1. Overview

This Privacy Policy explains how Asan ("we," "our," or "us") handles information in the Asan mobile app and on our website at asan-planner.com.

Asan is an app for service businesses. You use it to keep your customer records, schedule the work you do for them, send them quotes and invoices, record the payments you take, prepare the messages you send them, and work with the people on your team.

There are two different kinds of information here, and it matters which is which. There is your information, which you give us to have an account. And there are your business records, your customers, their addresses, your jobs, your quotes, invoices and payments, and your notes, which you enter and which belong to you. We hold those records so the app can show them back to you. We do not use them for our own purposes, apart from the anonymous statistics described in section 4.

2. Information We Collect

Your account: your name and email address. If you sign in with Apple or Google, we receive the account identifier and email address they give us, and nothing else from them.
An identifier for your account: an internal identifier we create when you sign up. We use it with our providers in place of your name or email address; see section 6.
Your business profile: the details you set up for your business, such as its name and address, the services you offer, your working hours, and the wording you choose for the messages you send.
The business records you enter: the people you serve and how to reach them, where the work happens, what work is scheduled and when, what it costs, and any notes you keep. Some of this is information about other people; see section 5.
Financial records: the amount, status and date of each quote, invoice, payment and refund you record, never card numbers.
Team members: if you add people to your business, their name, email address and role, and the time they log on jobs.
Contacts you import: with your permission, the app reads your phone's contacts so you can choose which of them to add as customers. Only the ones you choose are saved.
Your calendar and location: with your permission, the app reads your calendar so your existing events can be shown alongside your work, and those events are never sent to us. Your location is used while the app is open to work out where you are starting from and to show your day on a map. It stays on your phone unless you tap Use my location to pin your business or home, which saves that point with your business profile. Taking a payment in person with Tap to Pay on iPhone also needs your location, because Stripe requires it for payments taken in person.
Photos: with your permission, the app uses your camera or photo library so you can add photos to a job or a service, or add your business logo. Only the photos you choose are uploaded, and they are stored with your business records. Job photos and your logo can appear on the quotes and invoices you send. Photos you add to a service are shown on your public booking page, where anyone with the link can see them.
Notifications: if you allow notifications, a push token, an identifier for your device that lets us send notifications to it, and the kind of device it is.
Email records: for each email we send for you or to you, whether it was delivered, bounced or marked as spam.
Purchase history: your plan and subscription status, which reach us through RevenueCat from Apple, or from our website if you buy there.
Support messages: what you send us by email or through the feedback form.
Crash reports, only if you turn them on: technical details about an error, so we can fix it. This is off unless you choose it, and you can change your mind at any time in Settings.
Website visitors: the standard server logs our hosting provider keeps for security and reliability. We do not run advertising or tracking cookies, and we do not run third-party analytics on our website.

3. How Messages Work

Texts and emails work differently, and it matters which is which.

Texts. When Asan prepares a text message for one of your customers, it hands that message to your phone, in the Messages app. You send it, from your number, over your mobile plan. We do not send texts, and the text itself does not pass through us. Your customer's reply arrives in your phone, not in Asan.

Emails to your customers. When you email a quote or an invoice, and when your settings send your customers emails such as booking confirmations, receipts and reminders, we send that email for you, on your instructions, through our email provider. It shows your business name as the sender, and your customer's replies go to your business email address, not to us. We record whether each email was delivered, bounced or marked as spam.

Emails and notifications to you. We email you and your team the codes and links for signing in and joining a business, and notices about your business, and we send notifications to your devices if you allow them. We may also email you news about Asan. You can stop those with the unsubscribe link in any of those emails, and you will still receive the emails about your account and your business.

What we keep is the record in your own account that a message was prepared or an email was sent, so that your history of that job makes sense to you later.

4. How We Use Information

To give you an account, sign you in, and keep it secure.
To store your business records and show them back to you on your devices.
To provide the features you use: scheduling your work, sending quotes and invoices, recording payments, working with your team, showing your day on a map, and preparing the messages you choose to send.
To fix problems and keep the service working, including crash reports if you have turned them on.
To make aggregated statistics from across all businesses, with names and details removed so that they cannot identify you, your business or your customers, and to use them only to run and improve the service.
To contact you about your account and your business, and to email you news about Asan.

