Privacy Policy

Data We Process

Workspace data can include user profiles, company records, bid invitations, project documents, email messages, contacts, field logs, photos, time entries, and compliance records added by your team or imported through connected services.

Mobile records can also include assigned jobs and schedules; work, drive, and break times; cost codes; time-off and time-correction requests; notes, photos, plan markups, and change-order requests; expenses, receipt images, comments, and approval decisions. Records are linked to the submitting account and relevant company or project.

Your Company and Access

Your employer or company controls your membership, assigned projects, work policies, and authorized office access. Field employees can view their own hours and routes and the project information made available to them. Authorized office users can review field submissions, time records, and work routes for their company. Ask your company administrator about its employment notices, monitoring rules, and recordkeeping needs.

Location and Work Routes

OCOperations requires device location permission and a usable GPS position to start work or drive time. During a clocked-in session, it collects precise coordinates, timestamps, and available accuracy and motion information to record the work route and support timekeeping and day summaries. With the necessary permission, collection can continue while the app is in the background or the screen is locked. Route recording stops at clock-out or the 16-hour session limit; remaining saved points may upload afterward. Being signed in alone does not enable continuous route tracking.

Travel estimates use a one-time location check or a starting address you enter, together with the assigned job address. On iOS, Apple Maps processes these origins and destinations to estimate travel time. Estimates and departure reminders do not provide continuous off-duty tracking or guarantee arrival times. Photos can include a location tag when location is available. Sending an expense requires a GPS fix and includes a location tag; an offline expense draft waits for a usable location before it can upload. This location is separate from a merchant address read from a receipt.

You can change location permission, including background and precise-location access, in your device settings. Revoking access stops new location collection and can prevent clock-in or travel estimates. It does not erase previously submitted records. Contact your supervisor if you cannot record time. Connectivity, battery, device settings, and operating-system limits can create gaps; this is not an emergency monitoring service.

Photos, Receipts, and Scanning

Camera and file or photo-selection features upload the images and files you choose, together with entered captions, comments, and related record details. AI receipt scanning is part of receipt submission. Before submitting, the app explains that tapping Upload & scan receipt authorizes AI processing of that receipt. The receipt image and information visible on it are sent to configured AI providers (xAI and OpenAI, depending on availability), to extract printed merchant, address, date, item, quantity, tax, and total information. The app shows scanned fields for employee review before Submit posts the expense for office review. Extracted results can be wrong and should be checked before relying on them. Avoid uploading unnecessary personal information or full payment-card details. Printed names or payment information may be included in the image sent for processing. GPS location and expense comments are not sent to these AI providers. Scanning starts after upload; simply selecting a photo or saving an unfinished draft does not send it to an AI provider.

Private Employee Documents

When your company requests a work document, you may upload a driver’s license, certificate, or other employment-related document. These files, expiration dates, review decisions, version history, and acknowledgements are available only to you and your company’s owners and administrators. They are not shared with project crews and are not sent to receipt OCR or AI extraction services. Contact your company administrator about its document requirements and retention practices.

How Data Is Used

Data is used to provide the product, route work to the right records, generate reports, support search and automation, and maintain audit history for your company workspace.

Connected Services

Current native iOS and Android apps use Convex Auth for account sign-in. Older Expo-based OCO Field versions use Clerk for email or phone verification; when you use those versions, Clerk processes your email, any phone number used for verification, authentication identifiers, and verification and security information. This does not replace the OCO project database.

Convex provides the application backend and database. Hosting and file-delivery services, including Vercel and Cloudflare, process requests and stored content needed to operate the service. Map and geocoding services process relevant addresses or coordinates when you use map or travel features. Data sent to connected providers is subject to their applicable privacy terms as well as the purpose of the requested workflow.

When you connect services such as Gmail, Outlook, Mailgun, OCR, or AI extraction providers, OCO processes the data needed to perform the requested workflow. Connected mailbox visibility depends on workspace sharing and permission settings.

For paid features, Stripe receives the billing and payment information needed to manage subscriptions, collect monthly charges, and provide hosted billing pages. OCO does not receive or store full card numbers entered on Stripe-hosted pages.

When an authorized user submits physical mail, the mailing provider receives the final document, sender and recipient names, postal addresses, and selected service needed to print and mail it. OCO stores the related price authorization, provider and carrier status, available tracking, and evidence records with the project.

AI Assistant Connectors

You can connect OCO to an AI assistant, such as Claude by Anthropic, ChatGPT by OpenAI, or Grok and Grok Bot by xAI. Connecting requires signing in to OCO and approving access. The assistant then reads the OCO records your role allows, such as bids, proposals, projects, and billing drafts, when you ask it to. Those records are sent to the assistant provider and are handled under that provider’s privacy terms and your settings there. OCO does not receive your conversations with the assistant, only the tool requests the assistant makes.

Each connection has an access level you choose: read only, ask first, or full access. With ask first, changes take effect only after a signed-in OCO user confirms them. With full access, which only owners and admins can turn on, changes run right away, except deletes, large batches, emails outside your company, payments, and sends, which always wait for confirmation. Deleted records remain recoverable in Trash for at least two years. Owners and admins may explicitly confirm early erasure of a standalone file over 5 MB. Assistants cannot send invoices, sign documents, or move money through OCO. OCO stores hashed connection tokens and briefly keeps an encrypted refresh response for retry handling, the assistant’s name and version, the time and IP address of its last request, the requested changes, confirmation decisions, and results for audit history. It does not store your assistant password. Refresh responses are scheduled for removal after the 60-second retry window and cleared on revocation. Token hashes and connection history may remain for audit purposes. You can revoke a connection at any time in OCO under Settings, Assistants, or in the assistant’s connector settings. Disconnecting stops further access but does not erase data the assistant already received.

