HireLogic Privacy Policy

Who is responsible for your data

Which of us is responsible for a given piece of data depends on what it is.

• The Customer is the data controller for the business records it keeps in HireLogic: its customers and their contacts, bookings, hire contracts, deliveries, invoices, payments, photos and signatures, the records of its staff in that data, and the data HireLogic exchanges with the accounting and payment accounts it connects. HireLogic processes that data as the Customer's processor, on its instructions and under our agreement with it. If you work for a Customer, or you are a customer of a hire business that uses HireLogic, contact that business first about this data.
• HireLogic is the data controller for user account and login details, for the subscription and billing details of each Customer, for diagnostic and error data generated by the web platform and the App, and for any correspondence you have with us directly.

What data the platform holds

At a high level, the HireLogic platform holds:

• User accounts. The name, work email address, username, role and default branch or depot of each member of a Customer's staff who uses HireLogic, set up by the Customer. Passwords are stored as one-way hashes, not in readable form.
• Customers and contacts. Names, business names, postal and site addresses, email addresses and phone numbers of the Customer's own customers and their contacts, and any credit account application forms they submit.
• Bookings and jobs. Quotes, bookings, hire contracts, sales, repairs, deliveries and collections, with the items, dates, prices and addresses involved.
• Invoices and payments. Invoices and payment records. For card payments taken through Stripe we store the card brand and the last four digits of the card. Full card details go directly to Stripe and never reach HireLogic.
• Photos, signatures and documents. Photos of equipment, signatures captured on deliveries, collections and contracts, and documents the Customer uploads.
• Emails. A record of emails the Customer sends through HireLogic, such as invoices and quotes, and the delivery status reported by our email provider.
• Equipment telematics. Where a Customer connects telematics, readings from its equipment such as location, operating hours and fuel use.
• Stock and settings. Stock items, products, prices, nominal codes, tax rates and the Customer's settings, including the credentials for its connected integrations.

The web platform

Staff use the web platform in a browser to manage the records listed above. To find and fix faults we use Sentry, an error-monitoring service.

• Error reports. If the web platform hits an error, a report is sent to Sentry. It contains the browser and operating system, the page and action involved, a technical trace and your IP address.
• Session replays. Sentry also records a replay of about one in ten sessions, and of any session in which an error occurs. A replay reconstructs the pages you saw and the actions you took, including on-screen text and what you type into forms, so it can contain business records shown on screen. Images are excluded from replays.

We use error reports and replays only to diagnose and fix problems with HireLogic.

The mobile app

The App is a companion to the web platform for staff of hire businesses. It collects only what it needs to sign you in, do your job and stay working.

• Account details. Your name, email address, username and the HireLogic account you belong to, all set up by your employer. The App stores a session token in your device's secure storage so you stay signed in.
• Business records synced to the device. Stock items, bookings, hire contracts, delivery and collection jobs and the customer contact details and site addresses attached to them. The App keeps a local copy of the records you need so it keeps working without a connection.
• Photos and QR codes. When you use the camera or choose an image from your photo library, the photo is attached to the relevant item or job and uploaded to your employer's HireLogic account. The camera is also used to scan the QR code on an item label. The App does not read or upload other photos on your device.
• Signatures. Signatures captured on a delivery or collection are uploaded to your employer's HireLogic account with the job.
• In-person card payments. Where your employer uses Stripe card readers or Tap to Pay, the App takes card payments through Stripe. Card details go directly to Stripe. HireLogic records the payment, the card brand and the last four digits of the card. If you send a receipt, it is emailed to the address you enter.
• Diagnostic and crash data. If the App crashes or hits an error, a report is sent to Sentry. A report contains the device model and operating system version, the App version, the time of the error, a technical trace of what the App was doing, the screen you were on, and your HireLogic user ID, username, email address and business account, so that we can match a fault to the account it affected. The App also sends Sentry performance timings, such as how long screens take to load.

The App does not read your contacts, use the microphone, or use advertising identifiers. It contains no advertising and does not track you across other apps or websites. HireLogic does not store your device location.