If you are in the EU, the UK or a similar region, these are the legal bases we rely on:

Contract: your account, your business records, your team, your subscription and the payments you take. We need them to give you the service you signed up for.
Legitimate interests: keeping the website secure and reliable, looking up the addresses you enter, making the aggregated statistics above, and emailing you news about Asan. Our interest is a service that works. You can object; see section 8.
Consent: crash reports, and the phone permissions for contacts, calendar, location, camera, photos and notifications. You can withdraw it at any time; see section 7.
Legal obligation: where the law requires us to keep or disclose information.

We do not sell your personal information, and we do not sell or market to your customers. We do not use your business records to build advertising profiles or to train artificial intelligence models, and we do not share them with anyone except the providers in section 6, who act on our instructions.

5. Your Customers' Information

When you add someone as a customer, you are entering information about another person. You are the controller of your customers' records; we process them on your instructions. We contact your customers only to send the emails described in section 3, for your business and in its name.

When a customer pays by card, they enter their card details on Stripe's page, under Stripe's privacy policy. We receive the amount, the status and a reference, never the card number. When you take a payment in person with Tap to Pay on iPhone, the customer holds their card or phone to your iPhone instead. Apple's software on your iPhone reads it and passes the payment to Stripe. Again we receive the amount, the status and a reference, never the card number.

Your customers can also enter information themselves. On your booking page, a customer who asks for a visit enters their name, phone number and email address, the service, day and time they want, whether they agree that you may text them, and, if they choose, who referred them. On a quote you send, a customer who accepts types their name as a signature, and a customer who declines can add a message. We keep a record of each acceptance or decline, with the time, a hashed form of their IP address and the details their browser reports about itself. We process this information for your business and in its name, and it becomes part of your business records.

It is your responsibility to have a proper basis for holding their details and for messaging them, and to follow the rules that apply to you where you operate, including the rules about consent to receive text messages. If one of your customers asks you to remove their information, you can delete them in the app; if they contact us directly, we will point them to you.

5a. Your Team

The people you add to your business see its records according to the role you give them. As the owner, you control who is a member, and you can change a member's role or remove them at any time.

6. Who We Share It With

We share information only with the providers we need to run the service, and only what each of them needs for its part. The providers that work for us are required to protect it to the standard described in this policy and to use it only to provide their service to us. Apple, Google and Stripe also handle some information under their own privacy policies, as noted below. This is every provider the app and website send personal information to:

Our cloud database and authentication provider (Supabase): stores your account, your business records and the photos you add.
Our email provider (Resend): delivers every email we send: the codes for signing up and resetting your password, the emails we send you and your team, news about Asan, and the emails sent to your customers for your business. It receives each recipient's email address and the content of each email, and tells us whether it was delivered, bounced or marked as spam.
Our notification provider (Expo): only if you allow notifications. It receives your device's push token and the content of each notification, and passes it to Apple's or Google's notification service, which delivers it to your device.
Apple and Google: if you choose to sign in with them, to confirm who you are. Apple also processes your App Store purchases as the merchant of record. See the subscriptions entry below.
Tap to Pay on iPhone (Apple): if you take payments in person, Apple's software on your iPhone reads the customer's card or phone during a tap and passes the payment to Stripe, under Apple's own privacy policy. Turning it on links it to your Apple account. To provide and support the feature, Stripe shares details of your business with Apple: your business name, your business category and the amounts of the payments you take with it.
Address lookup and maps (Apple): when you type an address, Apple's own mapping service looks it up, and it shows the map. It receives the address you type and, to rank suggestions, a nearby location.
Address lookup where Apple's service is not available (Geoapify): where Apple's mapping service is not available, Geoapify may receive the address you type, as you type it, which can include your customers' addresses, and the address again when we place it on a map. It also receives a nearby location to rank suggestions, and your IP address and device details.
Directions: when you tap to get directions, the address is handed to the maps app you choose on your device (Apple Maps, Google Maps or Waze), and that app's own privacy policy applies from there.
Our error-reporting provider (Sentry): only if you have turned crash reports on. A report contains technical details about the error, your device model and operating system, the app version, the screens you were on and the actions you took just before it, and an internal identifier for your account. It does not contain your email address. Reports about errors that happen before you have chosen are held in the app's memory, sent if you then turn crash reports on, and discarded if you decline.
Our subscription provider (RevenueCat): manages your subscription. It receives the identifier for your account, your purchase history and subscription status from Apple or from our website checkout, and the technical information any online service receives, such as your IP address.
Our payments provider (Stripe): if you buy a plan on our website, Stripe takes the payment for RevenueCat Billing. You enter your email address and card details on the checkout page, under Stripe's privacy policy, and we never see the card. If you also connect Stripe to take card payments, then to open your payment account it receives your business name and the details Stripe asks you for on its own pages. When you send a payment link, it receives the amount and your business name to show on the payment page. Your customer enters their card and contact details on Stripe's page, and we never see the card. Stripe tells us the amount, status and a reference for each payment, refund and dispute, and handles your payment account, refunds and disputes under its own privacy policy.
Our feedback form (Tally): only if you tap Send feedback, which opens a form on Tally's site. It receives what you type, the platform and app version we add to the link, and the technical information Tally records about any visitor, such as your IP address.
Our website hosting provider (Cloudflare): for the website only. It sees the IP address and the pages requested by each visitor.
Legal reasons: if required by law, or to protect our rights, safety, or property.

