Privacy policy

Effective date: October 19, 2026

This policy explains what personal data Narrow Ways Farm, LLC, doing business as Thinkfleet ("ServFlo", "we", "us") collects, why, who we share it with, and the choices you have. It covers the servflo.ai website, the ServFlo web app at app.servflo.ai, the ServFlo technician app for iOS and Android, and the pages ServFlo hosts for the businesses that use it (customer portals, invoice and quote links, booking pages, payment pages and business websites).

Two kinds of people, two roles

ServFlo is software for field service businesses: plumbers, electricians, HVAC companies, cleaners and so on. That means two kinds of people show up in ServFlo.

• Our customers. The businesses that sign up for ServFlo, and the people who work for them (owners, office staff, dispatchers and technicians). For their account and billing data, and for visitors to servflo.ai, ServFlo decides how the data is used. We are the controller (in US state law terms, the "business").
• Our customers' customers. The homeowners and other clients of those businesses. A business puts their names, addresses, phone numbers, jobs, invoices, photos and so on into ServFlo to run its work. For that data the business is the controller and ServFlo is a processor (a "service provider"). We handle it only to provide ServFlo to that business and on its instructions.

If you are a customer of a business that uses ServFlo (for example, you received a reminder text, an invoice link or a booking confirmation), that business is responsible for your data. Please contact the business first with questions or requests about your information. If you contact us, we will pass your request to the business and help it respond.

What we collect from businesses and their staff

Account data. Name, email address, phone number, password or passkey, second-factor settings, the business (organization) you belong to and your role in it. Sign-in, sessions, organizations, members, invitations and roles are handled by Base316, our account and billing provider. Your session is kept in a secure, httpOnly cookie on app.servflo.ai.

Billing data. Your plan, billing interval, trial status, invoices, AI credit and text message usage, and credit pack purchases. Plan changes, payment cards and invoices are handled in Base316's billing portal. ServFlo does not receive or store your full card number.

Business data. Everything you enter or create to run your business: customers and their contacts, properties and service addresses, requests, quotes, jobs, visits, schedules, invoices, payments, memberships, pricebook, inventory, expenses, equipment records, notes, photos, videos, forms, signatures, timesheets, messages, automations, reviews, websites and settings. See "What we process for businesses" below.

Technician app data. When a technician uses the ServFlo app:

• the jobs for today and tomorrow, stored on the phone in an encrypted database so the app works without signal, and deleted from the phone on sign-out;
• shift clock, breaks, travel and job times, with the time each action happened;
• photos and short videos taken on the job (with any markup drawn on them), job notes, checklists, forms, signatures, quotes and payments recorded on site;
• a push notification token, so the app can tell the technician when their jobs are booked, moved or cancelled.

Location. With the technician's permission ("while using the app"), the app shares the phone's precise location only while the technician is clocked in or on the way to a job, and only while the app is open. It pauses when the app goes to the background and is never collected off the clock. The business's office sees the technician's latest position on its dispatch map. When the technician taps "On my way", the customer they are driving to can follow them on a tracking link until they arrive, never before or after. We keep each technician's latest position and a trail of positions for two weeks, then delete the trail. A technician can turn location off in the phone's settings; the rest of the app keeps working. "Directions" opens Google Maps, Apple Maps or Waze, which are separate apps with their own privacy policies. The in-app map shows job addresses on map tiles from OpenFreeMap. Face ID or fingerprint unlock is handled by the phone itself; ServFlo never receives biometric data.

Usage and technical data. Our servers record requests (such as the page or operation, the time, the result and a request ID) to run, secure and debug the service. We keep an activity log of changes made in each business (who did what and when, including changes made by Flo, the AI assistant, or through the API). We use IP addresses, or a one-way hash of them, for rate limiting and abuse prevention.

Support and communications. What you send us by email, live chat or our forms.

