Privacy Policy

This Privacy Policy explains how Gonzware LLC, the operator of Lyteworkgo ("we", "us", or "our"), handles personal information across our websites, staff application, customer portal, booking pages, public quote pages, job links a business shares with its subcontractors, support, and related services (collectively, the "Service"). It does not govern a third party's own sites or services.

For account, subscription, website, security, and support information used for our own business purposes, Gonzware LLC generally acts as controller or business. For information a business customer ("Customer") uploads or generates about its personnel, clients, and jobs ("Customer Data"), the customer generally acts as controller or business and we act as its processor or service provider, under the commitments in Section 6 of the Terms of Service.

If you are an employee, contractor, or client of one of our customers, that customer controls most Customer Data about you. Its privacy notice and choices apply, and privacy requests about that data should normally be directed to it first.

Depending on how the Service is used, we collect the following categories:

• Account and business information, such as names, work contact details, company profile, role, preferences, and support communications
• Subscription and transaction information, such as plan, billing status, Stripe customer identifiers on our platform billing account, invoices, payment status, refunds, and limited payment-method details supplied by Stripe; we do not store full card numbers
• Identifiers for Customer's own connected Stripe merchant account, used so Customer can collect from its clients; those client funds settle to Customer's Stripe account, not ours
• Customer and workflow content, such as client and personnel records, addresses and geocodes, requests, schedules, quotes, line items, terms, signatures, jobs, invoices, payment records, notes, messages, photos, files, checklists, and portal content
• Location, including geocoded service addresses, approximate location derived from IP (see the next category), and — only where the signer allows it in their browser — the location recorded when a quote, a change order, or a work sign-off is signed electronically
• Device, usage, and security information, such as IP address, browser or device type, user agent, device fingerprint, session and verification events, audit records, pages or features used, timestamps, crash or diagnostic data, approximate location derived from IP, and — for a customer who signs in to a customer portal — a one-way code derived from a random identifier kept in the browser, used only to tell a returning browser from a new one
• Integration information received from or sent to services Customer connects, including Stripe, mapping providers, authentication, storage, and email or SMS providers
• Website, lead, booking, and portal information submitted through public forms, including contact details, requested services, service address, message content, and related metadata

We receive information directly from account holders, Authorized Users, website visitors, booking users, customer-portal users, and people using a job link a business shared with them; from our business customers and their administrators; automatically from devices and use of the Service; and from connected providers and integrations.

A customer may provide information about other people, including its employees, contractors, and clients. The customer is responsible for providing required notices and having a lawful basis to do so.

We use personal information to:

• Create, administer, authenticate, and secure accounts and workspaces
• Provide field-service workflows, customer portals, booking, signatures, file storage, messaging, invoices, payments, and integrations
• Process subscriptions, connected-payment operations, refunds, and related records
• Deliver email and SMS selected by a customer, security codes, receipts, and operational notices
• Provide support; troubleshoot, monitor, analyze, and improve performance and usability
• Detect fraud, abuse, security incidents, and violations of our Terms
• Create aggregated or de-identified insights that do not reasonably identify a person
• Comply with law, enforce agreements, establish or defend claims, and protect people, rights, and the Service

We send account, billing, security, and service messages that are part of operating the Service. If an account holder provides a phone number, we may use it for requested verification and operational notices. Message and data rates may apply.

Businesses use the Service to communicate with their own clients. The business, not Gonzware LLC, selects recipients and content and is responsible for consent, sender identification, and opt-outs under laws such as the TCPA and CAN-SPAM; we transmit those communications on the business's behalf. We and our delivery providers process message content, recipient details, delivery events, and replies or opt-out signals to deliver and protect those communications.

To opt out of Lyteworkgo marketing email, use the unsubscribe method in the message or contact support@gonzware.com. Security, billing, and other transactional messages may continue while an account remains active.

When you write to us through the contact form on our website, we use what you send only to answer you and, if you asked to hear when something becomes available, to tell you when it does. Writing to us does not sign you up for marketing email. Those messages are kept in our email, not in the Service, for as long as we need them to answer you and keep a record of the conversation.

