sent to that company first. We will help the company respond.

3. Information the software handles

Company account information

• Business name, logo, brand colors, business profile and contact details.
• Owner and staff accounts and the role each person holds in the company.
• Subscription and billing records for Peak Director.

User information

• Name, email address, phone number and role.
• Sign in records. Users sign in with a one-time code sent by email or, in some versions of the technician app, with a personal passcode. Sensitive owner functions also require a second sign in step, such as an authenticator app code or a passkey. For a passkey, the server stores only the public key; the fingerprint, face or device unlock used to approve it stays on the user's device and is never sent to Peak Director.
• Work records a user creates, such as job notes, readings, checklists, time clock entries, materials used and tool assignments.
• Hourly pay rates, if a company owner enters them. Pay rates are limited to owners.

Customer and job information entered by a company

• Customer name, phone number, email address and service address.
• Property and equipment details, such as equipment type, model and serial numbers.
• Service requests, appointments, job history, service reports, estimates, invoices and payment status.
• Photos taken on jobs and signatures captured on documents.
• Text message history and the record of a customer's consent to receive service text messages, if the company turns on text messaging.

Photos

Photos are resized and saved again on the user's device before upload. This step removes the embedded information that cameras add to photo files, including GPS location. Photos are stored with the job and report they belong to.

Location

Peak Director does not collect GPS or device location. A technician's arrival at a site is recorded by a manual check in, not by tracking the device. When a user taps a service address for directions, the address opens in Google Maps, and Google's own privacy terms apply to that use.

Technical information

• Our hosting providers may record standard request information, such as IP address, browser type and the time of each request, to operate and protect the service.
• Peak Director keeps an audit record of sensitive actions inside a company, such as changes to staff access and resets of sign in factors.

4. QuickBooks Online

Where the QuickBooks Online connection is available, a company owner can choose to connect the company's QuickBooks Online account. Connecting is optional. Only an owner who has completed the second sign in step can connect.

• What is read. Peak Director reads two things from QuickBooks Online: invoices that have an unpaid balance, and the Accounts Receivable aging report. These are used to show the owner unpaid invoices and amounts owed by customer.
• Read only use. Intuit's connection screen asks for access to accounting data, which is broader than what Peak Director uses. Peak Director only reads. It does not create, change or delete anything in QuickBooks Online.
• When it is read. QuickBooks figures are read when the owner opens or refreshes them. Peak Director does not save those invoice records into its own database.
• Connection credentials. The access and refresh tokens Intuit issues are encrypted with AES-256-GCM before they are stored. The encryption key is held in the server configuration, separate from the database. Tokens are never sent to the browser or the phone. Each stored connection is tied to one company and one QuickBooks company, and cannot be used for another.
• Who can see it. QuickBooks figures are shown only to owners of the connected company.
• No sale or other use. We do not sell QuickBooks data, do not use it for advertising, and do not share it with anyone other than the connected company, except the hosting providers listed in Section 11 that run Peak Director. We use it only to show the company its own figures.
• Disconnecting. A company can end Peak Director's access to QuickBooks Online at any time in any of these ways: from its QuickBooks Online account, under Integrations, Manage integrations, then Disconnect on Peak Director; by emailing us at elliot@PeakDirector.com; or, where available, by selecting Disconnect QuickBooks in Books in Peak Director. Once access is revoked, Peak Director can no longer read the company's QuickBooks data.
• Deleting the connection. Disconnecting in Books revokes the connection with Intuit and deletes the stored connection tokens at once. If access is revoked from QuickBooks Online instead, the stored tokens stop working at once, and we delete them when the owner selects Disconnect QuickBooks in Books, when the owner asks us, or when the company's account closes, whichever comes first.

QuickBooks and QuickBooks Online are trademarks of Intuit Inc. Peak Director is not made, endorsed or sponsored by Intuit.

5. Google Calendar

Where Google Calendar sync is available, a company can choose to sync jobs from a work calendar in its own Google account. When it does, Peak Director reads events from the calendar the company selects, such as the event title, time, location and description, and turns them into jobs. Calendar sync reads only. It does not add, change or delete calendar events.

Peak Director's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar information is used only to create and update that company's jobs. It is not sold, not used for advertising, and not shared except with the service providers listed below as needed to run the service.

Some companies run part of Peak Director through a relay built on Google Apps Script in the company's own Google account. For those companies, job records, technician app data and service emails pass through and are stored in that company's Google account, under Google's terms and the company's control.

6. Payments

Where card payments are turned on, card payments, by a company's customers for invoices and by companies for Peak Director subscriptions, are handled by Stripe on payment pages that Stripe hosts. Card numbers are entered on Stripe's pages and are not received or stored by Peak Director. Peak Director stores the payment record: amount, currency, status, date and Stripe's reference numbers.

7. Text messages and email

Where text messaging is available, a company can choose to turn it on. When it does, service text messages are sent through Twilio from the company's own number. Messages are sent only to customers whose consent to receive service updates is on record. A customer can reply STOP to stop messages; the opt out is recorded and further messages to that number are blocked. Message content and delivery status are stored with the company's records.

