Privacy

The short version

• SwimSorted is an app that pool-service companies use for their work.
• The pool company is in charge of its own records. We look after them on its behalf.
• We collect as little as we can.
• We never sell anyone’s information, and we don’t use it for advertising.
• Street addresses and customers’ phone numbers stay on the phone they were saved on. They aren’t stored on our server.
• When a phone is in a company’s team, its visit photos are kept in that company’s private storage. A customer sees only the photos the tech chooses, of their own visit.
• Live location is off unless the company switches it on. Only the latest position is kept.
• Used without signing in, the app keeps everything on your phone and sends nothing to us.
• You can delete your account in the app or by email.

Who we are

SwimSorted is made in Auckland, New Zealand. In this policy, “we” and “us” means SwimSorted Limited (being registered), Auckland. For anything about privacy, email [email protected]. That inbox is read by our privacy officer.

Who this covers

1. Pool-service companies and their staff (owners, managers and techs) who use the SwimSorted app.
2. Their customers (pool owners) who get a visit report or open a visit link.
3. People who visit our website or email us.

What we collect, and why

Only when you sign in to your company’s team. Used on its own, the app keeps everything on your phone.

What stays on your phone

These are never stored on our server:

• street addresses, and the map pin for each pool;
• customers’ phone numbers;
• the customer names you use in Xero or MYOB, when you type them on the phone (the office’s are kept for the company, as above);
• visit photos, when the app is used on its own (see Visit photos);
• your company logo and the contact details printed on reports;
• the sound of your voice: saying readings out loud uses your phone’s own speech recognition (from Google, on Android, under Google’s terms). SwimSorted only gets the words. Voice isn’t offered on iPhone.

Every photo has its location data (EXIF and GPS) removed on the phone before it’s saved or sent.

Visit photos

• Used on its own, the app keeps visit photos on your phone only.
• When your phone is in a company’s team, each visit’s photos are uploaded with the visit to that company’s private storage on our server (Supabase, in Sydney, Australia). That way a lost phone doesn’t mean lost proof of the work. Photos from visits saved before the phone joined a company stay on the phone.
• Who can see them: the company’s owner, managers and staff, the same people who can see the visit. Nobody in any other company. They’re never public.
• Customers see only the photos the tech chooses to show them (none, unless the tech picks them, because a photo can show a gate code or a house number). They see them only on the link for their own visit, and only once the visit is finished. The links to those photos work for an hour at a time.
• Only the tech who did the visit can add its photos. They’re part of the visit’s record, so only the company’s owner or a manager can remove one, and they’re kept as long as the visit is.

The pool company is in charge

For staff and customer information, the pool company decides what’s collected and why. Under the Privacy Act 2020, we hold that information on the company’s behalf (section 11).

• If you’re a pool owner or a tech, the company is the one to ask first.
• You can also email us, and we’ll pass your request on and help.

Who we share it with

We share only what’s needed, only to run the service:

• Supabase stores the database, team chat photos and visit photos, and runs sign-in. The data is stored in Sydney, Australia.
• Cloudflare delivers the website and the app from its worldwide network.
• Stripe takes payments, from company owners only. Stripe is in the USA.
• Email: sign-in codes are sent by Supabase’s email service for now. Once it’s set up, our emails go through Resend, an email service in the USA, including the visit reports emailed to pool owners.
• Professional advisers (such as an accountant or lawyer) when needed, and anyone the law requires us to tell.

Some of these companies are outside New Zealand (Stripe and Resend in the USA, Cloudflare worldwide, and Supabase stores the data in Sydney). We only use services that protect information in ways comparable to the New Zealand Privacy Act 2020, such as by contract, as Information Privacy Principle 12 asks. We never sell information, and we never share it for advertising.

How long we keep it

• While a company uses SwimSorted, its records are kept so it has a full history. Mistakes are voided with a reason rather than wiped, so hours and visits stay accurate.
• Visit links for customers stop working 90 days after the visit by default. The company can choose 1 to 90 days.
• Pool owners who sign in to see their visits keep them for up to 2 years. That ends sooner if the company leaves SwimSorted (its data is then deleted, as below) or switches their sign-in off.
• Live location: only the latest position is kept. The phone removes it when sharing stops (at lunch, at the end of the day, or when the app is closed). It’s also deleted when the company switches location off, and when a tech leaves the company or deletes their account.
• When a company leaves:
  • it has a month to export everything;
  • we then delete its data within 90 days;
  • backup copies are gone within 30 more days;
  • we keep invoices as tax law requires.
• Your own account: see Delete your account.

Keeping it safe

• Everything travels encrypted.
• Each company’s data is walled off from every other company’s, and the database checks this on every request.
• Staff see what their role allows.
• Sign-in uses one-time codes sent by email, not passwords.
• Once it’s switched on, you can also sign in with Face ID or a fingerprint (a passkey). Your face or fingerprint never leaves your phone: the phone checks it and tells us only that it was you.

If something goes wrong, we’ll tell the affected company quickly, within 72 hours at the latest. We’ll help it tell the Privacy Commissioner and anyone affected when the law requires that.

Your rights

You can ask to see the information about you, and to correct it. Ask the pool company you deal with, or email [email protected] and we’ll help.

If you’re not happy with how we’ve handled your information, tell us first. You can also complain to the Office of the Privacy Commissioner (privacy.org.nz).

Australia

• We follow the Australian Privacy Principles as good practice.
• Information is stored in Sydney.
• You can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Children

SwimSorted is for working adults in the pool trade. It isn’t meant for children.

Changes

If we change this policy, we’ll update the date at the top. If a change matters, we’ll tell company owners in the app or by email before it starts.

Contact

Email [email protected] about anything in this policy.