What we hold, and what we do not

1Who this is about

TunePro is a product of Isles Mechanical LLC (“Isles Mechanical”, “we”, “us”). This notice covers the TunePro phone app, the TunePro web application, the customer reports it produces, and this website.

Two different responsibilities run through it. For your own account and for our billing, we decide what is held and why. For the records inside an organization — its sites, its equipment, its readings, its customers’ addresses — the organization decides what goes in and what comes out, and we hold it on their behalf. If you are a technician wondering who can see your work, the answer is the company whose organization you joined.

3What stays on the phone

The unsigned-in app keeps its saved sessions, settings, favourite refrigerants, probe names and screen preferences in the phone’s own local storage. None of that is transmitted anywhere. The values you read from a wireless probe go from the instrument to the phone over Bluetooth and stop there — no pressure, temperature or humidity reading leaves the phone unless you save it to a unit while signed in, or send a report.

The installed app checks for a signed update to its own interface through our DeployYourApp service, so a fix can reach a phone without waiting on an app-store review. Its native update diagnostics operate independently of the usage-reporting switch. Probe diagnostics and usage reports, described next, also work without signing in.

4Probe connection diagnostics

The app reports how your wireless probes behaved on the radio. Probe connection diagnostics are on by default, and you can turn them off in Settings at any time, separately from usage and error reports.

Here is why it exists, because it is easier to judge with the reason attached. Probes do not stream continuously — most of them transmit when a reading changes, plus a slow heartbeat when it does not. If the app guesses that rhythm wrongly it starts marking perfectly good readings as stale, which is exactly what it used to do when several probes were connected at once and competing for the radio. Knowing what real instruments actually do, in real vans and plant rooms, is what stops the app calling a working probe dead.

What a report contains:

• The probe’s brand, model and firmware version, and an identifier for the instrument that is hashed with a random value created on your phone at install. That lets us see that two reports describe the same probe on the same phone. It cannot be turned back into the hardware’s address, and the same probe on a different phone produces a different identifier, so nothing can be joined up across installs or across people.
• How long the connection lasted and how it ended, how many times it dropped, and how many times it reconnected.
• Signal strength over the session, and the timing between readings — typical gap, worst gap, how many arrived.
• How many other probes were connected at the same time, which is what explains a link that performed badly.
• The app version and whether the phone is iOS or Android.

What a report does not contain: none of your readings — no pressure, temperature, humidity, superheat or diagnosis — and nothing about the site, the equipment, the customer, your location or you. It describes a radio link, not a job.

Two older diagnostic captures work the same way and under the same switch. One connects to a recognized probe on its own — without you tapping anything — and records the raw frames it is broadcasting, its service and characteristic list, and a short recording of what it streams once connected. That happens so its decoder can be proved right — it keeps doing that until someone has held that model of instrument and checked a decoded value against the instrument’s own display, and it does it again whenever a frame carries a field we still cannot read. A probe whose readings the app already shows you is therefore still captured: decoding a frame and having confirmed the number against the hardware are not the same thing. The other records how a connected probe’s channels were interpreted, so a decoding mistake can be found. Both were previously off by default and buried in a developer menu. They are now under the same plain setting as everything else here, and they carry the same hashed identifier and the same exclusions.

A diagnostic disagreement is different and is sent only when you press its send button. It includes the current readings, the conclusion TunePro showed, and what you say was wrong so the logic can be checked. If you are signed in, the server associates it with your account and with the active workspace only after checking your membership; otherwise it remains anonymous.

Turning the setting off stops all of it immediately, including anything queued and not yet sent, which is discarded rather than held.

5Mobile usage and error reports

Production phone builds send limited usage and error reports to DeployYourApp, a service we own and operate, to understand which tools are used and where the app fails. This does not add tracking to the web portal or this marketing website. It adds no cookies and does not require an account.

Reports contain screen names, selected feature actions, time spent in the foreground, error categories and code locations with the screen where they occurred, the app version and an installation ID. The ID allows reports from the same installation to be grouped; it is not an account identifier. We do not include customer data, readings, URLs or query tokens, email addresses, account identifiers, raw error messages or logs in these reports.

