This policy covers the Total Quality OnSite mobile app, used by Total Quality Building Services ("TQ") clients, managers and field employees. It describes what the app collects, who can see it, and how long it is kept. It is presented in the app and must be accepted before the app can be used. Since version 2026-08-17 the in-app text is tailored per role — clients, field employees and managers each read the sections that apply to their account; this page is the complete combined form.
1. What the app collects
| Category | What exactly | Why |
|---|---|---|
| Account | Name, email address, role, assigned building(s), sign-in times, app version, and an internal random identifier used instead of your email when linking records | Access control, support, version management |
| Work records | Service requests, supply orders, schedules and availability, inspection and cleaning reports, work orders, proposal requests, survey answers, and attached photos; for equipment technicians, the supply audit videos they record or send, with their sound | Operating and documenting the cleaning services |
| Profile picture (staff accounts, optional) | A picture of yourself that you choose to take or upload in Settings. The TQ office sees it first and approves it before anyone else does; once approved it is shown beside your name wherever the app shows you, including to clients of the buildings you work at. The office can also set or remove it | So the people you work with, clients included, can recognise you |
| Messages | The full text and photos of messages sent in the app. Text is encrypted where it is stored, but TQ holds the key — see section 3 | Service quality, operations monitoring, dispute resolution |
| Usage data | Screens opened and time spent, taps and navigation, which features are used. Collected only after this policy is accepted; reports arriving without an acceptance on file are discarded | Finding broken or confusing parts of the app |
| Device & connection | The make and model of your phone, its operating system version, the app version you are running, your language and time zone, and the internet address (IP) your phone connects from. Kept as one record per device, updated each time you connect rather than added to — it is what you are running now, not a history. The full internet address is stored encrypted and can be read only by authorized TQ administrators; a coarse form of it (your network, not your device) is kept readable | Support and diagnosis, security, version management, and telling one site from another |
| Presence | Whether you are currently connected, and when you were last seen | Showing colleagues who is reachable |
| Location (staff only, opt-in) |
Your current position, plus a 90-day track history of reported positions, while signed in — see section 2 | Showing the office who is on site and coordinating work without phone calls |
2. Location — staff only, and only if you agree
TQ managers and field employees are asked separately, inside the app, whether the app may use their location. Clients are never asked and are never located.
If you agree, the app reports your position while you are signed in, so the office can see who is on site and route work. TQ stores your current position and a track history of your reported positions for the last 90 days; older history is deleted automatically, and all of it is erased when your account is deleted. The history is visible to the TQ office; a manager's current position is additionally visible to other TQ managers on the in-app team map, and an assist request may quote a manager's distance to a colleague. Employee positions are never shown to other field staff.
On Android, reporting runs as a foreground service, which means a permanent notification is visible the whole time it is active. You may decline location and continue to use every other part of the app, and you may withdraw permission at any time in your device settings.
3. Messages are not private
Message text is encrypted at rest, with its own key for each conversation, which protects it if the database itself is ever copied. This is not end-to-end encryption: TQ holds the keys. The people in a conversation can read it, and authorized TQ office staff can read any conversation — each time they open one they are not part of, that is recorded. The office can also message you directly in the app: each member of the office writes in their own conversation with you, shown under their own name. Messages are analyzed in aggregate, including common keywords, for service quality.
Managers read only conversations they are part of — their own direct messages, and group chats they set up or were added to. A manager who is away can let one other manager read their conversations with clients and crew at buildings they choose, read-only and for at most 30 days; each such read is recorded, and the manager can see what was opened.
TQ may also send announcements to everyone, or to everyone in a role, for things like planned maintenance. Those are notices, not conversations.
Please do not use in-app messaging for private personal matters.
Conversations are separated per person: two clients at the same building cannot see each other's threads.
4. Biometrics and offline data on your device
If you enable fingerprint or face unlock, that check is performed by your device and the result alone is used. No biometric data is ever sent to TQ.
Anything you submit while offline is stored encrypted on your device until it can be delivered — including across sign-out — and is then removed.
5. Employee activation
Employees activate an account with their employee ID and date of birth. The date of birth is never stored as entered — it is converted to a one-way cryptographic fingerprint used only to confirm a match against the payroll roster, whose own values are stored the same way. The employee ID you typed is kept, together with the outcome of the attempt and the network address it came from, in a security audit log that protects the activation process against abuse; that log is retained even if the account is later deleted. The payroll file itself is processed in memory and not retained by the app.
6. Administrator access
Authorized TQ administrators can open the app as your account to diagnose problems, and can hide or correct individual items shown to you. Every such session is recorded, and any change made during one is attributed to the administrator, not to you.
7. Who else sees it
TQ operates its own servers and mail system. Your data is not sold and is not used for advertising. Information is shared only as needed to do the work:
- TQ's own project, scheduling and supply boards, and TQ's work-order and inspection system;
- for a supply order, the vendor filling it — what was ordered and the delivery address;
- where required by law, or to establish or defend legal claims.
What each role receives is enforced on our servers, not merely hidden in the app: field-employee sessions are never sent prices or dollar amounts, and client sessions are not sent internal work-order or cost detail.
8. How long it is kept
| Data | Retention |
|---|---|
| Photos attached to anything | Deleted automatically about 2 years after upload. The record they were attached to remains |
| Supply audit videos (equipment technicians) | Deleted automatically 1 year after upload. The supply report they belong to remains |
| Profile picture (staff) | Not on the 2-year schedule: kept until it is replaced or removed, or the account is deleted. A picture the office does not approve is deleted when it is refused |
| Messages | Kept as part of the conversation they belong to, including after an account is deleted (shown to others as from “Deleted user”) |
| Usage data, presence | While the account is active, and as long as needed for the purposes above |
| Device & connection record | Deleted 180 days after a device last connects — the record is replaced on each connection, never appended to — and removed immediately when the account is deleted |
| Location | Current position overwritten on each report; track history deleted automatically after 90 days; both removed entirely when the account is removed |
| Requests, orders, reports, work orders | Retained as TQ business records |
You can delete your own account in the app (Settings → Delete account). Deletion starts a 72-hour grace period during which it can be cancelled — from the same screen or by the office — and is then carried out automatically: the sign-in, settings, consent record, personal preferences, usage records, device and connection records, survey answers, location data and uploaded photos and videos are erased, and the email address is released for re-registration. Operational records (requests, orders, reports, work orders) and the audit trail of account activity are retained as business records. Messages you sent in conversations with other people stay in those conversations, shown to them as from “Deleted user”; TQ keeps a record of who sent them.
9. Your choices
Accepting this policy is required to use the app with a TQ account; declining signs you out. Staff may decline location separately. You can delete your account yourself in the app (section 8); to ask what is held about you, or to request correction or deletion on your behalf, contact office@tqservices.biz.
Acceptance is recorded with your name, role, the policy version and the date and time. When this policy changes, the app presents the new version and asks you to read it before continuing.