Mobile opt-in data and consent are never sold or shared with third parties. Where a recipient consents to receive text messages, we record when and how consent was given and the disclosure that applied, together with any later STOP, START, or HELP request, so that we can honor the choice and demonstrate that we did. For consent given on a form or in the customer portal, the disclosure is the wording shown on screen. For consent a recipient gives to a business's staff, it is the disclosure the staff member was required to cover with the recipient, recorded with the staff member's confirmation that they did; it is not a recording or transcript of the conversation. That record is used only to operate and evidence the messaging program. It is shared with the messaging provider that transmits the messages and with the business whose service the recipient is receiving, and is not disclosed to anyone else, except to providers that store it for us or where the law requires — it is never sold, rented, or disclosed to third parties for their own marketing.

Every business on the platform sends text messages from the same program and number, so a STOP reply applies to every business that holds that number. Those businesses can see that the number opted out, when, and which stop word or phrase matched, but not the rest of the message. A START reply turns texts back on only where the recipient's own STOP ended them (see the SMS Terms, Section 7).

See our SMS Terms for the messaging program itself, including message types, frequency, and how to stop or get help.

The Service geocodes the service addresses a business enters so that it can map and schedule its work.

When someone signs a quote, a change order, or a work sign-off electronically, the signing page asks their browser for the device's location. If the signer allows it, that location is recorded with the signature as evidence of the signing, and the business that sent the document can see it; if the signer declines, the signature proceeds without it. Browser location permission can be changed at any time in browser settings.

Where an applicable law treats precise geolocation as sensitive personal information, we treat signing location as sensitive. We collect it only with the signer's browser permission and at the moment of signing, use it only as evidence of the signature — never for advertising or profiling — and do not sell it or share it for cross-context behavioral advertising. It is retained as described in Section 9. Because we use it for nothing else, we do not offer a separate request to limit its use: declining your browser's location prompt, which never stops you signing, is the choice.

We disclose personal information as needed to the following categories of recipients.

When Customer connects Stripe, we exchange the information Stripe needs to operate Customer's own merchant account (for example client names, emails, invoice amounts, and refund instructions) and receive payment status back. Stripe's privacy policy governs Stripe's processing. Client card payments settle to Customer's Stripe account. We are not affiliated with Stripe.

Our current service providers (subprocessors) are published, with what each one does, in our Subprocessor List. We keep that page current when our providers change, so it — rather than this section — is the authoritative list.

• The business customer that controls a workspace and its Authorized Users, according to configured roles and features
• A customer's clients or recipients through messages, portals, quotes, invoices, receipts, and booking confirmations
• People or companies a business shares a job with through a job link, who see that job's address, schedule and scope (not its prices or the client's contact details)
• The service providers named on our Subprocessor List, and providers in the same categories that support hosting, databases, authentication, storage, payments, email and SMS, mapping, security, support, and other operations
• Third-party integrations a customer enables, including Stripe, under that provider's terms
• Government authorities, courts, advisers, or other parties when required by law or reasonably necessary to protect rights, safety, and the Service
• A buyer, investor, lender, or successor in a merger, financing, reorganization, bankruptcy, or sale of all or part of the business, subject to appropriate protections

We do not sell personal information for money, and we do not share personal information for cross-context behavioral advertising as those terms are defined by applicable U.S. state privacy laws. We do not currently use third-party advertising cookies on the marketing site, and we do not allow advertising networks to collect information about your activities across other websites over time through our websites or applications.

Because we do not use personal information for those activities, the Service does not currently offer a sale/share opt-out, and a preference signal such as Global Privacy Control has no sale or sharing to stop. We go one step further: when your browser sends Global Privacy Control, our website and applications send no product-analytics events from that browser. We do not respond to legacy browser "Do Not Track" signals, which are not consistently defined. If our practices change, we will update this Policy and honor legally required browser-based preference signals.

Separately and unconditionally: we do not sell or share mobile opt-in data or consent with third parties, other than the messaging provider that transmits the messages and the business the recipient is receiving service from, as Section 5 describes. Mobile numbers collected for text messaging, and the consent records associated with them, are not disclosed for any third party's own marketing, are not included in any sale or rental of data, and are not transferred to affiliates or partners for their independent use. This commitment stands regardless of how the terms above are defined under any particular law, and it does not change if our advertising practices change.

We retain personal information only as long as reasonably necessary for the purposes described here. What follows is what we actually delete, and when; anything not listed is kept for as long as the workspace exists, and afterward only as the later paragraphs say.

Short-lived sign-in and verification records are deleted automatically. One-time sign-in and verification codes, password-reset and email-change requests, failed-sign-in counters, and staff remembered-device records are deleted 30 days after they were created, expired, or were last used.