Usage & error reports is on by default, including for existing installations upgrading to this version. The welcome screen offers a separate checkbox, and Settings has the same choice at any time. On a first run, collection waits until you continue from the welcome screen. Turning it off stops new usage and error events; reports already buffered by the native SDK may finish sending. It does not disable app updates or their native update diagnostics, and it does not change the separate probe connection diagnostics setting.

These reports follow DeployYourApp's analytics storage lifecycle. There is currently no automatic retention expiry; they remain under the lifecycle of the DeployYourApp organization that operates TunePro, separate from your TunePro account or workspace. Turning reporting off does not delete earlier reports.

6What we store once you sign in

Everything below lives in the account of the organization you belong to, on infrastructure we control.

7Photos, and what is inside them

A photo carries more than a picture. A camera writes the time, the device, often the lens settings, and sometimes the GPS coordinates into the file itself. Where that metadata goes is worth being exact about, because the honest answer here has two halves.

• Photos taken or picked in the phone app are re-encoded before they leave the phone. The app shrinks every image to fit the size limit, and re-encoding writes a new file from the pixels alone. The EXIF block does not survive that, so the copy we receive has no timestamp, no device string and no GPS tag in it.
• Our server does not strip metadata itself. It checks that an upload really is a JPEG or a WebP by reading its leading bytes rather than trusting what the file claims to be, checks its dimensions and size, and then stores those bytes as given. So a file that arrives some other way — a logo uploaded in the web app, or anything sent straight to our API — is kept exactly as it was supplied, metadata included.
• A photo's details — dimensions, byte size, checksum and caption — are rows in our own database, and the image itself is a file in storage we run on the same machine as everything else. It is not sent to an image service or a CDN, no outside company holds it, and its URL is not public: fetching one requires a session that belongs to the organization.
• Deleting a photo deletes it. Photos are not archived the way sites and equipment are — see section 15.

8Location, and the one thing it is for

Gauge pressure has to be converted against the local atmospheric pressure before a saturation temperature means anything, and atmospheric pressure depends on how high above sea level you are standing. So the app can read your elevation.

• It happens only when you tap the control that asks for it. It is never automatic and never in the background.
• It reads one position, once, and takes the altitude from it. Latitude and longitude are not read, not stored, and not sent anywhere.
• There is no continuous location watch anywhere in the app, no movement history, and no background location permission in either build. You can skip it entirely and type your elevation in by hand.

9What the app asks permission for

• Bluetooth — to find and connect to wireless probes and manifold gauges and read live pressures and temperatures from them. On Android the scan is declared as never being used to derive location.
• Camera and photo library — to photograph a nameplate or a failed component, or attach a picture you already took, and keep it with the equipment record. Only used when you open the photo sheet.
• Location — elevation only, as described in section 8.
• Internet — to sync an organization’s records when you are signed in, and for the update check in section 3, probe diagnostics and usage reports when their settings are enabled.

There is no microphone permission, no contacts permission and no background-location permission in either build. You can decline any of the above and keep using the app; the feature that needed it is what stops working.

10What we do not do

• No usage analytics on this marketing website or in the web portal. Production phone builds can send the limited usage and error reports described above, under a separate switch in Settings.
• No customer data, readings, URLs or query tokens, email addresses, account identifiers, raw error messages or logs in mobile usage and error reports.
• No third-party tracking scripts, no advertising identifiers, and no cross-site identifiers. There is no App Tracking Transparency prompt on iOS because there is nothing to ask about.
• No microphone, no contacts, no call logs, no tracking of background app activity, and no movement history.
• No reading of your nameplate photos. The app performs no text recognition on them and nothing is extracted from them automatically.
• Nothing you record is sold, shared with an advertiser, or used to train a model.

11Cookies and what sits in your browser

• This website sets no cookies. It stores one thing in your browser: which of the two palettes you chose.
• Signing in to the web application stores a session token in your browser so that you stay signed in, along with your theme choice and which lines you last had showing on a trend chart. That is all of it.
• There are no advertising cookies, no analytics cookies and no third-party cookies anywhere in the product, which is why you have never been asked to dismiss a consent banner on it.
• The report page a homeowner opens stores nothing in their browser. It asks browsers not to cache it, tells search engines not to index it, and does not pass its own address on to any site the reader clicks through to.

12Reports sent to your customers

One thing ever leaves the organization’s account: a report a technician chooses to send. Nothing is published automatically, and there is no public directory of anything.

