Privacy Policy

Application

Palm Beach Pool Service customer app and Admin Panel

Provider

Custom(er) LLC

Effective date

September 28th, 2026

Website

https://palm-beach-pool-service.web.app

1. Scope and responsibilities

Custom(er) LLC (“we,” “us,” or “Provider”) operates the Palm Beach Pool Service customer mobile application (“App”) and its Admin Panel (together, the “Application”) for Palm Beach Pool Service LLC (“Pool Company”).

The App is for the Pool Company’s customers. It lets them see their service schedule, ask to skip a visit, read messages from the office, view their invoices and pay them by bank transfer or card, and send feedback.

The Admin Panel is a private business tool used by the Pool Company’s authorized personnel to support importing the Pool Company’s customer, location, pool, technician and route records from its route-management system; controlling which customers may access the App; sending announcements and automated service reminders to those customers; publishing promotional cards to the App; reading customer feedback; and linking customer records to QuickBooks Online so customers may view and pay their own invoices. The Application integrates with the Pool Company’s QuickBooks Online account and its Stripe account.

This policy describes information processed through the Application, including information about authorized users, customers, and other individuals included in business records.

For business information processed on the Pool Company’s instructions, the Pool Company determines the purposes of processing and we act as its service provider or processor where those legal roles apply.

This policy does not govern Intuit’s own services.

2. Information we collect

We process the following information to the extent used by the Application:

User information: for each administrator of the Application, an email address, a password held by Google Firebase Authentication (never by us in readable form), and a user identifier. The Admin Panel recognises a single administrator account, and a single owner account that can only connect QuickBooks Online and Stripe; there are no other access roles.

Pool-service records: for each customer, a name, account status, billing address, telephone numbers, email addresses and whether the office has granted them access to the mobile application; for each service location, its address and the bodies of water at it; and for each recurring visit, the assigned technician, the day of the week, the frequency, the start and end dates and the estimated arrival time. For customers using the App we additionally hold the telephone number they sign in with, their sign-in identifier, the name and email address they enter, the device tokens used to send them notifications, any feedback they submit, and any request they make to skip a visit.

Payment information: when a customer pays an invoice by card, a record of that payment — the Stripe checkout and payment identifiers, the invoice it paid, the amount charged, the card processing fee included in it, the fee Stripe retained, and the identifiers of the QuickBooks records created for it.

QuickBooks Online information: the company profile; customer records (display name, company name, email, telephone, billing address and outstanding balance); and invoices (number, dates, amounts, balance, line items with quantities and unit prices, payment terms, the memo written to the customer, the billing address and applied payments). The private note held on an invoice is deliberately not read.

Connection information: the QuickBooks company identifier (realm ID), the company name, OAuth access and refresh tokens and their expiry times, the connection date and whether the connection is to Intuit’s sandbox or production environment.

Technical and support information: server-side operational logs produced by Google Cloud Functions, recording the function invoked, timing, outcome and error diagnostics, together with any correspondence sent to our support address.

We receive information from the Pool Company, Authorized Users, Intuit through the authorized integration, and operation of the Application.

The Application does not collect photographs, precise or approximate location, property access instructions, or payroll data, and never receives card numbers or bank account details. Card details are entered on Stripe’s hosted payment page, and bank transfers are made on Intuit’s hosted invoice page.

3. QuickBooks Online connection

An authorized administrator connects QuickBooks Online through Intuit’s authorization process. We use the resulting tokens to perform the authorized integration functions.

The Application does not collect or store your QuickBooks password. Authorization is performed entirely by Intuit, and we receive only access and refresh tokens, which are held server-side and are never sent to a browser or a mobile device.

The Application reads the company profile, customer records and invoices described in section 2 only on user action — when an administrator or a customer opens a screen showing this information. Nothing is copied on a schedule.

The Application writes to the Pool Company’s QuickBooks company only when a customer completes a card payment. It then adds the card processing fee to that invoice as its own line, records the payment against the invoice, and records the fee Stripe retained as an expense. It creates or changes nothing else in QuickBooks.

Intuit’s permission scopes may allow broader access than individual Application features require. Our actual access and use are limited to the agreed functions and documented instructions.

4. How we use information

We use information to:

• Provide the Application’s agreed pool-service functions.
• Synchronize specified information with QuickBooks Online.
• Manage user access and provide support.
• Diagnose errors and maintain security.
• Comply with applicable legal obligations.

We do not sell personal information, share it for cross-context behavioral advertising, use QuickBooks data for advertising, or use Client data to train general-purpose AI models. The Application contains no advertising and no third-party analytics.

Any additional use must be assessed and disclosed, with authorization or consent obtained where required.