Mobile app permissions

• Camera. Requested the first time you take a photo or scan a QR code. Deny or revoke the permission in your device settings and the App works normally except for those features.
• Photo library. Requested only if you choose to attach an existing image rather than take a new one. On recent versions of iOS and Android you can limit access to the images you select.
• Location. Requested only for in-person card payments. Stripe requires location access to connect to a card reader and take a payment, and receives your location for that purpose. The App works normally without it except for card payments.
• Bluetooth and local network. Used by Stripe to connect to supported card readers.
• Network access. Used to sync with HireLogic, take payments and send crash reports.

Online shopfronts and customer portals

A Customer can publish an online shopfront or customer portal through HireLogic, where its own customers browse equipment, place orders, submit forms, view their bookings and pay. The data you enter there, such as your name, contact details, addresses, orders and account application details, goes to that hire business, which is its controller. HireLogic hosts the shopfront as the business's processor.

• Card payments on a shopfront are taken by Stripe on the hire business's own Stripe account. Card details go directly to Stripe.
• Some shopfront forms use Cloudflare Turnstile to check that the person submitting them is not an automated program. Cloudflare receives technical information about your browser for that check.

Accounting and payment integrations

A Customer can connect HireLogic to its own accounts with QuickBooks Online, Xero, Sage, Zoho Books, Big Red Cloud and Stripe. HireLogic only accesses an account after the Customer connects it, and only exchanges the data needed to run the integration.

QuickBooks Online. When connected, HireLogic uses the QuickBooks accounting API to:

• read the company's preferences, to confirm its home currency matches HireLogic's;
• read the chart of accounts, tax codes and tax rates, so the Customer can map HireLogic's nominal codes and tax rates to them;
• read customers, and import them into HireLogic, both when the Customer asks and by checking regularly for customers changed in QuickBooks. Imported details are name, company name, email address, phone numbers and billing address;
• read products and services (inventory and non-inventory items) and import them into HireLogic as products;
• create and update customers, with the same details listed above;
• create and update items, with name, SKU, description, sale price, cost, income and expense accounts and tax codes;
• create and update invoices for the Customer's hire contracts, sales and repairs, with the customer, invoice number, dates, line descriptions, amounts, tax codes, purchase order number and a link to the invoice in HireLogic;
• create, update and delete payments against those invoices, with the amount, date, payment method, deposit account and invoice reference.

Xero, Sage, Zoho Books and Big Red Cloud. HireLogic exchanges the same kinds of data: it reads accounts, tax rates and, where supported, customers and products, and creates customers, invoices and, where supported, products and payments in the Customer's accounting software.

Stripe. A Customer connects its own Stripe account so that it can take card payments online, by payment link, on card readers and with Tap to Pay. HireLogic creates payments on that account and receives the payment status, card brand and last four digits of the card. Stripe processes card payments under its own agreement with the Customer.

• Credentials. The access tokens or API keys for QuickBooks Online, Xero, Sage, Zoho Books and Big Red Cloud are stored in the Customer's own HireLogic database. The Stripe access token is stored in HireLogic's account database. We use them only to make the API calls described here.
• Use. Data from a connected account is used only to provide the integration to the Customer. We do not sell it, use it for marketing or advertising, or share it with anyone except as described in this policy.
• Disconnecting. A Customer can disconnect QuickBooks Online, Xero or Zoho Books at any time from Settings in HireLogic. Disconnecting deletes the stored tokens and the integration's settings and mappings, so HireLogic can no longer reach the account. For QuickBooks Online, disconnecting also revokes HireLogic's authorisation with Intuit. HireLogic can also be removed from the connected apps in QuickBooks, Xero or Zoho. Sage and Big Red Cloud are connected by our team with a key the Customer provides, and Stripe can be disconnected from the Stripe Dashboard; to disconnect any of them, contact us at info@hirelogic.co.uk.
• After disconnection. Records already exchanged stay where they are: customers and products imported into HireLogic remain part of the Customer's records in HireLogic, and invoices, payments and other records created in the accounting software remain there. HireLogic does not delete records from the accounting software when it is disconnected.

