Privacy Policy
Last updated: September 30, 2026
This Privacy Policy explains how Seastack ("we," "us") collects, uses, and protects information when you use our website (seastackbook.com), field client portal, mobile applications, and related software or bookkeeping services (collectively, the "Services").
We collect the following categories of information to operate our multi-tenant trade platform:
Field and visit evidence. Crews may record visit start/finish times and locations, before/after photos, checklists, hazard checks, incident reports and mileage. This is operational evidence of work done — it is not a health or care record, and Seastack Book is not designed to store medical or personal health information. Photos are stored in a private bucket and shared only with the business that owns the account and, when that business chooses, the customer the visit was for. Businesses should instruct crews not to photograph people, documents or medication.
We use information to provide and improve the Services, to communicate with you, to prepare and deliver bookkeeping work, to process invoices and payments, to power optional AI-assisted features you choose to use, and to keep the platform secure. We do not sell your personal information, and we do not use it to build advertising profiles.
Precise location (GPS coordinates) is captured only at the moment a worker actively clocks in or out, and only when the device grants permission. It is used to verify where time was recorded for the employer and is stored with that time record. It is not tracked continuously or in the background. You can decline location access in your browser or device settings; the time clock will still work without it, and the entry is simply saved without a location stamp.
Approximate location of visits and page opens. When you visit seastackbook.com, or open a page in the app while signed in, we record the page and an approximate place (country, province or state, and city) that our hosting provider estimates from your internet connection. For signed-in pages this is linked to your account so we can support and improve the service. We do not store your IP address, and this is never GPS or precise location. When you click a link in an email we sent you, we record that click the same way; emails we send may also contain a small image that tells us when the email was opened.
Fraud prevention. To protect accounts and payments from scams, when you use the app while signed in we also record the internet (IP) address and country our servers see for that request. These records are used only to detect and investigate fraud and abuse (for example, several accounts run from one address), are visible only to Seastack administrators, and the IP address is erased after 90 days.
Some optional features use third-party artificial intelligence services (currently Google's Gemini API) to generate drafts, summaries, and answers. When you use one of these features, the content you submit for that task is sent to the AI provider solely to produce the result you requested and return it to you. This processing is limited to delivering the feature — we do not use it to sell your data or build advertising profiles, and the content is handled subject to the provider's applicable data-processing terms. AI-assisted features are optional: you can simply not use them, and the rest of the Services work normally. AI-generated output can contain errors, so you remain responsible for reviewing it before you rely on or send it.
We share information only as needed to run the Services:
Within the portal, access is restricted by role (Administrator, Client, Staff, Field Worker) so each user sees only the data they are authorized to view.
Data is stored with reputable cloud providers and protected with access controls, including database-level row-level security that isolates each tenant's account to its own data. Files are kept in private storage and shared only through time-limited links. No system is perfectly secure, but we take reasonable measures to protect your information.
We retain information for as long as needed to provide the Services and to meet legal, accounting, and reporting obligations. You may request deletion of your information, subject to records we are required to keep.
Identity verification (partners and agencies). Affiliates and agencies upload identity and business documents so we can verify who we pay and prevent fraud. All verification documents, including the face video or owner photo, are kept while the partner or agency is active, then deleted one year after they leave, or one year after an application is rejected. If an account is under a fraud investigation, its documents are kept until the investigation is closed. A written record of the verification (name, date of birth, document types, decision and dates) is kept as part of our business records.
You may request access to, correction of, or deletion of your personal information by contacting us. You can control location sharing through your browser or device settings, and you can choose not to use AI-assisted features.
We may update this Privacy Policy from time to time to match evolving system architecture or legal requirements. The "Last updated" date above reflects the most recent changes.
Questions about your privacy or your data? Email us at seastackmechanical@gmail.com.