5. How we disclose information

We disclose information to:

• The Pool Company and its users according to their access permissions.
• Intuit as necessary for authorized synchronization.
• Stripe to process a card payment the customer chooses to make.
• Service providers supporting hosting, database storage, authentication, logging and message delivery, under appropriate contractual restrictions.
• Authorities or professional advisers when required by law or reasonably necessary to address legal claims or security incidents.

Our service providers are:

• Google LLC (Firebase and Google Cloud) — hosting, authentication, database, server functions, logging and Android message delivery.
• Twilio Inc. — sends the one-time verification code when a customer signs in to the mobile application; receives that customer’s telephone number.
• Expo (650 Industries, Inc.) — relays push notifications to customers’ devices.
• Apple Inc. — delivers push notifications to iPhones.
• Intuit Inc. — QuickBooks Online, and the hosted pages on which customers pay invoices by bank transfer.
• Stripe, Inc. — processes card payments on the Pool Company’s own Stripe account. Stripe receives the card details and billing information the customer enters on its payment page, and the invoice number and amount being paid. Stripe’s handling of that information is governed by Stripe’s privacy policy.

Information may also be disclosed at the Pool Company’s documented direction or transferred in connection with a business transaction, subject to applicable legal and contractual restrictions and required notices.

6. Cookies and similar technologies

The Application uses browser storage to keep a signed-in administrator signed in between visits, placed by Google Firebase Authentication. It is necessary for the Application to function and is retained until the administrator signs out or the session expires. The App keeps a customer signed in the same way, using storage on their device.

No analytics, advertising or other nonessential tracking technologies are used, and no cookies are set for those purposes.

Restricting necessary cookies or session storage may prevent certain Application functions.

7. Security

We maintain safeguards appropriate to the information processed.

The controls in place are:

• All traffic is served over HTTPS.
• Data is stored in Google Cloud Firestore, which encrypts data at rest by default.
• Database security rules deny all direct client access. Every read and write passes through server-side functions.
• Administrative functions verify the caller’s identity on the server and accept only the administrator and owner accounts described in section 2; a signed-in customer cannot reach them.
• Customer-facing functions serve only the requesting customer’s own records, verified server-side against their authenticated identity.
• QuickBooks tokens and third-party credentials are held only in server-side configuration and are never transmitted to a browser or mobile device.

No system guarantees absolute security. Security concerns may be reported to security@thecustomer.io. We provide incident notifications as required by applicable law and our agreements.

8. Retention and deletion

We do not delete information automatically. Business records, synchronized QuickBooks identifiers, user accounts and service history are retained for as long as the Application is provided to the Pool Company, and afterwards as described in the Service Agreement.

Backups are taken daily and retained for 99 years, after which they expire automatically.

Deletion on request. The Pool Company, and individuals exercising rights under section 10, may request deletion of information held by the Application. On a valid request we delete the information within 60 business days, except where we are required to retain it. Anything retained is restricted to that purpose.

Deleting an App account. A customer can delete their App account at any time from Profile → Settings → Delete account, or by following the steps at palm-beach-pool-service.web.app/delete-account. Deleting in the App takes effect immediately and removes their sign-in, the name and email address they entered, their notification tokens and their service reminders. Records that belong to the Pool Company — its customer record for them, service history, invoices, payments, skip requests and feedback — are kept as the Pool Company’s business records and are only unlinked from the deleted sign-in.

Deleted information may persist in backups until those backups expire on the schedule above. It is not restored to the live Application except as part of recovering from an incident.

Authorization tokens are removed when QuickBooks is disconnected, as described in section 9. Server operational logs are retained under Google Cloud Logging’s default retention.

9. Disconnecting QuickBooks Online

An authorized administrator may revoke access through QuickBooks Online’s connected-app controls, or through the QuickBooks page of the Application using the Disconnect control.

Revocation stops further authorized API access through that connection once effective. It does not delete information already stored by the Application or remove records from QuickBooks Online.

To request deletion or export of stored information, contact support@thecustomer.io. Reconnection requires authorization through Intuit.

10. Privacy requests

Depending on applicable law, individuals may have rights to access, correct, delete, or receive copies of personal information; object to or restrict processing; withdraw consent; or appeal a decision.

For information we control, contact support@thecustomer.io. We may verify identity and authority before responding within applicable deadlines. Rights are subject to applicable conditions and exceptions.

11. Processing locations

Information is hosted in the United States. The database is a United States multi-region deployment (Google Cloud nam5) and server functions run in Google Cloud’s us-central1 region (Iowa, United States).

12. Children

The App is intended for the Pool Company’s customers, who are adults responsible for a serviced property, and the Admin Panel for authorized business personnel. Neither is directed to children.

13. Changes to this policy

We will publish updates at https://palm-beach-pool-service.web.app/privacy/ and revise the effective date.

Changes to this policy do not override contractual restrictions on our processing of Pool Company information.