Privacy Policy

LocalWorks is software for piano professionals — tuners, movers, dealers, and storage operators. This policy explains what information we collect when you (an operator) use LocalWorks to run your business, and what we collect when one of your customers books an appointment, requests an estimate, or pays an invoice through a LocalWorks-hosted page.

We try to keep this short and readable. If anything here is unclear, email hello@localworks.app and we'll explain.

Who is responsible for your data

For information about operators (the businesses that sign up for LocalWorks), LocalWorks is the controller — we decide what is collected and why.

For information about your customers(the people who book a tuning, request a moving estimate, or pay an invoice through a page that an operator runs on LocalWorks), the operator is the controller and LocalWorks is the processor: we hold and process that data on the operator's behalf, and the operator is the right party to ask about retention, access, or deletion of their customer records.

What we collect

From operators (the people who sign up)

• Name, email address, and password (hashed — we never see plaintext).
• Business profile: organization name, portal slug, optional branding (logo, primary color), home base address, business hours, service catalog, pricing.
• Subscription and billing information when you pay for a paid tier. Card numbers are handled by Stripe — we store only the billing customer ID and subscription status, never card data.
• Product usage: which pages you visit, which features you use, error reports when something breaks. This helps us prioritize fixes and improvements.
• Optional integrations you connect (e.g., a Google or Apple calendar URL you paste in to read busy time, or a Stripe account you connect to receive customer payments).

From your customers (when they book or pay through LocalWorks)

• Name, phone number, email, service address, and any notes the customer provides about their piano or move.
• Appointment, estimate, invoice, and payment history within the operator's account.
• Optional photos a customer attaches (for example, a picture of their piano or their stairwell).
• Payment information when a customer pays an invoice. Card data is collected directly by Stripe and never touches our servers; we receive a paid/unpaid status and a payment reference.

Automatic technical data

• IP address, browser, device type, and pages visited — used for security, fraud prevention, and figuring out which screens are broken on which devices.
• Cookies and similar storage strictly necessary for authentication and session continuity. We do not run third-party advertising trackers.

How we use the information

• To provide the service — show you your schedule, your customers, your invoices.
• To send transactional messages on your behalf (booking confirmations, reminders, invoices) and on our behalf (account, security, billing notices).
• To process payments through Stripe.
• To geocode addresses, display maps, and calculate routing using Google Maps services.
• To maintain security, prevent abuse, and investigate incidents.
• To improve LocalWorks — what to build next, what to fix, where the product is confusing.
• To comply with legal obligations (tax, accounting, lawful requests from authorities).

We do not sell personal information. We do not rent or trade customer lists. We do not run third-party advertising on LocalWorks and we don't share data with ad networks.

Who we share information with (subprocessors)

LocalWorks uses a small set of vendors to actually deliver the product. Each one only receives the data it needs to do its job, and is bound by a data-processing agreement.

• Supabase — primary database and authentication. Customer records, appointments, invoices.
• Vercel — application hosting and edge network.
• Stripe — subscription billing for operators and (when an operator opts into Connect) customer invoice payments. Stripe is the only party that sees card numbers.
• Twilio — SMS delivery for booking confirmations, reminders, and operator notifications.
• Resend — transactional email delivery.
• Google Maps Platform — address autocomplete, geocoding, and route optimization.

We may add or change subprocessors as the product evolves. We will update this list when we do.

We may also disclose information when we're legally required to (a valid subpoena, court order, or other lawful process), or when it's necessary to protect LocalWorks, our users, or the public from fraud or harm.

If LocalWorks is acquired or merges with another company, your data may transfer as part of that transaction. We'll notify you in advance and you'll have a chance to export your data.

Operator backup responsibility

LocalWorks is not a records-retention or backup service. We maintain operational backups for our own disaster-recovery purposes, but those are not designed for operator self-serve restore and they are not a substitute for your own backup discipline. Operators are responsible for maintaining independent backups of critical business information — customer records, appointment history, invoices, photos, and anything else you would not want to lose. Export tools live in the operator dashboard; use them on a cadence that fits your business.

How long we keep it

• Active operator accounts: as long as the account is open. Customer records you import or create are retained for the life of the account.
• Closed operator accounts:we retain your data for at least 30 days after closure so you can recover the account if you change your mind. After that, we work to remove your data from active systems on request. Standard database backups containing historical data may persist for additional retention periods set by our infrastructure provider; we'll purge data from backups as those backups roll over, or sooner on written request.
• Alpha-phase test orgs: data is wiped before the public beta launch. Operators using a testing org are warned of this in the invite.
• Billing and tax records: we retain invoice history for as long as required by tax law (typically seven years), even after an account closes.

How we protect it

• All connections use TLS in transit.
• Data at rest is encrypted on the database side by Supabase.
• Tenant isolation enforced at the application layer so one operator can never see another's data, with row-level security on the database as a defense-in-depth backstop.
• Internal access to production data is limited to engineers who need it for support and incident response, logged, and reviewed.
• Passwords are hashed (we never store or log plaintext passwords).

No system is perfect. If we ever detect a breach affecting your account, we'll notify you and the appropriate authorities within the timeframes the law requires.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to certain uses, or to withdraw consent. To exercise any of these, email privacy@localworks.app from the address on your account. We'll respond within 30 days.

If you are a customer of an operator (you booked a tuning or paid a moving invoice through a LocalWorks page), the operator is the right party to contact about your record. If you can't reach them, email us and we'll help route the request.

Messaging consent

When a customer books through a LocalWorks page, the operator may send transactional SMS and email related to that booking (confirmations, reminders, day-of updates, invoices). Reply STOP to any text message to opt out of further SMS, or use the unsubscribe link at the bottom of any email. We do not send marketing texts on behalf of operators.

Mobile information (phone numbers, SMS opt-in status, and any data tied to them) is not sold, rented, or shared with any third party for marketing or promotional purposes. Phone numbers are shared only with Twilio, our SMS delivery subprocessor (listed above), and only for the purpose of delivering the transactional messages a customer has consented to receive. No mobile information is disclosed to advertisers, data brokers, or marketing partners under any circumstance.

Message frequency varies depending on a customer's appointments and service history with the operator. Typical volume is 1–4 messages per appointment (booking confirmation, day-before reminder, day-of update, follow-up). Customers with multiple instruments or recurring service may receive periodic past-due reminders. Message and data rates may apply, depending on the recipient's mobile plan and carrier. Mobile carriers are not liable for delayed or undelivered messages.

Customers can opt out at any time by replying STOP (or UNSUBSCRIBE, CANCEL, END, QUIT) to any text message. Reply HELP for support. Full SMS program disclosure: localworks.app/sms-program.

Children

LocalWorks is a tool for businesses and is not directed at children under 13. We do not knowingly collect information from children. If you believe a child has submitted information through LocalWorks, contact us and we'll delete it.

International users

LocalWorks is operated from the United States. If you use the service from outside the U.S., you are consenting to the transfer and processing of your information in the U.S.

Changes to this policy

We'll update this page when our practices change. The date at the top reflects the last meaningful update. If a change is material — for example, a new category of data we collect, or a new way we use it — we'll notify operators by email before it takes effect.

Contact

Privacy questions or requests: privacy@localworks.app. General support: hello@localworks.app.