• A report is written once and kept as written. Editing your branding or taking a newer reading afterwards leaves what the customer already read alone.
• It is reached by a link built from 32 bytes of randomness, and that link is the only credential. Treat it the way you would treat the document itself.
• The link stops working 400 days after it is sent, and anyone in the organization who can see the report can revoke it sooner. To a reader, a revoked link and an expired one look the same.
• It contains the equipment and property details the technician entered, the reading and what the app concluded, their note, and their company’s branding. It contains no prices, no savings claims and no predictions.
• If a technician emails it rather than sharing the link themselves, we hold the recipient’s email address so the sender can see where it went. On the paid plan a PDF copy travels with that email, and a PDF in somebody’s inbox is theirs — revoking the link cannot reach it.
• If you received a report and want to know what is held about you, ask the company that sent it: they control it, and we hold it for them. You are welcome to write to us and we will point you at them and help.

13Who else touches it

The external services below handle the listed functions. Mobile usage, error reporting and app updates use DeployYourApp, which we own and operate, as described in section 5. We do not use an advertising network. Photo bytes sit in an object store we run ourselves — not a third party’s.

• Stripe — payments and subscriptions. Card details go from your browser to Stripe and never through us; we hold only the identifiers that tell us which subscription is yours.
• Resend — email delivery. It carries organization invitations, the customer reports you send — so it handles the recipient’s address and, on the paid plan, the report PDF — and the feedback you send us on its way to our inbox.
• Apple and Google — app distribution. What they collect about a download or a purchase is theirs and is governed by their own policies, not this one.
• The OpenStreetMap Foundation — the address suggestions under the street field when you create or edit a site. What is sent is the text typed into that field, which is part of a customer’s address. Your browser and your phone never talk to them. The request goes from our server, so what reaches them is the query and our server’s address — not yours, not the technician’s location, and nothing tying one search to another. That is deliberate, and it is also required: their usage policy forbids an app doing this lookup directly. The Foundation is registered in the United Kingdom. An operator can configure MapTiler AG, in Switzerland, in their place; the same proxy applies, so the same thing is sent.
• CARTO — the map tiles behind the sites map. This is the one third party your browser contacts directly, because a map is drawn by fetching image tiles. So CARTO sees the IP address of whoever has the map open and which part of the world they are looking at. It does not see your sites, your records or who you are: a tile is a picture of a square of the earth, requested by coordinates, and the pins are drawn on top of it by your own browser. The map is the only screen that loads anything from them.

14Where it lives, and how it is protected

• TunePro runs on a virtual private server we rent and administer ourselves. The database runs on that same machine and accepts connections only from it — it is not reachable from the internet.
• Everything is served over HTTPS. Passwords are stored as hashes; we cannot read yours.
• Access to an organization’s records is checked on every request against your membership and role. Report links are long random tokens, expiring and revocable.
• Uploads are validated by what the bytes actually are rather than by what the file claims to be, and both a per-photo and a per-seat size limit are enforced by the server, not just by the app.
• Backups are taken nightly and kept for 30 days on the same machine, so that a mistake or a failure is recoverable.
• No system is perfectly secure, and we are a small company. We hold no security certification — no SOC 2, no ISO 27001 — and we are not going to imply one. If we ever discover a breach affecting your data, we will tell you and tell you what we know, as promptly as we can.

