Legal · CCPA

Notice at Collection

Last updated: July 12, 2026 · Applies to California residents under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)

This Notice at Collection describes the categories of personal information WorkReceipt collects from California residents at or before the point of collection, the purposes for which that information is collected, and how long it is retained. This notice supplements our full Privacy Policy.

Categories of personal information collected

Identifiers

Not sold or shared

Examples: Name, email address, IP address, account username

Purpose: Account creation, authentication, and customer support

Retention: Duration of account; deleted immediately upon account-deletion request (brief residual copies may exist in routine backups until rotated out)

Commercial information

Not sold or shared

Examples: Subscription plan, billing history, payment method type (not card numbers — those are processed by Stripe)

Purpose: Processing payments and managing your subscription

Retention: 7 years (tax / financial records requirement)

Professional or employment-related information

Not sold or shared

Examples: Business name, trade type, service area, phone number, business logo

Purpose: Customizing your account and customer-facing reports

Retention: Duration of account; deleted immediately upon account-deletion request (brief residual copies may exist in routine backups until rotated out)

Customer-submitted content

Not sold or shared

Examples: Job notes, voice recordings (converted to text), before/after photos, customer names, job locations

Purpose: Generating AI-powered job reports and storing your work history

Retention: Duration of account; deleted immediately upon account-deletion request (brief residual copies may exist in routine backups until rotated out)

Precise geolocation

Not sold or shared

Examples: GPS coordinates and accuracy (in meters) captured when you tap "Stamp this job's location" on a job — available on Solo-tier plans and above, never captured automatically or in the background

Purpose: Recording an on-site proof-of-work timestamp and location for your own records and dispute documentation. We reverse-geocode the coordinates into an approximate street address (house number omitted) using OpenStreetMap's Nominatim service.

Retention: Duration of account; deleted immediately upon account-deletion request, same as other Customer-submitted content above (brief residual copies may exist in routine backups until rotated out)

Internet or network activity

Not sold or shared

Examples: Browser type, device type, pages visited within the app, feature usage

Purpose: Service operation, debugging, and improving reliability

Retention: 90 days rolling

Inferences

Not sold or shared

Examples: Trade type inferred from job notes to improve AI vocabulary suggestions

Purpose: Improving the quality of AI-generated reports

Retention: Duration of account

Sale or sharing of personal information

WorkReceipt does not sell your personal information to third parties. WorkReceipt does not share your personal information with third parties for cross-context behavioral advertising purposes.

We share personal information only with service providers who help us operate WorkReceipt (Supabase for database and auth, Stripe for payments, Netlify for hosting, Anthropic for AI report generation, Google for Day Planner address geocoding, and Retell for businesses that use the optional Call Desk add-on to answer calls and route leads). These providers are contractually prohibited from using your data for any purpose other than providing services to WorkReceipt.

Sensitive personal information

WorkReceipt does not collect most categories of sensitive personal information defined under the CPRA — we do not collect Social Security numbers, financial account credentials, racial or ethnic origin, health data, or biometric data. The business address or service area you enter in your profile is not precise geolocation tracking — it is a text field you fill in voluntarily.

One exception: precise geolocation. WorkReceipt's optional GPS check-in feature (available on Solo-tier plans and above) does collect precise geolocation, which the CPRA classifies as sensitive personal information. This only happens when a technician affirmatively taps a location-stamp button for a specific job — there is no automatic or background location tracking, and the browser's own location-permission prompt governs whether it's allowed at all. See the "Precise geolocation" row in the table above for what's collected and how long it's kept. This data is used solely to provide the proof-of-work feature you or your team member requested — never for advertising, profiling, or any purpose beyond delivering that feature. It is visible only to your account and (for Business-plan team workspaces) teammates with access to that job — it is never included in the public customer-facing report link, and never sold or shared for cross-context behavioral advertising.

Your California privacy rights

As a California resident, you have the right to:

✓Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you
✓Right to Delete: Request deletion of your personal information (subject to certain exceptions)
✓Right to Correct: Request correction of inaccurate personal information
✓Right to Opt out of sale/sharing: We do not sell or share your data, so there is nothing to opt out of
✓Right to Non-discrimination: We will not discriminate against you for exercising any of these rights
✓Right to Limit use of sensitive information: The only sensitive personal information we collect is precise geolocation, gathered solely to provide the GPS check-in feature you or your team affirmatively use — never for advertising or profiling. Because our use is already limited to that purpose, there is nothing further to opt out of, but you may still contact us to ask that a specific job's location data be deleted

How to submit a request

To exercise any of your rights above, email us at support@workreceipt.app with the subject line "CCPA Privacy Request". We will verify your identity and respond within 45 days. If we need more time, we will notify you and may extend the deadline by an additional 45 days.

Authorized agents may submit requests on your behalf with written permission from you. We may require additional verification in those cases.

Contact

For questions about this notice or your privacy rights: support@workreceipt.app