Privacy Policy

1. Two kinds of people in Cervan

You, the business owner. You create an account, so we hold your account and business information.

Your customers. When you add a customer, send an estimate, text an ETA or collect a payment, you decide what information goes into Cervan. For that information you are the owner and controller of the data; we process it on your behalf and only to run the Service for you.

2. Information we collect

• Account information. name, email address, password (stored hashed, never in plain text), and optional phone number.
• Business profile. business name, address, logo, license number, service area, and the settings you choose.
• Business records you create. customers, appointments, estimates, invoices, expenses, receipt photos and notes.
• Payment information. handled by Stripe. Card and bank numbers are sent directly to Stripe and never stored on Cervan servers. We keep non-sensitive records such as amount, status, last four digits and payout references.
• Usage and device data. pages visited, features used, IP address, browser and device type, plus error logs. Used to keep the Service working and secure.
• Support messages. anything you send us through the in-app help button or by email.

3. How we use information

• To provide the Service: create documents, schedule jobs, send messages, take payments.
• To bill you for your plan and to enforce plan limits.
• To send transactional email and text messages you or your customers trigger.
• To provide support, investigate problems and prevent fraud or abuse.
• To improve the Service using aggregated, de-identified usage data.
• To comply with law, tax and accounting obligations.

We do not sell your data or your customers’ data. We do not use your business records to advertise to you or to anyone else.

4. Service providers we share with

We only share information with vendors that help us run Cervan:

• Stripe. payment processing, subscription billing and payouts.
• Twilio. text messaging (ETA, appointment and payment texts).
• Resend. transactional email delivery.
• Supabase and Cloudflare. database, file storage, authentication and hosting.
• OpenAI. the AI assistant, Cervan Voice, speech transcription and receipt reading. Only the input and account context needed for that feature is sent, and it is not used to train public models.
• Google Maps Platform. address lookup, routing and service area checks.

The full list, with what each provider does and the data involved, is on our Subprocessors page. We do not sell personal information and we do not share it for cross-context behavioral advertising.

We may also disclose information if required by law, to protect our rights or users’ safety, or as part of a merger or acquisition (in which case this policy continues to apply).

4a. When Cervan is a processor for you

For information about your customers, leads and team members, you are the controller and Cervan acts on your instructions as a processor. Those terms, including security, incident notice, deletion and assistance with data subject requests, are in our Data Processing Addendum, which applies automatically to your account.

4b. Google account connections (Calendar and Gmail)

Cervan lets each user optionally connect their own Google account so their Cervan jobs sync to their own Google Calendar, and, if they turn it on, so customer email can be read and sent from their own Gmail inside Cervan. Every user authorizes their own Google account. Cervan never uses one shared Google account, and one user's Google data is never visible to another Cervan business.

Exactly what we request, and why:

• Google Calendar events (read and write). to create, update and remove the calendar events that match your Cervan jobs, and to read your existing events so we do not double book you. We do not request access to your calendar settings or other calendars.
• Gmail (read and modify). only if you enable the Cervan inbox: to list and open the email threads that belong to your customers, download their attachments, send replies from your own address, mark messages read or unread, change labels and move messages to Trash. Cervan cannot permanently delete your email.
• Your Google email address. to show you which Google account is connected. We do not request your Google profile, photo or contacts.

How that data is used. Google data is used only to run the feature you turned on, on your screen, for you. Cervan does not generate aggregated or anonymized data sets from Google user data. We do not sell Google user data, we do not use it for advertising or ad targeting, we do not use it for lending, credit or underwriting decisions, and we do not use Google Workspace API data to develop, improve or train generalized artificial intelligence or machine learning models. Cervan's AI features read only your Cervan records, such as jobs, customers and invoices, and never your Gmail messages or Google Calendar events.

How it is shared. We do not transfer Google user data to third parties except to the infrastructure providers that run Cervan on our behalf under contract (cloud hosting and managed database), for security investigations, or where the law requires it. Those categories are listed on our subprocessors page. Google user data is never shared with advertisers, data brokers or AI model trainers.

How it is protected. Your Google authorization tokens are encrypted at rest with AES-256-GCM and stored where only Cervan's server code can read them. They are never sent to your browser or to any other user. All traffic to Google runs over HTTPS, and access is scoped to your own account.

Retention and deletion. We keep only what the feature needs: your encrypted Google tokens, the connected email address, the Google event ID linked to each Cervan job, and the message metadata shown in your inbox. Email bodies and attachments are fetched from Google when you open them and are not stored by Cervan. When you disconnect Google, we revoke the token with Google and delete the stored connection immediately. If you delete your Cervan account, all Google data is deleted within 30 days. You can also request deletion at any time by emailing us, and we will confirm when it is done.

Cervan's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time in Cervan under Settings, Connections, or at myaccount.google.com/permissions. Disconnecting revokes our access and deletes the stored connection; calendar events already created stay in your Google Calendar unless you remove them.

5. Text messages and email

Cervan sends messages to your customers only when you trigger them. Before texting a customer you must have their permission. Customers can reply STOP to opt out of texts at any time, and HELP for help. Message and data rates may apply. See our Messaging Policy for details.

6. Security

Data is encrypted in transit (TLS) and at rest. Access is restricted per account: each account can only read and write its own records, enforced at the database level. Passwords are hashed, and payment credentials never touch our servers. No system is perfectly secure, so please use a strong, unique password and tell us right away if you suspect a problem.

7. How long we keep data

We keep your data while your account is active. If you cancel a paid plan and stay on Free, your data stays. If you delete your account, we delete your business records within 30 days, except records we must keep for legal, tax or fraud-prevention reasons (typically payment records for up to 7 years).

8. Your choices and rights

• Access, correct or export your data from inside the app, or by emailing us.
• Delete your account and data by emailing support@joincervan.com.
• Opt out of non-essential email at any time; transactional email is required to use the Service.
• Depending on where you live (for example California, or the EU/UK), you may have additional rights to know, delete, correct, or object to processing. Email us and we will honor them. We will not discriminate against you for exercising any right.

9. Children

Cervan is for business use by adults. We do not knowingly collect information from anyone under 18. If we learn we have, we delete it.

10. Where data is processed

Cervan is operated from the United States and data is processed there. If you use Cervan from outside the U.S., you understand your information will be transferred to and stored in the U.S.

11. Changes

If we make a material change to this policy, we will update the date above and notify you in the app or by email before it takes effect.