Files and photos are deleted when a user deletes them. When a user deletes a file or photo attached to a request, quote, job, or client, or a job expense receipt, the stored file is removed, not only its listing. A file that is part of a signed document, or that the same workspace still uses elsewhere, is kept. A removed file leaves our backups within 90 days; database backups roll off on a shorter schedule.

Everything else a workspace holds is kept while the workspace exists. That covers clients, requests, quotes, jobs, invoices, payments, time entries, notes, messages, signed documents, and our event, delivery, and audit logs. When a user deletes a client, a note, a quote, a job, or another record in the Service, it is hidden and no longer shown, but it is not erased: we keep it, and can recover it, until the workspace itself is deleted.

A closed workspace is deleted on request, not automatically. Canceling a subscription stops billing; it does not by itself delete anything. After the workspace ends, Customer Data is deleted or de-identified when the customer asks us to, by hand, using our workspace-deletion procedure; it is not deleted on a fixed date. We do not promise retrieval of Customer Data after termination. Records we must keep by law, and the records that evidence consent to receive text messages or acceptance of our terms, are kept as long as that purpose requires, including after a workspace is deleted.

There is no self-service way to erase one person. Deleting a client in the Service hides it; it does not erase the name, phone number, address, notes, or files, which remain until the workspace is deleted or we remove them by hand. A request to erase information about one person is handled by us, by hand: for our own account holders and website visitors, on their request; for Customer Data, on the request of the business that controls it (see Section 11).

We use reasonable administrative, technical, and organizational measures designed to protect personal information. No transmission, storage, or system is completely secure. Account holders must safeguard credentials, use supported authentication controls, secure their devices, and configure workspace access appropriately.

Depending on applicable law, you may have rights to know about, access, correct, delete, or obtain a copy of personal information; to opt out of certain processing; or to restrict or object. Submit a request using support@gonzware.com; we handle deletion and correction requests by hand, and we respond within 45 days of receiving a request. If we need longer, we will tell you within those 45 days why and how much longer, up to 45 more days. We may verify identity and authority before acting. Authorized agents may submit requests where law permits, subject to verification.

We will not discriminate against you for exercising a privacy right. A request may be limited or denied where an exception applies, such as when we must retain information for security, legal compliance, or a transaction.

If your information is Customer Data controlled by one of our business customers, contact that customer first. We will assist the customer as required by law and our agreement.

The Service and the Portal are for adults. Everyone who uses them must be at least 18: the person who accepts the Terms of Service on a business's behalf represents that they are 18 or older (Terms §1), and so does anyone who signs a document or makes a payment through the Portal (Portal Terms §1). We do not verify age — that representation, made when the terms are accepted, is the control — and we do not knowingly create an account for, or collect personal information directly from, anyone under 18.

Two different lines are sometimes confused here, so we state both. Being old enough to enter an agreement is a question of contractual capacity, and our answer is 18. Children's-privacy laws — the federal rule at under 13, and New York's at under 18 — govern personal information collected directly from a child. Because no one under 18 is permitted to use the Service or the Portal, we do not knowingly collect such information at all.

A business customer may submit Customer Data about individuals, including minors, when providing its services — a household member named on a job, for example. That is the customer's collection, made in its own relationship with those individuals, and the customer is responsible for the lawful basis, notices, and consents it requires. Contact us if you believe a child provided personal information directly to us without appropriate authorization, and we will delete it.

We and our providers process information in the United States, and some providers — our network provider, for example — also operate internationally; the Subprocessor List says where each one processes. The Service is offered to businesses in the United States, and we do not offer a cross-border transfer mechanism such as Standard Contractual Clauses (see Section 12 of the Data Processing Addendum). If you visit our website or contact us from outside the United States, what you send is processed in the United States, where privacy laws may differ from those where you live.

We may update this Privacy Policy to reflect changes in the Service, our practices, or law. We will post the new effective date. A change is material if it means we collect a new category of personal information, use personal information for a new purpose, or disclose it to a new category of recipient. We will tell workspace owners, and customer-portal users we have an email address for, about a material change by email or in the Service no later than the date it takes effect. Adding or replacing a provider on our Subprocessor List is a change to that page, not to this Policy.

Questions, requests, and legal notices: Gonzware LLC · support@gonzware.com · 1041 Main Ave #588, De Pere, WI 54115 · https://qa-get.lyteworkgo.com