Valish & Company

App privacy policy

Effective September 20, 2026 · Updated October 15, 2026

This policy covers the Valish workplace app and the partner portal at admin.valish.co. The workspace is for authorized employees, workers, sales representatives, and subcontractors. The separate partner portal lets authorized business partners follow shared projects and handle leads referred to them. Your organization, role, and enabled access determine which records you can access.

Partner portal and referral information

We receive partner company and contact details from the partner or our staff, including the email enabled for portal sign-in. We send one-time sign-in codes to that address and use a session cookie to keep the partner signed in. We also process sign-in attempts, a hashed network address for rate limiting, and access records to protect the portal. The partner portal does not require a Google account or access to a partner’s calendar.

Projects: when a partner refers work to us or is given access to a project, they can view the shared project name, location, status, dates, progress, schedule, partner messages, and eligible shared photos, videos, and documents. This view does not include the project’s customer phone or email fields, internal staff notes, insurance details, or project financials. Information included within a shared file or message is visible to its recipients; staff should share only content appropriate for that partner.

Leads: when we refer a customer to a partner, we share the customer’s contact details, job address, requested work, partner notes, and the relevant referral terms so the partner can contact the customer and handle the inquiry. The partner’s status reports and notes are returned to the referring company and retained in the referral history. The partner can view agreed fees, confirmed amounts, and recorded payments for those referrals.

Partners may be independent businesses that handle customer information under their own privacy practices. Contact the receiving partner about information they collect while quoting or performing their work. Portal access is limited to the partner’s enabled businesses and shared work; it does not grant access to unrelated customers or the staff workspace.

Removing access ends the partner’s ability to view the affected work in the portal; it does not erase referral history, business records, or copies already received. To request a correction, access removal, or deletion of partner information, contact info@valish.co. We may verify your identity and retain records needed for contractual, accounting, security, or legal purposes. The workplace Settings and account-deletion form below apply to workplace accounts; partners do not need a workplace account to contact us.

See the partner portal terms and partner portal guide.

Information used by the app

Account and contact details: your name, email, account identifier, profile picture, role, business assignments, and contact details you or an administrator provide.
Work records: projects, leads, assignments, schedules, time entries, comments, messages, documents, photos, videos, receipts, and other content entered or uploaded. Depending on your role, these may include addresses, estimates, invoices, compensation, and payment records.
Location: with device permission, your location is used for maps and job-site time-clock verification. The app does not request continuous background location tracking.
Camera, photos, and microphone: when you use capture, upload, scan, or voice-assistant features, the app processes the content you choose to provide. Supported scanning features can include room geometry and images.
Device and usage information: notification tokens, app interactions, and diagnostics help deliver notifications and troubleshoot the service. The web workspace also uses session replay. Native iOS builds disable replay of screen contents, network bodies, and console output.
Connected services: optional Google sign-in and calendar connections process identity, authorization tokens, and calendar information needed for the features you authorize.

How information is used and shared

We use this information to authenticate users, coordinate work, provide company resources, maintain business records, deliver requested features, protect accounts, and diagnose problems. Workspace information is shared with authorized people according to their business and role. Content intentionally shared through customer links or publishing tools can be seen by its intended audience or publicly when published.

Service providers process information for these purposes. They include Supabase for authentication, database and storage; Vercel for hosting and web analytics; Google for optional sign-in, calendars and maps; Apple for push delivery; Resend for email; and LogRocket for diagnostics and session replay. Connected chat and document-signing services process the communications and documents handled through those features.

Optional assistant and drafting features use providers including OpenAI and Anthropic. After their separate permission prompt, these features can send your prompt, selected attachments, voice input, conversation history and relevant workspace context to a provider to produce a response. You can decline them or reset the assistant permission in Settings. Responses can be incorrect and should be checked before use.

We do not sell personal information or use it for cross-company advertising tracking. We may disclose information when required by law or to protect the security and rights of the people using the service.

Posting safety and upload processing

Before posting, the workplace agreement asks permission to send submitted text and images, including text and rendered pages from PDF uploads, to OpenAI for automated content safety checks. Uploaded project images and receipt PDFs may also go to Anthropic to distinguish job-site photos from documents and suggest receipt details. Review those suggestions before saving. This processing is separate from optional assistant features.

Plain-text and CSV file contents are included in these text checks. Normal work updates do not wait for manual approval. You can decline the posting agreement and continue browsing; content that requires these checks cannot be posted until you accept. If a safety check is unavailable, the app asks you to retry. Graphic job-site images may be shown with a warning.

We store your agreement, safety-check results and records needed to handle reports and appeals. A report can include the reported content or a snapshot, the reporter and author identifiers, the reason and details, and administrator responses and actions. Authorized administrators review these records. You can see responses to your reports in Settings → Content & safety, or contact us to appeal a decision.

Storage and retention

Authentication credentials, cached work data, queued offline actions and a device credential for disconnecting notifications may be stored on your device. Server records, including moderation records, are reviewed under our retention and deletion process. Removing an account identifier alone may not remove personal details contained in uploaded content or report text. Service providers may process data in the United States or other locations where they operate.

We use access controls and encrypted connections to protect information. No system is completely secure. Protect your device and do not share your account credentials.

Your choices and account deletion

You can change camera, microphone, location, photo, and notification permissions in your device settings. Calendar access can be revoked in your Google Account. Some features will be unavailable if their required permission is declined.

To permanently delete your account and associated personal data, open Settings → Delete account, or submit a deletion request here. Requests are completed within 30 days and confirmed by email. You do not need to contact support to complete the request. Records that must be retained for legal obligations, such as payroll, tax, or contractual records, may be kept; any exceptions will be explained in the completion confirmation.

Contact us to request access to or correction of your personal information, or to ask about retention. Your organization may need to verify your identity before providing records.

Contact and changes

Valish & Company, PO Box 12, Lehighton, PA 18235.
info@valish.co · (570) 213-9080

The app is a workplace tool and is not directed to children. We will update this page when our practices change and revise the effective date above.