How we use your data

• To provide the HireLogic service to Customers: signing users in, showing them the records they have access to, syncing changes from the App, hosting shopfronts and running the integrations they connect.
• To send the emails a Customer asks HireLogic to send, such as invoices, quotes and receipts.
• To look up and complete addresses and to work out delivery distances.
• To find and fix faults using error reports, replays and diagnostic data.
• To respond to support requests and to notify Customers and users about security or service issues.

We do not use personal data for marketing to a Customer's customers, for profiling or for automated decision-making, and we do not sell it.

Our legal basis

Where HireLogic is the controller, we rely on the following bases under the UK GDPR and the Data Protection Act 2018:

• Performance of a contract: providing the HireLogic service to the Customer, which includes managing its users' access.
• Legitimate interests: keeping the web platform and the App secure, reliable and free of faults. We have weighed this against your interests and limit diagnostic data to what we need to find and fix faults.
• Legal obligation: where we must keep or disclose data to comply with the law.

Where HireLogic processes business records on behalf of a Customer, the Customer is responsible for the legal basis and for telling its staff and customers how it uses their data.

Who we share data with

We share personal data only with the following, and only as far as needed to provide the service:

• The Customer, who can see the records, photos and signatures created in its HireLogic account.
• DigitalOcean, which hosts HireLogic's databases and file storage.
• Mailgun, which delivers emails sent from HireLogic.
• Sentry (Functional Software, Inc.), which receives error reports, session replays and diagnostic data as described above.
• Google, whose Maps Platform we use to look up addresses and calculate delivery distances.
• Cloudflare, which provides the automated-submission check on shopfront forms.
• The accounting and payment services a Customer connects, which receive the data described in the integrations section on the Customer's instructions.
• Professional advisers, regulators or law enforcement where we are legally required to disclose data.

Each provider that processes data for us acts on our instructions and may only use the data to provide its service to us.

International transfers

HireLogic is based in the United Kingdom. Some of our providers are based in, or process data in, other countries, including the United States. Sentry stores our error reports in its EU region. Where personal data leaves the UK we rely on a UK adequacy decision or on the UK International Data Transfer Agreement or Addendum, together with any further safeguards required, so that your data has equivalent protection.

How long we keep data

• User account details are kept while the Customer's subscription is active and the account is enabled, and are deleted or anonymised within 90 days of the account or the subscription being closed.
• Business records, photos and signatures are kept for as long as the Customer keeps them in HireLogic. When a subscription ends we delete or anonymise them within 90 days, unless the law requires us to keep them.
• Integration credentials, settings and mappings are deleted when the integration is disconnected. Otherwise they are deleted with the rest of the Customer's data within 90 days of the subscription ending.
• Error reports, session replays and diagnostic data are kept by Sentry for no more than 90 days and then deleted automatically.
• Cached records on a mobile device are cleared when you sign out of the App. Work you have completed but not yet synced, such as photos, signatures and payment receipts, stays on the device until it is uploaded. Everything the App stores is removed when you uninstall it.

Security

Data moving between your browser or the App and HireLogic is encrypted in transit. Each Customer's business records are held in a separate database. Passwords are stored as one-way hashes, and card details are handled by Stripe and never stored by HireLogic. On a mobile device, the App keeps its data in its private storage and its session token in the device's secure storage. Keep your device locked and sign out of the App if the device is shared or leaves your possession.

Your rights

Under UK data protection law you have the right to ask for a copy of the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Some rights are limited where we need to keep data to provide the service or meet a legal obligation.

To exercise a right in relation to data HireLogic controls, email info@hirelogic.co.uk. We will respond within one month. For business records controlled by a Customer, contact that business; we will help it respond.

You can also complain to the Information Commissioner's Office at ico.org.uk. If you are outside the UK, you may have similar rights under your local law and can raise them with us in the same way.

Children

HireLogic is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children.

Changes to this policy

We will update this page if HireLogic starts collecting new data or using it differently, and will change the effective date above. Where a change materially affects you we will also tell you in HireLogic, in the App or through the Customer.

Contact us

HireLogic Ltd, Belfast, Northern Ireland. Email: info@hirelogic.co.uk.