Notifications and Diagnostics

If you enable notifications, OCO stores a device push token and notification preferences to deliver schedule and office-decision alerts through the platform notification service, including Apple Push Notification service on iOS. On-device reminders use your saved reminder settings. You can change reminder preferences in the app and disable notifications in device settings. Delivery depends on permissions, connectivity, and device settings.

The website uses browser storage for sign-in, preferences, and saved work drafts, including email recipients and message contents and bid or project form details. Drafts can remain after sign-out. On a shared device, discard drafts using the relevant form controls or clear the site's browser data when finished; clearing browser data also removes unsent drafts and local preferences, not records already submitted to OCO. When configured, PostHog receives limited product-usage events and account or company identifiers, and Sentry receives filtered error diagnostics. The website disables PostHog session recording and automatic interaction capture. Hosting and backend services also process technical request information, such as network addresses, to operate and secure the service.

OCO Sidekick for Chrome

After you explicitly agree and connect for your company, Sidekick reads Gmail page content to identify displayed messages, selections, sender details, dates, links, and files, and can fetch the selected message’s raw email and attachments using your signed-in Gmail browser session. Inbox scan rules run locally. Matching and existing-capture checks send limited descriptors, including message IDs, sender, subject or project information, to OCO. A local scan is not an upload of the complete message to an AI provider.

When you explicitly add a message or file to OCO, Sidekick uploads selected content, headers, attachments, source identifiers, and your chosen action and target. OCO stores and routes these records into your company workspace. Authorized company members can access resulting records according to their roles and enabled modules. Email capture and document extraction can send content to configured AI providers: Anthropic Claude first, with xAI and OpenAI fallbacks as configured. Local inbox checks and server AI extraction are separate operations. Review extracted information before relying on it.

OCO does not sell captured email data, use it for advertising, or use it to train OCO’s own AI models. OCO has not enabled optional sharing of API requests or responses for model training with Anthropic, OpenAI, or xAI. Processing by these providers remains subject to their applicable terms and retention practices; this is not a promise of zero retention.

OCO staff access to captured emails is limited to support you authorize, security or abuse investigations, and legal obligations. OCO’s use and transfer of information received through Sidekick complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

Sidekick keeps its connection refresh credential in trusted extension session storage, and access tokens only in worker and trusted panel memory. Browser restart, extension update or reload requires explicit reconnect; worker suspension in the same browser session does not. Local storage keeps an installation identifier, a versioned nonsecret consent preference bound to your user and company, minimal capture operation and upload IDs, authority and timing, and bounded technical diagnostics. The durable capture queue omits subjects, addresses, notes, file names, bodies and source links. Source context stays in browser memory or session storage. Pending recovery receipts survive restart; accepted local receipts are limited to 100 and seven days. Pending work is not silently discarded; new work is refused at 100 unresolved attempts. Diagnostics contain adapter versions, failure codes, route categories, and coarse page-structure flags rather than message bodies; retained entries are bounded and filtered to seven days when read or updated.

Disconnect while online in Sidekick, or revoke the browser connection in OCO Settings under Integrations. Disconnect stops Gmail access and clears transient source context. If offline, server revocation may remain unconfirmed; retry online or revoke in OCO Settings. Pending nonsecret recovery receipts, installation identifiers and diagnostics may remain until cleared or uninstalled. Revocation stops further authorized access through that connection. Removing the extension does not itself revoke the server connection or erase messages, files, audit records, or other data already added to your company workspace. Contact your company administrator or support@ocoapp.com for access or deletion requests. Server-record retention and provider processing are separate from extension removal.

Reply-draft controls, when available, prepare text for your review in Gmail; they do not send the email. Gmail can save the draft under its own account settings. Review the recipient and text before sending, and discard unwanted drafts in Gmail. Calendar actions can open an event template or a subscription link. Subscription URLs contain a bearer secret: anyone with a working link can read the feed’s event details. Keep those links private and revoke subscriptions separately in OCO calendar settings. Revocation stops new feed access but does not remove events already cached by a calendar provider.

Security and Retention

OCO uses role-based access controls and server-side storage for sensitive integration credentials. Workspace owners should periodically review users, connected accounts, and retained records.

Mobile apps retain sign-in tokens in platform-protected storage so you can stay signed in; they do not save your entered password. Downloaded plans, cached summaries, saved drafts, and pending uploads may remain on your device for offline use. Keep the device protected and sync pending work before signing out or removing the app. Files exported to Files, Downloads, or another app are outside OCO’s in-app storage controls.

Queued GPS points are eligible for upload for up to 7 days. The backend schedules daily deletion of route pings older than 90 days. This route-ping limit does not delete time entries, expense or photo location tags, project files, or audit records. Other workspace records do not have one universal automatic deletion period; retention depends on the record type, company administration, and applicable business or legal obligations. Removing the mobile app does not delete server records.

Your Choices and Deletion Requests

Contact your company administrator to request access to, correction of, export of, or deletion of employment and project records. You can also contact OCO at support@ocoapp.com about privacy or account deletion. Include your account email and company name, but do not email your password, identity documents, or sensitive attachments. Requests may require identity and company authorization checks. Some records may need to be retained for payroll, accounting, disputes, security, or other applicable obligations; account deactivation and removal of an app are not the same as erasing all company records.

Device settings let you revoke camera, photo, location, and notification permissions. Disconnecting an email integration prevents further access through that connection but does not automatically remove messages already imported into the workspace.

Policy Updates and Contact

Changes to this policy are published on this page with an updated date. For questions about OCO’s handling of information, contact support@ocoapp.com. Your company’s own privacy and employment policies also apply to how it uses records received through OCO.