What we collect
We process account identity and verification data, FieldRoutes employee identity and access-profile data, authentication and security events, device and app diagnostics, support submissions, and employee performance data for authorized Romex employment purposes. The app no longer collects or provides in-app messages. Historical encrypted message data is retained only within the approved rollback, backup-retention, and legal-hold process while the 1.1.0 retirement gate is completed.
Optional app performance summaries
You can enable Share app performance in the iPhone app’s Support screen. Romex receives grouped loading times and crash/hang counts with app build and major iOS version, to identify slow or unreliable releases. These summaries contain no account or device identifiers, customer information, KPI values, raw diagnostic stacks, or advertising data. Sending requires sign-in; ordinary authentication and abuse-prevention records are separate. Summaries are retained for 30 days. You can turn sharing off at any time, which clears summaries that have not been sent.
Customer identity in recent activity
Customer display names may appear in private KPI Recent Activity. Technicians see names only for services or sales attributed to their own linked technician identity. App-role managers and administrators may see names only for technicians within their authorized scope. A technician's elevated FieldRoutes KPI-read profile does not grant access to customer names on another employee's activity. Customer contact details, addresses, and identifiers remain outside this view.
Sales and payment qualification
After the approved backfill and source-coverage checks are complete, restricted snapshots may be used server-side to derive whether both the initial appointment and qualifying payment are complete. The private native app may show only the subscription identifier, sale amount, credited technician revenue, and a green composite check when both conditions are true. It does not reveal either component status, failure reasons, staleness, customer identity beyond the separately described authorized Recent Activity names, balances, amounts collected, payment methods, raw financial rows, or payment history. The website does not show this composite check.
Use and sharing
Data is used to authenticate employees, provide authorized KPI reporting, operate employee programs, protect and support the service, and meet employer obligations. Access is limited by app role, management scope, and approved FieldRoutes access-profile policy. Data is not sold or used for cross-context behavioral advertising.
Service providers
Romex uses FieldRoutes as an authoritative work-data source, Amazon Web Services for primary application, database, and encrypted backup hosting, Cloudflare for authoritative DNS, Postmark for transactional account email, and Apple for App Store Connect, private app distribution, passkeys, and optional push delivery. During the bounded migration period, Abacus AI may securely relay requests from an older supported app version to the primary service without remaining a separate system of record. Access-controlled source-control and monitoring services are also used by the engineering team. Providers receive only the data required for their service and must be governed by Romex's access, security, retention, and deletion requirements.
Planned reporting features—not yet enabled
Romex is preparing finalized bonus-estimate reporting, an updated driving-performance calculation, and review of eligible work-note explanations. These features are not yet enabled. Their access, source-accuracy, retention, and service-provider controls must be verified before activation, and this notice must be updated to reflect the enabled service.
When enabled, technicians will see only their own finalized bonus estimates and aggregate qualifying results. Authorized administrators may review and correct company results through an audited process. Manager access to another employee's bonus information remains disabled unless separately approved. Bonus amounts are estimates. The final amount appears on your paycheck. The app does not process payroll or payments.
The planned Driver Score calculation uses TRUCE session scores and distance. Individual session and device data is processed transiently; the new reporting cache retains minimized period aggregates and protected association evidence needed to verify attribution, not individual trip or location history. Individual sessions are not exposed to app users.
If activated, eligible work-note explanations may be reviewed through the OpenAI API after automated privacy filtering. Requests are limited to sanitized explanation text, appointment date, status, and service type. Customer identifiers, contact details, addresses, payment and billing information, access codes, and raw work records must not be sent. Existing filters remove known names and attempt to mask additional names, but an unrecognized incidental name may remain. Romex accepts this limited residual risk; it is not permission to deliberately send customer identities or unfiltered notes. The model classifies explanations; application rules and authorized administrator review determine qualifying reporting credit. Ambiguous or failed reviews remain pending. Provider data handling and retention must be confirmed separately from the application's storage rules before this review is enabled.
Employee requests
Employees can request access support, correction, or deletion through the app. A deletion request immediately disables access, revokes sessions, and stops push delivery. Account-owned personal data is purged within 24 hours. Deidentified security records may remain for one year and disconnected employer KPI or program records for three years. A documented legal hold may delay deletion of the specific records it covers.
App-account deletion is distinct from the employer's retention of reporting and audit records. The planned financial, driving-evidence, and explanation-review records follow the approved employer-audit policy: finalized bonus history is retained indefinitely, and supporting evidence is preserved as recorded at payroll close without automatic short-term expiration. These restricted records may remain linked to an employee or administrator after app-account deletion; they are not covered by a promise of automatic three-year deletion or anonymity. Inactive FieldRoutes technicians are excluded from ordinary Bonus reports and exports, not erased from the retained audit history. See the Retention and Deletion Policy for this distinction and the remaining verification requirements.