What we process for businesses

When a business uses ServFlo, it may put the following personal data about its own customers into ServFlo, and ServFlo processes it on the business's behalf:

• names, contact people, email addresses and phone numbers, and contact preferences (whether a number may be texted, whether marketing emails are allowed);
• service addresses and property details. Addresses are converted to map coordinates (geocoded) using OpenStreetMap's Nominatim service;
• requests, quotes, jobs, visit history, equipment at the property, photos, signatures and notes;
• invoices, payments, tips, refunds and membership plans. For online payments, ServFlo stores the card brand and last four digits, never the full card number (see "Payments");
• emails and text messages the business sends through ServFlo, and replies;
• online booking and website form submissions, with where the visitor came from (the page, referrer, campaign tags and ad click IDs);
• Google reviews of the business, and which customer wrote a review when the reviewer's name matches exactly one customer.

End customers also use pages ServFlo hosts for the business: the customer portal, invoice and quote links, payment pages, online booking, membership sign-up, the email and text preferences page, and the business's website. What they enter there goes to the business.

What we collect on servflo.ai

Demo and contact forms. Your name, email address, and optionally your phone number, business name, trade, team size and message, plus the page you sent it from. We email each request to our team through Amazon Simple Email Service (Amazon SES), and we may also file it as a lead in our own ServFlo account. We use it to answer you and to follow up about ServFlo.

Scheduling a demo. After a demo request you can pick a time on our Cal.com booking page. We pass it your name and email to fill in the form. Cal.com handles the booking under its own privacy policy.

Live chat. The chat bubble is provided by Crisp. If you use it, Crisp receives your messages and anything you choose to share (such as your email address), along with technical information about your browser. Crisp stores cookies and local storage in your browser to keep your conversation going between pages and visits.

Photos. Some photos on servflo.ai and on business websites built with ServFlo are loaded directly from Unsplash or Pexels, as their terms require. When your browser loads one, that service receives your IP address and browser information.

Website analytics. With your permission, we use Google Analytics on servflo.ai to understand traffic, page views, referral sources and how visitors use the website. Google Analytics uses cookies and receives technical information about your browser and visit. The Google Analytics tag does not load until you choose Allow analytics. We remember your choice for 30 days. You can decline analytics or change your choice using Cookie settings in the footer. Turning analytics off stops future measurement; it does not remove data already collected. Google signals and advertising personalization are disabled in our tag configuration. Crisp uses its own cookies and storage for live chat, as described above.

Business websites, QR codes and visitor statistics

Businesses can publish a website with ServFlo and print QR codes. To show them simple statistics, ServFlo counts:

• Website page views per day and page, using a beacon that sets no cookie.
• QR code scans: the device type, phone system and browser family (read from the browser's user agent), the country when our network provides it, and a daily visitor hash (a one-way hash of the IP address, user agent, day and a secret value), used only to count unique scanners. We do not store the IP address.

A business website also remembers, for the length of the browser tab, the first page of the visit, so a booking or message can say where the visitor came from.

How we use personal data

• To provide ServFlo: run accounts, store and show your data, send the emails and texts you ask for, process payments, sync with the tools you connect, and run the technician app.
• To bill for ServFlo, count usage (AI credits and text segments) and enforce plan limits.
• To secure ServFlo: authenticate users, prevent abuse and fraud, rate-limit requests, keep audit logs and investigate incidents.
• To support you and answer your requests.
• To tell you about changes to ServFlo and, if you are a business customer or asked for a demo, about our products. You can opt out of marketing emails at any time.
• To comply with the law and enforce our terms.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We do not use the data of our customers' customers for our own purposes.

AI features

ServFlo's AI features use Claude, a model provided by Anthropic:

• Flo (AI assistant). The chat assistant answers questions about your business and proposes changes. To answer, it sends Anthropic your question, your name and role, the business's name, the date, the page you are on, and the records it reads to answer (for example, customers, jobs or invoices). It can only see and do what your role allows, and every change waits for you to approve it. Your conversations are saved to your account, visible only to you, and you can delete them.
• Review replies. When you ask for a draft, ServFlo sends the review and, when there is one, the matched customer's last job.
• Website copy. When a business builds a website, ServFlo sends its services, plans, service area and trade to draft the pages.