15How long things are kept

• Archived is not erased, and this page will not let the word do work it cannot do. Removing a site, a unit or a site contact stamps a date on the row and hides it from the lists. The row itself stays in the database with everything in it — the address, the contact name, the phone number, the readings underneath — and nothing sweeps it later. It works that way so that a mis-tap cannot lose a service history, and it is why an archived record still appears in an export, carrying the date it was archived, instead of being quietly dropped. If you asked us to delete something and we archived it, we would not have done what you asked.
• Erasure means a person deletes the rows. There is no self-serve delete button, and nothing sweeps your records away on age — the two things that do age out are the visit photos and the report content described below, and both are named here rather than left to be discovered. Write to us and name what you want gone — a site, a unit, a reading, the photos on a record, your account, the whole organization — and someone deletes it, after replying to the address on the account to check the request is really yours. Three things are outside what that reaches, and we would rather say so than leave you assuming otherwise: the nightly backups still hold a copy for up to 30 days before they roll off; a report PDF already sitting in a customer’s inbox cannot be recalled; and the billing record behind a past subscription is kept for as long as the accounting rules require. The procedure in full, and what deleting an account does not reach, is on the account deletion page.
• Some things you delete go outright rather than being archived, and it is a short list: a photo, a saved reading, a session synced from a phone, a maintenance agreement you end — the visits performed under it stay — your organization’s logo, and a permission somebody revokes. Those go when you delete them. Separately from anything you do, the app rewrites its own working data as you use it: a maintenance schedule’s upcoming occurrences and a technician’s working hours are replaced rather than versioned, so the previous copy is gone. That is bookkeeping about future work, not a record of work done — no visit, reading, report or photo is touched by it.
• Photos taken on a maintenance visit are deleted automatically after 730 days. They are job documentation, and they age out on their own once that job is far enough behind you. Nameplate photos are deliberately excluded and are kept until you delete them: those are the record of what the equipment IS, and a warranty claim on it can land five or ten years later.
• Report links expire 400 days after they are sent. The report record itself stays, so that it can be listed and revoked — but the frozen document behind an expired link, and the photos in it, are cleared once that day passes. Nobody could open it after that anyway; keeping the copy would only mean holding a customer's photos for no reason.
• Sign-in sessions expire on their own and can be ended by signing out.
• Mobile usage and error reports in our DeployYourApp service have no automatic expiry today. They follow that service's organization lifecycle, independently of TunePro account deletion. Disabling reports stops new collection but does not erase earlier reports; see section 5.
• Probe captures and the readings sent with a diagnostic disagreement are kept for days, then deleted from both the database and the diagnostic archive.
• Nightly database backups are kept for 30 days and then discarded, so anything you delete disappears from the backups within a month.
• The web server keeps ordinary access logs, which include IP addresses, and the application logs errors and the fact that an email was sent. Those logs rotate on the server’s own schedule and are used for running and debugging the service, nothing else.
• Account and organization records are kept for as long as the account is open, and go when you ask for them to go.

16Children

TunePro is a tool for working tradespeople. It is not directed at children, we do not market it to anyone under 13, and we do not knowingly collect anything from them. An account requires you to be 18. If you believe a child has given us information, write to us and we will delete it.

17California residents

If you live in California, the CCPA as amended by the CPRA gives you the right to know what personal information we hold about you and where it came from, to get a copy of it, to have it corrected, and to have it deleted. You also have the right not to be treated worse for exercising any of that, and we will not.

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined in that law. We never have. There is nothing to opt out of, and we run no financial incentive programme.

The categories we collect are set out in section 6: identifiers such as your name and email address, commercial information such as your subscription record, internet activity in session and log entries and the mobile usage and error reports in section 5, coarse elevation if you ask for it, and the work records your organization enters. They are collected to run the product you signed up for, and they come from you and from your organization. We do not collect sensitive personal information for the purpose of inferring characteristics about you.

To exercise any of this, write to us at the address in section 22. We will verify that the request is yours — usually by replying to the email address on the account — and answer within 45 days, or tell you why we need longer. You can name an authorised agent to ask on your behalf.

18People in Canada

TunePro is used by Canadian companies, and Canadian homeowners’ addresses are in it. Under PIPEDA you can ask what personal information we hold about you, get access to it, and have it corrected if it is wrong. We collect it with your knowledge and consent, for the purposes described in this notice and no others, and you can withdraw that consent by closing your account. Usage and probe reports have separate switches in Settings; they can operate without an account, as described above.

Isles Mechanical is a United States company, and your information may be stored and processed on servers outside Canada. Where it is, it is subject to the laws of the country holding it, including lawful access requests made there. Using the account side of TunePro means accepting that. If you are not satisfied with how we answer a request, you can complain to the Office of the Privacy Commissioner of Canada.

19People in the UK and EEA

If you are in the United Kingdom or the European Economic Area, the UK GDPR and the GDPR apply to what is held about you here. This section says who is answerable for which records, what each purpose runs on, what you can require of us and how it actually happens, and the one thing no paragraph can soften: the server is in the United States.

Which records you mean decides who the controller is — and getting that wrong sends you to the wrong company.