Service emails, such as visit reports, estimates and invoices, are sent on the company's behalf and identify the company. Sign in codes are sent by our sign in provider.

The company that sends a text message or email through Peak Director is its sender. It decides which messages its customers receive and is responsible for having consent where the law requires it and for honoring requests to stop. Peak Director does not send marketing messages to a company's customers.

8. Cookies and device storage

Peak Director uses three cookies, all required for signing in: one that holds the signed in session, one that renews it, and one that protects forms against forged requests. They are limited to the Peak Director site and cannot be read by page scripts.

The technician app stores app files and work in progress on the device so that it keeps working without a signal, such as in a basement or on a roof. That information is sent to the server when a connection returns.

Peak Director does not use advertising cookies, tracking pixels or third party analytics.

9. How we use information

• To provide Peak Director to each company and its users and customers.
• To sign users in and protect accounts.
• To keep each company's records separate and secure.
• To bill companies for Peak Director subscriptions.
• To answer support requests, when the company asks us to look at its records.
• To find and fix errors and to improve the software.
• To comply with law and respond to valid legal requests.

10. What we do not do

• We do not sell personal information or company data.
• We do not show advertising in Peak Director and do not use any information for targeted advertising.
• We do not share one company's records with another company.
• We do not contact a company's customers for our own purposes.

11. Service providers

We use the following providers to run Peak Director. Each receives only what it needs for its role.

Information is handled by service providers that may process data in the United States. We use providers whose terms commit them to protect the information they handle. We will update this list before a new provider begins to receive company data, and a company may object by writing to us.

We may also disclose information when required by law or valid legal process, to protect the safety or rights of any person, or as part of a merger, sale or transfer of the business, in which case this policy continues to apply to the information transferred.

12. Separation between companies and customers

• Every record in Peak Director belongs to one company. Peak Director is designed so that access to records depends on membership in that company, and so that a user of one company does not see another company's records.
• Inside a company, what a user can see is designed to depend on the role the owner gives them. For example, owner only areas such as QuickBooks figures and pay rates are meant for owners, not technicians.
• The customer portal is designed to show a customer only that customer's own reports, invoices and requests.

We review and test these controls and correct any gap we find. If a gap exposes a company's information, Section 17 applies.

13. Security

• All connections use HTTPS.
• Sensitive owner functions, such as connecting QuickBooks Online, require a second sign in step.
• Session cookies cannot be read by page scripts, and forms are protected against forged requests.
• QuickBooks connection tokens are encrypted by Peak Director before they are stored.
• Payment card details are handled by Stripe and never reach Peak Director.
• Sign in rate limits slow repeated attempts.

We do not claim any third party security certification. No system is perfectly secure. We review and improve these measures over time.

14. Retention, export and deletion

• We keep a company's records while its Peak Director account is active.
• A company owner can download some records, such as reports and service history, from within Peak Director, and can ask us for an export of all of the company's records in a common file format.
• After a company's account closes, we delete the company's records, or return them to the company on request, within 30 days, except where the law requires us to keep certain records longer.
• QuickBooks connection tokens are deleted when the connection is disconnected, as described in Section 4, and in any case when the company's account closes. QuickBooks invoice figures are not stored, so there is nothing further to delete.
• Copies held in our providers' backups are removed as those backups expire on the providers' schedules. Until then they are kept secure and are not used.
• A company can ask us to delete a specific user's or customer's information, and we will do so unless the law requires us to keep it.

15. Privacy rights and requests

Depending on where you live, you may have the right to know what personal information is held about you, to get a copy of it, to correct it, and to have it deleted.

• Customers of a company should send requests to that company. We will help the company respond. If you contact us directly, we will refer the request to the company and assist it.
• Users and company owners can send requests to their company or to us at the address below.

The Colorado Privacy Act and similar state laws give rights to individuals acting in a personal or household capacity. They generally do not cover information about people acting in a business or employment role. We honor reasonable requests either way. We respond within 45 days, and will tell you if we need up to 45 more days. We do not sell personal information or use it for targeted advertising, so there is nothing to opt out of for those purposes. We will not treat anyone differently for making a request.

We may need to confirm your identity before acting on a request. If we decline a request, we will tell you why, and you may ask us to reconsider by replying to our answer.

16. Children

Peak Director is business software for companies, their staff and their customers. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it.

17. Security incidents

If we learn of unauthorized access to a company's information, we will notify the affected company in the most expedient time possible and without unreasonable delay. We will cooperate with the company and give it the information we have that it needs for any notice it owes to its users, its customers or regulators. Where QuickBooks data is involved, we will also notify Intuit as required. For information we are responsible for ourselves, we will give any notice the law requires, including notice to affected Colorado residents within the time Colorado law sets.

18. Changes to this policy

We may update this policy as the software changes. The effective date at the top shows the current version. We will notify company owners of material changes by email or in Peak Director before they take effect.

19. Contact

Peak Director LLC
Email: elliot@PeakDirector.com
Website: PeakDirector.com

See also the Terms of Service and End User License Agreement.