HVAC.TOP Android privacy policy

Provider and responsibilities

The provider is VERCOD, upravljanje spletnih portalov, d.o.o., Spodnja Polskava 100, 2331 Pragersko, Slovenia (registration number 7534132000). Privacy contact: info@vercod.com. We control account, support and service-security data. For customer data entered by installers, the installer or their business normally determines the purposes and we process the data on their instructions under the data processing agreement.

Contact us: info@vercod.com

Data processed by the application

Signing in sends your email and password over HTTPS to authenticate your existing HVAC.TOP account. The server stores a password hash, not a readable password; the Android application does not persist your password. It receives your account ID, name, email, language and access/subscription status.

The app retrieves and sends the records you access or create: customer and primary-contact names, company and tax details, postal addresses, email addresses, phone numbers, site details, visit dates, technical measurements, notes, tasks and calendar entries. Visit attachments may contain photos, documents and handwritten signatures. Only enter data that you are authorized to process.

For connected-device management and security, we process an installation-generated identifier, device name/model, app version, IP address, connection and last-use times, session tokens and technical request/error records. The installation identifier is not an IMEI or MAC address; the server stores its hash. Administrators and the account holder can view and revoke connected sessions.

Purposes and legal grounds

We use these data to authenticate users, synchronize field work, generate and send reports, manage tasks, provide support, protect accounts and troubleshoot failures. Processing is based on providing the agreed service, applicable legal obligations, legitimate security interests and consent where required. Customer records are processed on the business user's instructions. These data are not sold or used for advertising profiles.

Photos, files and device access

Taking a photo opens the device camera application at your request. Selecting an attachment uses Android file-selection controls; the chosen file is uploaded when you request it. The app does not scan your photo library, read your phone address book, SMS or call history, or access the microphone. Addresses entered in records and IP addresses are still processed. The app has no advertising SDK.

The optional Insert GPS location button requests precise foreground location only when you use it. Coordinates are placed in site access instructions and uploaded when you save or synchronize the site. You can edit or remove them or enter instructions manually. No background tracking takes place.

Offline work and remembered sign-in

The app stores downloaded records and pending changes in private application storage so field work can resume after connection loss. Cached record payloads and pending changes are encrypted with keys protected by Android Keystore. Photos awaiting upload and generated PDFs can also exist as private local files; we do not claim that every file is separately encrypted.

Remembered or permanent sessions store an encrypted access token, not your password. Pending changes may synchronize in the background when connectivity returns. Revoking a device blocks subsequent server access but does not remotely erase copies already on an offline device. Signing out clears the account cache and pending work; clearing Android app storage or uninstalling removes local app data, not server records or copies exported to other apps.

Recipients and service providers

Data are sent to HVAC.TOP infrastructure and accessed by authorized personnel and hosting, security, maintenance and email providers as needed to operate the service. Cloudflare may process connection information when protecting the service. Reports sent by email go to the recipients you specify through the configured email provider. Opening or exporting a PDF gives the selected external application access to that file; recipients may retain their own copies.

The native Android app does not collect payment-card details or include a Stripe checkout. Web subscription payments are handled separately by Stripe. If a provider processes data outside the EEA, applicable transfer safeguards such as adequacy decisions or standard contractual clauses are required. Contact us for information about providers and safeguards relevant to your account.

Retention and security

Account data and work records are kept while needed to provide the service, until authorized deletion, or for applicable accounting, security and legal obligations. Log retention depends on the category and configured retention rules. Restricted recovery backups have a separate lifecycle: deleting a live record does not instantly remove every backup copy. Erasure requests must also account for backups and restoration; any necessary retained records are restricted to their justified purpose.

We use HTTPS, authenticated access, account-level access controls and restricted operational access. No system is completely secure. Protect your device and report suspected unauthorized access to info@vercod.com. Do not send passwords or access tokens in a support message.

Request account or data deletion

Administrator-marked deletion provides 30 days of free access, followed by 30 days of locked access and then erasure of operational data and files. An administrator can cancel until permanent erasure starts. The login profile is anonymized and cannot be restored. Accounting and justified security records remain restricted to their retention purpose; backups and exported copies have separate retention. Existing debts are not waived. Contact support to request deletion or cancellation.

You may request deletion of your HVAC.TOP account and associated data, or specified personal data without closing your account, by emailing info@vercod.com with the subject "HVAC.TOP account and data deletion". Include your account email and the scope of your request, but not your password. This support-managed request does not require installing or signing into the app. We verify authority, explain any necessary legal retention and handle requests within applicable legal deadlines.

For records controlled by an installer business, contact that business or ask us to route the request. Deleting the app or revoking a device is not account deletion. Export needed work before requesting deletion. Copies already sent to email recipients or exported outside HVAC.TOP must be addressed with those recipients separately.

Contact us: info@vercod.com

Your rights and policy updates

Subject to applicable conditions, you may request access, correction, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent for optional processing. Contact info@vercod.com; you may also complain to the Slovenian Information Commissioner or your competent supervisory authority. The service is intended for professional installers, not directed at children. Changes to these practices will be reflected in this policy and its update date.