Our database is hosted in the United States (US East), and several other providers, including Sentry, RevenueCat and Resend, process information there too. Where information about people in the EU or the UK is transferred outside those regions, we rely on the safeguards each provider publishes: the European Commission's Standard Contractual Clauses in its data processing agreement and, for providers that hold it, its certification under the EU-US Data Privacy Framework.

7. Keeping, Exporting and Deleting Your Data

We keep your account and your business records for as long as your account exists, because they are what the app shows you. You are in control of all three of the following, from inside the app:

Export your data. Settings → Privacy → Export My Data gives you a copy of your data to keep.
Clear the copy on this device. Settings → Privacy → Clear Local Data removes what is cached on the device you are using. Your account stays active.
Delete your account. Deleting your account deletes your account and the business records held with it. This cannot be undone, so export first if you want a copy. Backups are overwritten on their normal cycle.

Your financial records are kept while your account exists, like the rest of your business records, and are included in your export. Stripe keeps its own records of the card payments it processes, under its own privacy policy.

Crash reports, if you turn them on, are kept by Sentry for up to 90 days. The standard server logs for the website are kept by our hosting provider for the period it sets.

You can also withdraw consent for anything you opted into: crash reports in Settings, and the phone permissions for contacts, calendar, location, camera, photos and notifications in your device's own settings. Turning one off stops that use from then on. If you would rather we did any of this for you, email [email protected].

8. Your Rights

If you are in a region with data-protection laws such as the GDPR or the CCPA, you have the right to access, correct, delete, and receive a copy of your personal information, and to object to or restrict certain processing. The tools in section 7 cover most of this directly. For anything else, email [email protected] and we will respond within the time the law allows. You will never be treated differently for exercising these rights. You also have the right to complain to the data-protection supervisory authority in the country where you live or work.

9. Security

Your data is held on our providers' infrastructure and encrypted in transit. Access to your business records is restricted to you and the team members you add, according to their role. Your sign-in credentials are stored in your device's secure keychain. No system is perfectly secure, and we will tell you if something happens that affects your information.

10. Children's Privacy

Asan is for businesses and is not intended for anyone under 18. We do not knowingly collect information from children.

11. How This Policy Changes

This policy describes the kinds of information the app handles rather than listing features one by one, so that adding an ordinary feature does not change what it says. If we ever start handling your information in a way this policy does not already describe, we will post the updated policy here at least 30 days before that change takes effect, showing the date it takes effect.

We will post any other new version here with an updated date.

12. Contact

If you have questions about this policy, contact us at:

Data controller: Belmaya LLC, doing business as Asan Planner
Email: [email protected]
Website: asan-planner.com