Privacy Policy

Draft — pending attorney review. This page is published on the Tilsyn preview site for review only; it is not yet in force.

Version 1.3 (draft) — November 7, 2026. The effective date is inserted when this document is published as binding.

Location data deletes itself

Tilsyn shows owners where their crews are while they work. That positioning data is automatically deleted after 30 days — it is a working tool, not an archive.

How location works — the clock-in rule. The app reports a crew member’s position only while that person is clocked in. Clocking out stops it — being signed in alone never reports a position. Live positions are visible only to people who are themselves clocked in; a person who is not clocked in cannot see anyone’s live position. Each clock-in is recorded with the crew on it — who was clocked in, and therefore who was able to see live positions at the time. That record shows who was on and able to access location; it is kept with the clock-in record. On a company-issued device, your company may set its own rules for the device itself; the clock-in rule above still governs what Tilsyn reports. With live positions, the app also reports battery level and whether the app is in use, so owners can tell a dead phone from a missing crew member.

Your photos belong to your company

The photos, site records, and customer information your company puts into Tilsyn belong to your company. We process them only to run the service for you. We never sell your data, and Tilsyn carries no ads and no advertising trackers.

What we collect

Account details for your company’s people (names, emails, roles); company records (properties, jobs, schedules, notes); job photos, with the time and — where the crew member’s device provides it — the place they were taken; live positions while users are clocked in, as described above; details of issued hardware; billing records; and messages you send us, such as feedback and support requests.

If you are the owner who sets up your company’s account, we also ask for your date of birth, to confirm you are 18 or older and able to bind the company. It is kept with your company’s sign-up record, as part of the business and tax record described in “How long it stays” below.

Separately, any user may add an optional birthday to their own profile as a profile and contact nicety. It is optional, you can edit or remove it, it is not an age gate, and it is removed with your profile.

If you join the interest list, we keep what you send (company, name, email, and your note) so we can contact you about onboarding.

Messages and dictations to the assistant — the text of what you say or type to AMELIA, which we store so she can answer, keep context, and so reports you ask her to file reach us. Dictation is turned into text by your device’s own speech service; Tilsyn receives the text, not voiceprints — the customer product contains no speaker recognition or biometrics. Dictation records are kept as a summary only — not the verbatim transcript — for up to 24 months, then hard-deleted. Assistant audio stays on your device and is purged 3 days after its summary is made, or at 14 days if no summary was ever made.

Assistant observations and console conversations — the assistant keeps observations about your company’s operations (patterns it flags, and the owner’s calls on them) and, in the owner’s console, an archive of conversations with the assistant, so it can remember context between sessions. These are kept indefinitely — they are the operator’s own records and the assistant’s cross-session memory.

Failure and reliability records — when something in Tilsyn fails, a record of what failed, the error, who was using it, and when; we keep these permanently as our reliability review record. Usage records — basic in-product measurements (such as feature use and performance timing) used only to run and fix the service; never for advertising. Usage records are kept for 12 months on a rolling basis, then deleted.

How it is used

To run the operation your company sees on its board: who is where, what each property needs, what is done, and the written record of the day. Also to bill the company, answer support, keep the service secure, and meet legal duties. That is the whole list.

Who else sees it

Only the providers a service like this cannot run without, and only the pieces each one needs. This list is the sub-processor register itself — the same living record we maintain — so it cannot drift from the stack:

Your customers see their own property through the portal your company gives them, and nothing else. We share data with authorities only when the law requires it.

If you work for a company on Tilsyn

Your company is your employer and controls your account. While you are clocked in, the app reports your position to your company’s board; it also records the items above. Your employer is responsible for telling you about monitoring at work; this page tells you what the app itself does.

If you use a company’s customer portal

The company that services your property controls your portal. What you send — messages, map pins, photos, service requests — goes to that company and is kept with your property record. Tilsyn runs the portal for the company and does not use your information for its own marketing. The assistant may answer routine questions and take actions you ask for, such as cancelling a visit; anything else goes to the company as a message.

How long it stays

Positioning data: 30 days, then automatic deletion. The 30-day deletion applies to positioning data — the movement trail. A photo keeps the time and place it was taken as part of the photo’s record, for as long as the photo itself is kept, because that is what makes the photo useful evidence of the work. Photos and company records: until your company deletes them (deletions rest in a 30-day bin first, once the bin is enabled on your account, restorable by an owner) or until your company cancels — on cancellation you get 30 days to export everything, after which the operational data is deleted in full, bin included. Dictation records: kept as a summary only for up to 24 months, then hard-deleted; on-device assistant audio is purged 3 days after its summary is made, or at 14 days if no summary was ever made. Usage records: 12 months on a rolling basis, then deleted. Assistant observations and archived console conversations: kept indefinitely, as the operator’s own records. Email we send about your account is recorded in our email outbox: routine mail is kept for 12 months, while billing mail and the setup-completion welcome email that carries the monitoring packet are kept with the company’s business and tax record. The one exception to deletion on cancellation is the business and tax record described in the Terms — the owner information used to sign up, the company details as entered at setup, and the invoice and payment history — which is kept as a business and tax record for the retention period that applies to such records, and is not deleted on request because the law requires keeping it. Nothing else is kept in that record: no positioning data, photos, messages, or dictations are kept in it, and everything outside that record is erasable on request.

Your levers

Owners control their company’s data from the owners’ desk: export photos in bulk, delete with an owner’s approval, deactivate users (which locks their app sign-in), and manage who has access. For anything else — a copy of what we hold, a correction, a deletion — write to siteviewoperations@gmail.com and we will respond within 45 days.

Security

Owner access to this website is by email and password; the phone apps sit behind a company code, username, and PIN, and issued devices stay tied to their company. We use reasonable technical and organizational measures to protect the data we hold.

Cookies

The website uses only the cookies needed to keep owners signed in. There are no advertising or analytics cookies. The apps store what they need to work on the device itself.

Changes

If this policy changes in a way that matters, we will say so plainly — on this page and to company owners by email — before the change takes effect. Tilsyn is a business service and is not directed at children.

Questions: siteviewoperations@gmail.com