Jobcard Privacy Policy
Effective date: October 20, 2026
Jobcard (jobcard.tech) is operated by Jobcard by IAIG (Inevitable AI Group) ("Inevitable AI Group", "IAIG", "we", "us"), an Israeli company. This policy explains what we collect, why, and the choices you have.
Who this applies to
- Shops: US trade businesses that subscribe to Jobcard, and their owners, staff and technicians ("Users").
- Shop customers: the homeowners and businesses a shop serves through Jobcard ("Customers").
- Visitors to jobcard.tech.
Our role: controller and processor
- Each shop is the controller of its Customers' data. The shop decides what to collect and how to use it, and is responsible for its own privacy notices and consents.
- Jobcard is the processor (a "service provider" under US state laws) for that data. We process it only to provide the service to the shop, on the shop's instructions, under our agreement with the shop.
- We are the controller of account, billing and website data about Users and visitors.
If you are a Customer, please contact the shop you deal with first. We will help the shop respond to your request.
What we collect and why
| Data | Examples | Why |
|---|---|---|
| Account data | Name, email, phone, role, login details | Create and secure accounts, provide support |
| Shop business data | Business name, address, EIN, branding, settings | Run the service |
| Customer data (on behalf of shops) | Names, phone numbers, service addresses, job notes, photos, quotes, invoices | Scheduling, quotes and invoicing |
| Billing data | Subscription plan, billing status, card brand and last four digits | Charge the $249 per month subscription. Subscription billing for Jobcard's plan is handled by a third-party payment provider, which will be named here before billing begins. The card form in the product sends a card token to Square. We do not store the card number |
| Payment data | Invoice amounts and payment status | Show payment status on the shop's own invoices. Card details are handled by Stripe or Square, whichever the shop connected |
| AI assistant data | Prompts, and job or customer content the AI needs | Generate drafts, summaries and suggestions |
| Usage and device data | Pages used, clicks, IP address, browser, error logs | Keep the service working, fix bugs, improve the product |
We do not intentionally collect sensitive data such as Social Security numbers or health information. Shops should not put it in Jobcard.
Sub-processors
We use these service providers to run Jobcard. Each gets only the data it needs to perform its service for us:
| Provider | Purpose |
|---|---|
| Supabase | Auth, database, and storage. An emailed code is sent through Supabase Auth |
| Resend | Shop invitation email. Supabase Auth's sign-in codes use the same account as SMTP |
| Sign-in | |
| Vercel | Hosting, and cookieless page-view counts on the marketing site when Web Analytics is on |
| Billing provider (to be named) | Subscription billing for Jobcard's plan. The provider will be named here before billing begins |
| Square | The subscription card form sends the shop's billing name, email and a card token. We store the brand and the last four digits |
| OpenAI | AI assistant prompts and the shop text the assistant needs, when that deployment uses an OpenAI key |
| OpenRouter | The same, when that deployment uses an OpenRouter key. An OpenRouter key is used instead of an OpenAI key when both are set |
| Sentry | Error reports, when a DSN is set. The request body is dropped, cookie and authorization headers are dropped, and a failed scrub drops the event |
| PostHog | Product analytics in the United States, when analytics is on. Customer-facing links are excluded. Session replay masks on-screen text and blocks images |
| Stripe | Card payments a shop's own customers make on an invoice, when the shop connects Stripe |
| Intuit (QuickBooks Online) | Customers, invoices and payments, when the shop connects QuickBooks |
| Calendar events and busy times, when a person connects Google Calendar. This is separate from Google sign-in | |
| Twilio | SMS sending and receiving |
| Telegram | The bot's replies to people on the shop's allowlist, when that shop's bot is configured. Customers are not on the allowlist |
A provider the shop connects (QuickBooks, Google Calendar, Stripe or Square for its own invoices) also has its own privacy policy. Apple Calendar and Outlook can subscribe to a feed Jobcard publishes. They then hold a copy under their own terms. We do not send that feed to Apple or Microsoft.
When the assistant is on, the prompt and the shop text it needs go to OpenAI or OpenRouter so the model can answer. We do not train a model of our own on that data. What the provider keeps is covered by its terms. We do not claim that a provider deletes the prompt.
Other disclosures
We also share personal data when the law, a court or a regulator requires it, or when it is needed to protect the rights, safety or security of a shop, a customer or us. If we are involved in a merger or a sale of the business, we will tell shops before their data moves to a new owner.
Legal bases, where the GDPR applies
Where we are the controller, we rely on contract (to provide the subscription), legitimate interests (to keep the service secure and to understand how it is used, as the Cookie Policy describes) and legal obligation (records the law tells us to keep). The GDPR page says how to use the rights those laws give.
Google Calendar
A person connects their own Google account. We ask for two permissions: to add, change and delete events on the calendars they pick, and to read the list of those calendars. A visit is written as an event whose title includes the customer name and the crew. Other events on their main calendar are read as busy time, start and end only, not the title. The saved calendar connection is stored as AES-256-GCM ciphertext. They can disconnect in the product, and they can revoke Jobcard from their Google account.
We use that Google data only to put visits on the calendar they connected and to read busy time. We do not use it for advertising. We do not sell it.
Cookies
What the browser stores is in the Cookie Policy. We do not use advertising cookies.
Texting
Texting is coming. Texting is not active yet. See our SMS Terms.
No selling or cross-context advertising
We do not sell personal data, and we do not share it for cross-context behavioral (targeted) advertising. We do not use Customer data for our own marketing.
Your US state privacy rights
Depending on your state (for example, California under the CCPA/CPRA), you may have the right to:
- Know what personal data we hold about you and how we use and disclose it;
- Delete your personal data;
- Correct inaccurate personal data;
- Opt out of the sale or sharing of personal data, and of targeted advertising (we do neither);
- Not be discriminated against for using these rights.
Other US state privacy laws that give these same kinds of rights are exercised the same way.
To make a request, email legal@jobcard.tech. We will verify your identity before acting, and you may use an authorized agent. If your data belongs to a shop's Customer records, we will pass your request to that shop and help it respond. If we deny a request, you may appeal by replying to our decision.
Retention and deletion
- We keep data while a shop's account is active and as needed to provide the service.
- When a shop cancels, it can export its data for 30 days. After that we delete it within 30 days, except backups, which roll off within 30 days.
- We keep billing records as long as the law requires.
- Shops can delete Customer records at any time, and anyone can ask us to delete their data at legal@jobcard.tech.
Security
Each shop's records sit in that shop's own database schema, and a request for one shop does not read another's. Sign-in is Google or an emailed code, through Supabase Auth. Traffic uses the hosts' transport encryption. The measures we actually run are on the Security page. No system is perfectly secure.
If we learn of a breach of personal data, we tell the affected shops, and people, as the law requires, and without undue delay. Where the GDPR sets a clock for that notice, we keep to it. Write to legal@jobcard.tech.
International transfers
We are based in Israel, and our service providers operate mainly in the United States and in other countries where their services run. Where a transfer from the EEA or the United Kingdom needs a transfer tool, the Data Processing Agreement incorporates the European Commission's standard contractual clauses, module two (controller to processor), and the UK addendum where the UK GDPR applies.
Children
Jobcard is a business tool. It is not directed to children under 16, and we do not knowingly collect their personal data. If you believe we have, contact us and we will delete it.
Changes
We may update this policy. We will post the new version here with a new effective date, and notify shops by email or in the app about material changes.
Contact
Jobcard by IAIG (Inevitable AI Group) Email: legal@jobcard.tech
See also our Terms of Service, SMS Terms, Security, GDPR, Cookie Policy and Data Processing Agreement.