Information the H38 Business Office may process
The Business Office is an authenticated business operations system. Depending on the features a business uses, it may process:
- Account information such as email address, user identifier, role, business membership, and authentication/session information.
- Business records such as customers, vendors, requests, jobs, schedules, tasks, quotes, change orders, invoices, payments, expenses, mileage entries, inventory, equipment, and audit records.
- Project content such as notes, measurements, documents, photos, screenshots, video, audio captured with video, and other files intentionally added by an authorized user.
- User-private Personal Assistant records such as reminders, tasks, routines, notes, memory items, priorities, and due times. These records are stored separately and scoped to the signed-in user.
- Technical and security information needed to authenticate users, synchronize offline work, diagnose errors, and protect tenant boundaries.
Camera and microphone permissions
The Android app requests camera and microphone access so an authorized user can intentionally capture site photos, measurements, and walkthrough video. The app does not continuously record. Camera or microphone capture starts only when the user chooses a capture feature and grants the required device permission.
How information is used
- To operate the Business Office and keep authorized business records synchronized across devices.
- To create, edit, review, print, and deliver business documents such as quotes when the owner uses the existing approval and delivery controls.
- To store project evidence, measurements, notes, receipts, photos, video, and documents associated with the correct business record.
- To provide requested AI-assisted features, including quote drafting, photo review, measurement assistance, and concept rendering.
- To maintain proof logs, error logs, security controls, tenant isolation, and offline recovery.
- To provide support and respond to account, privacy, or deletion requests.
Website traffic counts
The public website counts page views with Highway 38's own first-party counter, run on the same Supabase service listed below. It records the page visited, the referring site (host name only — no query strings), the general device type (phone, tablet, or desktop), and a one-way daily code that changes every day and cannot be used to follow a visitor from one day to the next. It sets no cookies, stores no raw IP addresses, and does not use Google Analytics or any advertising or cross-site tracker. Page counts are used only to understand which pages people read.
If the website helper cannot answer your question and you choose to leave a phone number or email address, our team may use it later to send you an answer; contact details left this way are used only for that reply.
AI-assisted processing
When an authorized user explicitly runs an H38 AI feature, the information needed for that request may be sent from the Business Office through Highway 38's server-side Supabase functions to OpenAI for processing. This can include project text and selected project images. AI output remains subject to the Business Office's owner-review controls; it does not automatically approve a quote, send a customer message, make a purchase, or make a payment.
Service providers
Highway 38 uses service providers to operate the system. Current providers can include:
- Supabase for authentication, database records, tenant authorization, private storage, and server-side functions.
- OpenAI for AI-assisted processing when an authorized user invokes an AI feature.
- GitHub Pages for website and Business Office web application hosting.
- Google Play for Android app distribution and platform services.
- Google Drive only when a business explicitly configures its own Drive as an optional file-storage provider.
Highway 38 does not sell Business Office user or customer data to advertisers.
Sharing and access
Business information is available only to authorized users according to their business membership and role. User-private Personal Assistant records are scoped to the signed-in user. Information may also be processed by the service providers above as necessary to provide the requested feature, or disclosed when legally required.
Security and offline storage
The Business Office uses authenticated access, HTTPS, tenant authorization, and database row-level security. The mobile/web app can keep a limited offline cache and queued work on the device so field work is not lost when connectivity drops. Signing out, clearing app/site storage, or uninstalling the app removes device-local data under the control of that device.
Retention and deletion
Records are retained as needed to provide the Business Office and to preserve legitimate business, accounting, audit, security, and legal records. Account holders can request deletion of their H38 account and user-private information. Shared business records created in the course of business may need to be retained by the business even after a user's access is removed.
See H38 account and data deletion for the request process and what is deleted or retained.
Children
The H38 Business Office is a business operations product and is not directed to children under 13.
Contact
Privacy, access, correction, and deletion questions can be sent to highway38solutions@gmail.com.