Privacy Policy

Airmaintix is operated by Matum Soluções Inteligentes LTDA, [registered address], Brazil, [company registration number]. We are the controller of the data described in this Policy, except where section 2 says otherwise.

• Privacy contact: contact@airmaintix.com
• EU representative: [EU representative under Art. 27 GDPR — to be appointed]
• UK representative: [UK representative under Art. 27 UK GDPR — to be appointed, if required]
• Data protection officer: [DPO — if appointed]

As controller, we process data about our own customers and website visitors: account holders and users, billing contacts and people who contact us.

As processor, we process the personal data that our customers enter into the Service about their own clients, sites and staff — for example their clients' names and contact details, technicians' names, photos taken on site and signatures captured on screen. For that data, the customer (the HVAC/R company) is the controller, and we process it only on its documented instructions under our Data Processing Agreement (DPA). If you are a client or employee of one of our customers, please contact that company to exercise your rights; we will help them respond.

• Account data: name, email address, password (stored as a secure hash), role, language and profile settings.
• Company data: company name, tax ID (for example VAT number or EIN), address, phone number, logo, currency, units and time zone.
• Content you enter: clients, sites, equipment, employees, materials, work orders, checklists, compliance plans, refrigerant records, quotes and financial entries.
• Photos and signatures: images taken with the camera or chosen from the gallery, and signatures drawn on screen, used to document the work.
• Billing data: plan, invoices and subscription status. Card and bank details are processed by Stripe; we only receive references such as the card brand and last digits.
• Quote responses: when a client responds to a quote link, their name, the date and time and the IP address are recorded as confirmation.
• Usage and device data: IP address, browser and device type, pages visited, app version, logs and error reports.
• Communications: messages you send to support and our replies.

We do not collect your precise location (GPS).

• Providing the Service — creating your account, running the features, generating PDFs, syncing the mobile apps and sending transactional emails (account confirmation, password reset, billing notices). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Billing, accounting and tax — invoices, VAT and sales tax, record-keeping. Legal basis: performance of a contract and compliance with legal obligations (Art. 6(1)(b) and (c) GDPR).
• Security and fraud prevention — authentication, rate limiting, logs and error monitoring. Legal basis: our legitimate interest in keeping the Service secure (Art. 6(1)(f) GDPR).
• Support and product improvement — answering requests and understanding, in aggregate, how features are used. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
• Analytics cookies and marketing emails — only with your consent where consent is required (Art. 6(1)(a) GDPR). You can withdraw consent at any time.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

• Camera: to take photos for work orders and to scan the QR labels on equipment.
• Photos / gallery: to attach images that are already on the device.
• Storage on the device: to keep jobs and checklists available offline until they sync.

Permissions are only used when you start the related feature, and you can revoke them in the device settings.

We use cookies and local storage that are strictly necessary for the Service to work, such as the session cookie, the language preference (amx_locale) and the light/dark theme. Where enabled, we use Google Analytics and Google Tag Manager to measure how the website is used; in the EU/EEA, the UK and Switzerland these analytics cookies are only set with your consent, and you can change your choice at any time [cookie settings — to be implemented].

We do not sell personal data. We share it only with service providers that process it on our behalf under contracts that include data protection terms:

• Supabase — database, authentication and file storage.
• Vercel — hosting of the web application.
• Stripe — payments, subscriptions and tax calculation.
• Resend — delivery of transactional email.
• Sentry — error monitoring.
• Google (Analytics / Tag Manager) — website analytics, where enabled.
• [Other providers — list to be confirmed]

Our up-to-date list of sub-processors, with the regions where they process data, is available on request. We may also disclose data where required by law or court order, to protect our rights, or to a successor in a merger or acquisition, subject to this Policy.

Matum Soluções Inteligentes LTDA is established in Brazil, and some of our providers process data in the United States and other countries outside the European Economic Area (EEA). When personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) — with the UK Addendum where applicable — or, for certified US providers, on the EU-U.S. Data Privacy Framework, together with supplementary measures where needed. You can request a copy of the relevant safeguards at contact@airmaintix.com.

• Account data and Customer Data: while the subscription is active; after the account is closed, deleted or anonymized within [number] days.
• Trial accounts without a subscription: deleted [number] days after the trial ends.
• Billing and tax records: for the period required by tax and accounting law (up to [10] years).
• Logs and error reports: up to [number] days.
• Backups: overwritten on a rolling cycle of [number] days.

Our customers decide how long the data they enter is kept, within the limits of their subscription.

We protect personal data with technical and organizational measures appropriate to the risk, including encryption in transit (TLS), isolation of each company's data enforced in the database, role-based access control, least-privilege access for our staff, monitoring and regular backups. No system is completely secure; if a personal data breach affects you, we will notify you and the competent authorities as required by law.

Where the GDPR applies, you have the right to:

• access your personal data and receive a copy;
• have inaccurate data rectified;
• have your data erased;
• restrict processing;
• receive your data in a portable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, without affecting processing carried out before;
• lodge a complaint with a supervisory authority, in particular in the country where you live or work (for example the AEPD in Spain or the data protection authority of your federal state in Germany).

To exercise your rights, write to contact@airmaintix.com. We reply within one month, which may be extended where the law allows. We may ask you to confirm your identity.

This section applies to residents of California.

• Categories collected in the last 12 months: identifiers (name, email address, IP address); commercial information (plan and billing history); internet or network activity (usage data and logs); professional information (company and role); and visual information (photos and signatures).
• Sources: you, your company's account administrator, your devices and our service providers.
• Purposes: the business purposes described in section 4.
• Disclosure: to the service providers listed in section 7, for business purposes.
• Sale and sharing: we do not sell personal information and do not share it for cross-context behavioral advertising. We do not knowingly sell or share personal information of consumers under 16.
• Sensitive personal information: account login credentials are used only to provide the Service, not to infer characteristics about you.
• Retention: see section 9.

You have the right to know what personal information we collect, use and disclose; to request deletion; to correct inaccurate information; to opt out of the sale or sharing of personal information (which we do not do); to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. You can submit a request by email to contact@airmaintix.com [toll-free number — if required]. You may use an authorized agent; we verify requests by matching the information we already hold.

The Service is intended for businesses and professionals. It is not directed to children, and we do not knowingly collect personal data from anyone under 16.

We may update this Policy. The date of the latest version appears at the top of this page, and we will inform you of material changes by email or in the Service before they take effect.

Matum Soluções Inteligentes LTDA · [registered address] · Brazil
Privacy contact: contact@airmaintix.com
EU representative: [EU representative under Art. 27 GDPR — to be appointed]