Each request includes only the business data needed for it. Anthropic processes it as our subprocessor to return a response. ServFlo does not use your data to train AI models. AI output can be wrong, so ServFlo shows drafts for you to review and nothing is sent or posted until you choose to.

Payments

What businesses pay ServFlo is billed through Base316 and its payment processor.

What end customers pay a business goes through Stripe Connect. Each business has its own Stripe account and is onboarded and verified by Stripe. Customers pay on Stripe-hosted pages, so card and bank details go straight to Stripe and never reach ServFlo's servers. ServFlo stores the payment's amount, tip, status, fees, Stripe's reference numbers, the payment method type and the card brand and last four digits. A customer can choose to save a card with Stripe for automatic membership payments. Stripe uses payment data under its own privacy policy, including for fraud prevention.

Emails and text messages

Businesses send emails and texts to their customers through ServFlo (reminders, "on my way" texts, quotes, invoices, receipts and campaigns). Texts and phone calls go through Twilio, on an account ServFlo provides to the business (or a Twilio account the business connects instead); emails go through ServFlo email (ServFlo's own Amazon SES account, the default) or the provider the business connects in its messaging settings instead: Resend, Postmark, SendGrid, Mailgun or its own Amazon SES account. ServFlo keeps a log of each message, its content and its delivery status, and records replies, opt-outs (such as STOP), bounces and complaints so they are honored.

ServFlo also sends its own emails to users, such as notifications about their account and their business.

ServFlo text alerts. If you turn on text alerts in Settings → Notifications and give your mobile number, ServFlo texts you from its own toll-free number about your work and account: jobs assigned to you or cancelled, and account, billing and integration alerts. Message frequency varies. Msg & data rates may apply. Reply STOP to stop, HELP for help. Turning alerts on is optional and not required to use ServFlo; you can turn them off at any time in the same place.

Mobile numbers and text consent are never shared for marketing. Mobile phone numbers and SMS opt-in and consent data, ours and those the businesses collect through ServFlo, are not sold, rented or shared with third parties or affiliates for their marketing or promotional purposes. They are shared only with the providers that deliver the messages (Twilio and the mobile carriers), and only to deliver them. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the text message services.

Integrations you connect

• Google Business Profile. If a business connects Google, ServFlo reads its locations and reviews and posts the replies the business writes. Tokens are stored encrypted. Disconnecting revokes access; reviews already synced stay.
• QuickBooks Online (Intuit). If a business connects QuickBooks, ServFlo sends customers, invoices, payments and related records to the business's QuickBooks company. Tokens are stored encrypted. Disconnecting revokes access.
• Webhooks. A business on a plan that includes them can send event data to addresses it chooses. What happens there is the business's responsibility.

Who we share data with

We share personal data only:

• with the subprocessors below, to run ServFlo;
• within a business, according to the roles the business sets (for example, technicians see only their own jobs, and cost data is hidden from roles without access);
• with services a business chooses to connect (Google, QuickBooks, its messaging providers, its webhook endpoints);
• when the law requires it, or to protect the rights, safety and property of our users, the public or ServFlo;
• with a buyer or successor if ServFlo is involved in a merger, acquisition or sale of assets, under this policy's protections.

Subprocessors

Where a business connects its own Twilio, email, Google or QuickBooks account, that provider also acts under the business's own agreement with it. We will update this list when we add or change a subprocessor.

Where data is stored

ServFlo stores data in the United States, on Amazon Web Services in the us-east-2 (Ohio) region. Some subprocessors may process data in other countries (for example, Crisp is based in the European Union). If you use ServFlo from outside the United States, your data is transferred to and processed in the United States, where data protection laws may differ from those in your country.

