Privacy Policy
Effective 19 September 2026
Who we are
Cycle is field service management software operated by Aqua-Star Pools, Inc.(“we”). It is sold to service companies, who use it to run their scheduling, job records and invoicing. Contact us at matt@aquastarpools.net.
Two kinds of data, treated differently
This distinction determines who is responsible for what, so we state it first.
- Account data — information about the service companies who subscribe and the staff who sign in. We decide how this is used, and we are the controller of it.
- Customer data — information a service company holds about their customers: names, addresses, job history, invoices, photographs of work. We process this on that company’s instructions and for no purpose of our own. They are the controller; we are the processor. If you are a customer of a service company that uses Cycle, your relationship is with them, and requests about your data should go to them.
What we collect
| Data | Why |
|---|---|
| Name, email, phone, address, date of hire of staff users | To create accounts and control what each person can see |
| Password, stored only as a bcrypt hash | To authenticate. We cannot read it, and neither can an administrator |
| Customer records, service addresses, job and visit history, field notes, photographs | The operational purpose of the software, entered by the service company |
| Invoices, estimates, payments, credits | Billing, and synchronisation with QuickBooks |
| QuickBooks access and refresh tokens, and the company realm id | To synchronise accounting data on the company’s instruction |
| Stripe identifiers, card brand, last four digits, expiry | To take card payments. We never receive or store a full card number |
| Approximate location of service addresses | Mapping and route planning |
| Error and synchronisation logs | To diagnose failures and support customers |
We do not collect information about visitors who are not signed in beyond what a web server necessarily records, and we do not use advertising or analytics trackers.
How we use it
To provide the software, authenticate users, synchronise with services the company has connected, take payments they initiate, send messages they choose to send, and support and secure the service. We do not sell data. We do not share it for advertising. We do not use customer data to train machine learning models.
Who else processes it
| Provider | What they handle |
|---|---|
| Railway | Application hosting and the database, United States |
| Intuit (QuickBooks Online) | Accounting data, only where a company has connected it |
| Stripe | Card payments and payouts. Card numbers go directly to Stripe and never reach us |
| Resend | Delivery of emails the company chooses to send |
| Anthropic | Processes a question and the relevant records when an office user asks the built-in assistant. Off unless enabled per user |
| Amazon Web Services | Photograph storage, where a company has configured it |
How it is protected
- Encrypted in transit with TLS.
- QuickBooks tokens encrypted at rest with AES-256-GCM, using a key held outside the codebase.
- Passwords hashed with bcrypt. No mechanism exists to recover one, by design.
- Each company’s data is isolated at the data layer. The company identity comes from a signed session, never from anything a browser sends.
- Access within a company is limited by role and by individual permission, including what a field technician may see.
No system is perfectly secure, and we do not claim otherwise. If a breach affects personal data we will notify affected companies without undue delay.
How long we keep it
- While the subscription is active — operational records are kept, because they are the company’s business history.
- Disconnecting QuickBooks — stored tokens are deleted immediately. Records already imported are kept: disconnecting is not a request to erase history.
- Records deleted in QuickBooks — flagged as no longer present and excluded from balances, but retained so past reports still reconcile.
- After a subscription ends — data is retained for 90 days so it can be exported or the account reinstated, then deleted. A company may ask for deletion sooner.
- Logs — retained up to 12 months for diagnosis and security.
Your rights
Depending on where you live you may have rights to access, correct, delete, or export your personal data, and to object to some processing.
If you are a customer of a service company using Cycle, contact that company. They control your data; we act on their instructions and will assist them.
If you are staff at a subscribing company, contact us at matt@aquastarpools.net.
Location
Data is stored and processed in the United States. If you are elsewhere, using Cycle involves transferring your data there.
Children
Cycle is business software and is not directed at anyone under 18. We do not knowingly collect their data.
Changes
We will update this page and revise the effective date. Material changes will be notified to subscribing companies directly.