• Your account and our billing: we are the controller. Your name, the email address on the account, the password hash, your sign-in sessions and the subscription record are ours to answer for. Write to us.
• The records inside an organization: the organization is the controller and we are its processor. Its sites and their addresses, the contact names and phone numbers on them, its equipment, its readings, its photos and the reports its technicians send are held on that company’s instruction. We do not decide what goes into them and we do not use them for anything of our own. The software is built that way rather than promised that way: every request is scoped to the organization resolved from the caller’s own membership, never from anything the caller sends.
• So if you are a homeowner whose address is in TunePro because a contractor put it there, or a technician asking about the work records in a company’s organization, the controller is that company and the request goes to them. Write to us as well if you cannot reach them: we will tell you who they are and chase it. That is the whole of what we can do without acting on one company’s records over its head.

What each purpose runs on (Article 6). Per purpose, because a list of lawful bases with no purposes attached to them tells you nothing.

• Running your account and syncing an organization’s records — performance of the contract you have with us, Article 6(1)(b). Without the account record, the membership and the session there is no product to perform.
• The subscription and what it is billed on — the same contract while it runs; and once it has ended, keeping the billing record for as long as accounting and tax rules require is a legal obligation, Article 6(1)(c).
• The IP address and browser stored against a sign-in session, the web server’s access logs, and the nightly backups — our legitimate interests, Article 6(1)(f): keeping accounts from being taken over, keeping the service running, and being able to put it back after a failure.
• Probe connection diagnostics — legitimate interests again, and section 4 states the interest in full rather than asserting that one exists: an app that guesses a probe’s transmission rhythm wrongly starts calling working gauges dead. Those reports carry none of your readings, nothing about the site or the customer, and an instrument identifier hashed on your own phone. The switch in Settings is how you object to it, and it takes effect immediately.
• Mobile usage and error reports — our legitimate interests in understanding which tools are used and improving app reliability. Section 5 describes the limited fields and the Usage & error reports switch in Settings, which stops new collection when you object.
• A diagnostic disagreement, and feedback you send us — consent, Article 6(1)(a), given by pressing send, because both carry whatever you chose to put in them. Ask us and we will delete what a particular one sent.
• Everything an organization records about its own customers — the organization’s basis to choose and to be able to defend, not ours. We process it on their instruction.
• Your elevation is deliberately not on this list, because it never reaches us at all: the phone reads it on a tap, converts a pressure with it, and sends nothing (section 8).

What you can require, and how it actually happens here (Articles 15 to 22).

• Access, Article 15. Write to the address in section 22. We verify the request is yours by replying to the address on the account, and we answer with a description of the record we really hold rather than a form letter.
• A copy in a portable form, Article 20. There is a full export: a zip of CSV files, one per table, that spreadsheets and databases open directly. Section 20 describes what is in it, who can ask for it, and the button it does not have yet.
• Rectification, Article 16. The work records are editable in the app by anyone whose role allows it, so an address typed wrong is fixed there rather than by email. Your own name and the email address on your account are not editable in the app today — write to us and a person changes them.
• Erasure, Article 17. Read section 15 before you rely on this one. Archiving a record is not erasing it, erasure here is a person deleting rows on request, and three things are outside what that reaches.
• Restriction, Article 18. There is no flag in the database meaning “hold this, do not use it”. If you ask for one while something is in dispute, we do it by hand and tell you exactly what we did. That is the honest version of a promise we cannot enforce in software.
• Objection, Article 21. The probe diagnostics and Usage & error reports settings let you object to those uses separately. There is no profiling, no advertising and no marketing list to come off — the only email we send is about your account, an invitation, or a report you sent.
• Automated decisions, Article 22. Nothing here makes a decision about a person, with legal or similarly significant effects or otherwise. TunePro grades a refrigeration system, and its conclusion is shown to the technician standing in front of the equipment, who decides what to do about it.
• Withdrawing consent. Where consent is the basis, withdrawing it is the same switch that gave it. Turning probe diagnostics off discards its unsent queue. Usage reporting stops collecting new events, but its native SDK may finish sending already buffered reports. Neither switch undoes processing that had already lawfully happened.

We answer within one month, and it costs you nothing. If a request is genuinely complicated we may take up to two months longer, in which case we will say so, and say why, inside that first month.

