← Back to Boss Man Jobs
1. Information We Collect
Boss Man Jobs collects and processes the following categories of information to provide job management, time tracking, and invoicing services:
- Business information: job details, schedules, client records, estimates, and invoices.
- Employee information: names, contact details, and pay rates (used to calculate what is owed for hours worked). We never collect employee bank account or routing numbers — a crew member who opts into direct deposit links their bank directly with Stripe (see Section 3), and we store only the bank's name and the last four digits.
- Financial information: records you enter yourself, plus transaction records for online payments and payouts (see Section 3).
- Device information: app configuration and preferences.
2. Data Storage and Security
- Core business data (jobs, clients, schedules) is stored locally on your device in encrypted storage. The data your team needs to work together — the crew roster (names, phone numbers, and email addresses), schedules and calendar items, team chat messages, client and crew portals, a clocked-in crew member's live position, your business profile and subscription status — is stored on our secure cloud backend hosted by Supabase, organized by business account, so it reaches your crew's devices.
- Sensitive credentials and your tax ID (EIN) are stored in the iOS Keychain, protected by hardware-backed encryption.
- Application data is encrypted at rest using AES-256-GCM encryption.
- Payment-related data (payment and payout records, and bank references limited to institution name and last four digits — never full account, routing, or card numbers) is stored on our secure cloud backend hosted by Supabase, which uses AES-256 encryption at rest and TLS 1.2+ for all connections.
- Receipt photos are stored locally on your device and are not uploaded to external servers.
3. Payments and Payroll
Boss Man Jobs offers online invoice payments and crew direct-deposit payouts, processed by Stripe, our payment processor. Here is exactly what that involves:
- Getting paid by your clients: you can attach a secure payment link (with QR code) to an invoice. Your client pays on Stripe's own hosted checkout page — by card or bank transfer — and the funds are deposited to the bank account you linked with Stripe. Card numbers are entered only on Stripe's pages; they never touch the app or our servers, and we never store them. You may instead paste a payment link from another provider onto an invoice — we store that link as part of the invoice and nothing more.
- Setting up payments: connecting your business happens on Stripe's own onboarding pages. Stripe — not Boss Man Jobs — collects and verifies your identity, business details, and payout bank account. We store only your Stripe account identifier and its status (for example, whether charges and payouts are enabled). The app never sees your Stripe sign-in.
- Crew payouts (payroll): an account owner can pay crew members by direct deposit through Stripe. A crew member who opts in links their bank on Stripe's hosted pages; we store only the bank's name, the last four digits of the account, and Stripe account identifiers — never full account or routing numbers. Payout records (amount, status, dates, and the crew member's name) are kept as transaction history.
- What our backend keeps: for each online payment or payout we retain transaction records — amounts, status, dates, and Stripe transaction identifiers, plus, for invoice payments, the payer's name and email address for receipts and reconciliation. We also receive and retain payment-status notifications (webhooks) from Stripe to keep these records accurate.
The third-party services that process this data on our behalf are:
- Stripe: Processes payments and payouts and verifies business and bank details. Stripe is PCI DSS Level 1 certified. See Stripe's privacy policy.
- Supabase: Hosts our secure backend infrastructure including Edge Functions and the PostgreSQL database, with Row Level Security enforcement. See Supabase's privacy policy.
No Stripe secret keys or other third-party secrets are stored on your device. Only a single API authentication token is stored in the iOS Keychain.
Boss Man Jobs never sees or stores card numbers, full bank account or routing numbers, or your Stripe sign-in credentials — those stay with Stripe.
4. Third-Party AI Services
- Google: every AI feature in Boss Man Jobs — the Assistant (chat and voice mode), AI Job Walk, Smart estimate & report, the Help center chat, plan review, AI price research, AI property lookup, and the AI material scanner in Site Vision — is powered by Google's AI services using our developer key. You do not need a Google account, and there is nothing to add or configure. Your questions, plus the job, client, and team details the assistant needs to answer (names, contact information, addresses, and prices), are sent to Google to generate answers. AI price research sends the item's details (name, trade, category, description, notes and unit) and your pricing area (city, state and ZIP code) to Google, which searches the web for current prices; the sources it used are shown with the result. When you tap Look up property on a job, the job's street address is sent to Google, which searches the web for public facts about the building (such as year built, size, value and owner of record); the sources it used are shown, and only the facts you choose to keep are saved on the job. The same tap checks the job's flood zone with FEMA's public flood map using the job's location, and its radon zone from a list of EPA zones built into the app. Photos you choose to analyze — job-site frames for Smart estimate & report, a plan page for plan review, or the photo of the wall, floor, or ceiling you scan with the material scanner — are sent to Google to identify materials and quantities. In voice mode, your microphone audio and camera view are streamed to Google while the session is active. If you ask the Assistant to draft an accident report, what you tell it about the incident — including an injured worker's name, date of birth, injury, body part and treatment — is sent to Google to fill in the form; the report you save stays on your device.
- Google handles this data under its own privacy policy (policies.google.com/privacy). Bank account details, card numbers, and personal identification numbers are never sent to AI services.
5. Location Data
Location features are optional and controlled by the iOS location permission. If you enable them, location is used for:
- Automatic GPS mileage tracking between job sites — trips are recorded and stored on your device.
- Job-site clock-in/out verification — geofence events are processed on your device.
- Live team location while clocked in — a clocked-in team member's current position is sent to our secure backend so the account owner can see it on the Team Locations map. Only the current position (overwritten in place) and the clock-in point are stored — never a movement trail. Clocking out removes the pin and deletes both from the server.
- Weather for your job sites and current area.
Location data is never sold, shared with data brokers, or used for advertising.
6. Data Sharing
We do not sell, rent, or trade your personal information. Data is shared only with the third-party service providers listed above, solely for the purpose of providing the services you have requested (payment processing, bank verification, AI assistance).
7. Data Retention
- On-device data is retained until you delete it or uninstall the app.
- Server-side data is retained until you delete your account from Settings > Delete account, which erases it from our servers at the same time as from your device and permanently disables your account's access token.
- Records of completed online payments and payouts (amounts, status, dates, and Stripe transaction identifiers) are retained as required for financial auditing, tax compliance, and dispute resolution; when you delete your account, the personal details on those records (names, email addresses, descriptions) are removed.
- Records held by Stripe (your connected account) and by your bank-verification provider are kept under their own retention policies and are not deleted by the app; you can close your Stripe account through Stripe at any time.
8. Your Rights
- Account owners can export business data at any time from Menu > Money > Reports.
- You can delete your account and all associated business data — on this device and on our servers — from Settings > Delete account. A team member who deletes their account is removed from their employer's crew roster and live-location map; the employer's business data is unaffected.
- If the server-side erase cannot complete (for example, while offline), the app tells you what remains and lets you try again, or you can contact us and we will complete it.
- If you have connected a Stripe account for payments or payroll, you can manage or close it through Stripe at any time, and you can contact us to remove the connection and associated records on our side.
9. Security Measures
We implement industry-standard security measures including TLS 1.2+ encryption for all data in transit, biometric authentication (Face ID/Touch ID), jailbreak detection, and automated lockout after failed authentication attempts.
10. Children's Privacy
Boss Man Jobs is a business management application and is not directed at children under 13. We do not knowingly collect information from children.
11. Changes to This Policy
We may update this privacy policy from time to time. The "Last Updated" date at the top of this policy indicates when changes were last made. Continued use of the app after changes constitutes acceptance.