Security

We use technical and organizational measures designed to protect personal data, including:

• encryption in transit (HTTPS/TLS) for the website, the app, the API and the technician app;
• integration tokens, webhook secrets and messaging provider credentials encrypted with AES-256-GCM, under keys we can rotate;
• database row-level security, so each business's records are separated from every other business's at the database level, in addition to permission checks on every request;
• role-based permissions, with every change recorded in an activity log;
• session tokens kept in httpOnly cookies, not readable by page scripts; two-factor sign-in and passkeys supported; each login can be signed in on at most two devices at a time;
• an encrypted local database on technicians' phones, with the key held in the phone's secure storage, and optional Face ID or fingerprint unlock;
• database backups with point-in-time recovery.

No system is perfectly secure. If we learn of a security breach that affects your personal data, we will notify you and, where required, the authorities, as the law requires.

How long we keep data

• Business data is kept while the business's account is open, so the business can use it. When an account is closed, we delete or de-identify the business's data within 30 days, unless the business asks for an export first or we must keep it by law. Backups are overwritten within 35 days after that.
• Downgrading a plan does not delete anything: the business can still see everything it made.
• Operational records are deleted on a schedule: system event records after 90 days, webhook delivery logs after 30 days, the QuickBooks sync log after 90 days, Stripe event IDs after 30 days, and the activity log after 365 days.
• Technician app data on the phone is limited to today's and tomorrow's jobs, photos are removed from the phone once uploaded, and signing out deletes the business's data from the phone.
• Conversations with Flo are kept until the person deletes them or the account is closed.
• Website and demo requests sent to us are kept as long as needed to follow up and for our business records.
• Billing and payment records are kept as long as tax, accounting and financial laws require.

Your rights and choices

Depending on where you live, you may have the right to:

• know and access the personal data we hold about you;
• correct inaccurate data;
• delete your data;
• get a copy of your data in a portable format;
• opt out of the sale or sharing of personal data, or of targeted advertising. We do neither;
• appeal a decision we make about your request.

Business users can view and correct most of their data in the app. A business can ask us for an export of its data at any time.

Deleting your account. Accounts are created by the business you work for, which can remove you at any time. You can also ask us to delete your ServFlo account, from the web app or the technician app, by emailing privacy@servflo.ai from the address you sign in with. We delete your account and sign-in details within 30 days. Records you made while working for a business (such as job notes, photos and timesheets) belong to that business and stay with it, without your account.

To make a request, email privacy@servflo.ai. We will verify your identity before acting on it, usually by confirming you control the email address on the account. You may use an authorized agent where the law allows; we may ask for proof of their authority. We will respond within the time the law requires (for example, 45 days under California law). We will not discriminate against you for exercising your rights.

If you are a customer of a business that uses ServFlo, please send your request to that business, which controls your data. If you contact us, we will forward it to the business. You can always stop marketing emails and texts from a business through the unsubscribe link in its emails, by replying STOP to its texts, or on the preferences page linked in its messages.

US state privacy rights

Residents of California and other states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Texas and Oregon) have the rights described above. In the last 12 months, for our own customers, users and website visitors, we have collected the categories described in this policy: identifiers (such as name, email, phone, IP address), commercial information (plan and billing history), internet activity (requests to our servers, chat), professional information (business name, role, trade) and, for technicians, records of work time and job photos. We collect them for the purposes in "How we use personal data" and disclose them only to the recipients in "Who we share data with". We do not sell personal data or share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the data of anyone under 16. We do not use sensitive personal data (such as account passwords) for anything other than providing ServFlo.

For data a business puts into ServFlo about its customers, ServFlo acts as that business's service provider, and the business handles consumer requests.

Children

ServFlo is a tool for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email privacy@servflo.ai and we will delete it.

Changes to this policy

We may update this policy as ServFlo changes. We will post the new version here with a new effective date. If a change materially affects how we use personal data, we will tell business customers by email or in the app before it takes effect.

Contact us

Narrow Ways Farm, LLC, doing business as Thinkfleet
A North Carolina limited liability company
2890 Mount Pleasant Road South, Mount Pleasant, NC 28124
privacy@servflo.ai