Where your records physically are (Article 44), and what we do not have.

Isles Mechanical is a company in the State of Florida, United States, and TunePro runs on one rented server there, with the database and the nightly backups on the same machine (section 14). So from the moment you save a record it is in the United States. There is no copy in the UK or the EEA, and no setting that would keep one there. In practice that means United States law reaches the machine your records sit on, including a lawful demand made there, which we would have to answer. Stripe and Resend, who between them handle payments and every email we send, are United States companies as well.

Two of the six sit closer to you, and it is worth saying which way that cuts. The address lookup in section 13 goes to the OpenStreetMap Foundation in the United Kingdom, or to MapTiler in Switzerland where an operator has configured it instead — both places the European Commission has ruled offer adequate protection, so that transfer needs nothing further from either of us. It is also the smallest of them: a line of typed text, sent by our server rather than by you. The map tiles are the opposite shape — your browser asks CARTO for them directly, so your IP address goes, and no proxy of ours sits in the way.

And the part a privacy page is tempted to leave out. We are not certified under the EU–US Data Privacy Framework. We do not have a data processing addendum with standard contractual clauses to hand you. We have no representative in the EEA under Article 27 either — the address in section 22 reaches a person directly, and that is the only route there is. If your company cannot put its customers’ addresses into a product on those terms, we would far rather you learned it from this page than after you had.

Complaining about how we handled something. You can take it to a supervisory authority, and you do not have to come to us first — though we would rather you did, because it is usually faster. In the United Kingdom that is the Information Commissioner’s Office, at ico.org.uk. In the EEA it is the data protection authority of the country you live in, work in, or where the thing you are complaining about happened. If the complaint is about records inside an organization, that company is the controller, so it is them the authority will be asking.

20Asking us about your data

Write to us and ask. You can ask what we hold about you, ask for a copy, ask us to correct something, or ask us to delete an account or an organization. We will verify the request is really yours before we act on a deletion.

One honest limit first. If you are a technician in a company’s organization, the records in it belong to that company, so a request to delete them goes to them and not to us.

There is a full export, and this page claimed otherwise until September 2026. An owner or an admin can ask TunePro for everything it holds for their organization and get back a zip of CSV files, one per table: every site and its address, every site contact, every unit, the roster, the checklists, every synced reading, the maintenance programs, visits and appointments, the commissioning walks, every report and every delivery attempt on it, and a manifest of every photo. Archived records are in it, carrying the date they were archived, because an archive that quietly left them out would be a smaller thing than the account. The files are ordinary UTF-8 CSVs that Excel, Numbers, Sheets and any database import tool open directly; the zip carries a README explaining every file in it; and the sites and equipment files import straight back into TunePro.

Two things about it are deliberate. It is not gated on the plan. A company whose card expired, or who has decided to leave, is exactly the company that needs its own records, and withholding them until a subscription is paid would contradict the promise in our terms that those records are theirs. It is limited to owners and admins, and to three requests an hour, because one file holding every customer’s address and phone number is a larger disclosure than any single screen it is assembled from.

Four things are held out of it, each for a reason the archive states: the photo images themselves — the manifest lists every one of them, and we will produce the files if you ask; the rendered report documents, which are hundreds of kilobytes of frozen page each and downloadable one at a time as PDFs; the secret inside a report link, which is not a record but the key that opens a customer’s address to whoever holds it; and anything that signs you in, so no password hashes and no session tokens.

What it does not have yet is a button. The export is an endpoint rather than a screen today, so for now you ask us and we produce your organization’s archive — same address, same verification. If you are comfortable doing it yourself, a signed-in owner or admin can fetch it from /api/org/export, which is the same thing the button will do. And if what you want is one specific record rather than the lot, ask for that instead; we would rather send you the record.

Questions about what is stored are answered with a description of the record, not a form letter. That is easy to promise while the company is small, and it is what we intend to keep doing.

21Changes to this notice

This notice changes when the software changes, and the date at the top moves with it. If a change materially affects what we collect or who we share it with, we will email the address on the account before it takes effect. The disclosures above and the list in section 10 must change if collection expands or a live ad unit is added — that is the point of writing them down.

22Contact

Isles Mechanical LLC, for TunePro. Write to hello@tunepro.ac. Replies come from a person.