Last updated: March 15, 2026
At 86Steps, we take your privacy seriously. This Privacy Policy explains how we collect, use, protect, and share information about you and your end-customers when you use our field service management platform. By using 86Steps, you agree to the collection and use of information in accordance with this policy. This policy should be read alongside our Terms of Service.
When you use 86Steps, we collect information in the following categories: (a) Account Information - your name, email address, phone number, business name, company address, and password (stored as a cryptographic hash, never in plain text). (b) Business Data - job scheduling records, route information, service history, quotes, invoices, payment records, crew assignments, territory definitions, and inspection reports you create through the platform. (c) End-Customer Data - names, email addresses, phone numbers, physical addresses, vehicle information, service history, and any other data you enter about your customers. (d) Payment Information - billing details processed securely through Stripe; 86Steps does not store full credit card numbers on its servers. (e) Location Data - GPS coordinates collected with your consent when using fleet tracking, route optimization, and dispatcher features. (f) Communications Data - phone numbers used for SMS delivery, email addresses used for notifications, message delivery statuses, and opt-out preferences. (g) Usage Data - login timestamps, pages visited, features used, browser type, device information, and IP addresses collected automatically to maintain and improve the platform.
We use the information we collect to: operate, maintain, and provide all features of the 86Steps platform; process transactions, send invoices, and manage subscription billing; send automated SMS and email communications including appointment reminders, invoice notifications, payment reminders, quote follow-ups, review requests, and booking verification codes; provide AI-powered route optimization using Google Gemini and AI-powered help assistance using OpenAI; perform geocoding and distance calculations using Google Maps; deliver real-time GPS tracking and route playback for fleet management; generate business reports and analytics; provide customer support and respond to inquiries; detect, prevent, and address technical issues and security threats; comply with legal obligations; and improve and develop new features based on aggregated usage patterns. We do not sell your personal data or your end-customers' data to third parties.
86Steps enables you to store and manage personal data about your own customers (end-customers) as part of providing field service management functionality. In this context, you act as the data controller for your end-customers' data, and 86Steps acts as a data processor, processing end-customer data solely on your behalf and according to your instructions through the platform. End-customer data we process on your behalf includes: names, contact information, service addresses, vehicle details, job history, invoices, payment records, and any custom field data you define. We do not access, use, or share your end-customers' data for any purpose other than providing the 86Steps service to you. You are responsible for ensuring that you have obtained appropriate consent from your end-customers for the collection and processing of their data, and for complying with all applicable privacy laws governing your use of their data. End-customer data collected through the customer portal (profile information, job requests, vehicle data) and online booking (contact details, booking verification codes, service selections) is processed in the same manner and subject to the same protections.
86Steps provides a customer portal and online booking system that your end-customers may use to interact with your business. When end-customers use these features, we collect and process the following data: (a) Magic Link Tokens - when an end-customer accesses the customer portal, we generate a single-use, time-limited magic link token sent via SMS or email. These tokens serve as passwordless authentication credentials, are cryptographically generated, expire after a limited time period, and are invalidated after use. Used and expired tokens are retained in our system with restricted access for security auditing and abuse prevention purposes, and are permanently deleted in accordance with our data retention schedule described in Section 12. (b) Booking Verification Codes - when an end-customer submits an online booking request, we send a numeric verification code via SMS to confirm their phone number. These codes are short-lived and single-use; once verified or expired, they are marked as consumed and retained with restricted access for auditing purposes, subject to the same retention schedule. (c) Portal Profile Data - end-customers may view and update their contact information, service address, and vehicle details through the portal. This data is stored as part of your customer records and is subject to the same protections described in Section 3. (d) Booking Request Data - service selections, preferred dates/times, contact information, and any notes provided during the booking process. All customer portal and online booking data is processed on your behalf as described in Section 3. Token-based authentication artifacts (magic links and verification codes) are transmitted securely via encrypted channels.
86Steps sends automated SMS and email communications on your behalf to your end-customers, and directly to you for account-related purposes. Types of communications include: appointment reminders and scheduling notifications, invoice and payment reminders, quote and estimate follow-ups, review requests, booking verification codes via SMS, and service-related updates. For SMS communications: message frequency varies based on activity and notification settings; standard message and data rates may apply depending on the recipient's mobile carrier; all SMS messages include opt-out instructions ("Reply STOP to opt out"); opt-out requests are handled by our SMS provider (Twilio) at the carrier level. For email communications: all emails include sender identification and a custom reply-to address if configured by the account owner; emails comply with the CAN-SPAM Act. You may configure a custom reply-to email address on the Notifications page, which requires verification via a 6-digit code sent to that address. We retain communication delivery logs (recipient, timestamp, delivery status) for service reliability and troubleshooting purposes.
We implement administrative, technical, and physical security measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include: encryption of all data in transit using TLS/SSL; encryption of sensitive data at rest; secure authentication with bcrypt-hashed passwords; role-based access controls with granular permissions per feature; multi-tenant data isolation ensuring each organization's data is accessible only to authorized members; session-based authentication with secure cookie handling; and regular security assessments. While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but will promptly address any identified vulnerabilities.
86Steps uses cookies and browser local storage to provide essential platform functionality. Specifically: (a) Session Cookies - used to maintain your authenticated session while you are logged in; these are essential for the platform to function and cannot be disabled. (b) Authentication Tokens - securely stored to verify your identity across requests. (c) Local Storage - used to remember UI preferences such as sidebar state, selected views, and dismissed notices. We do not use third-party advertising or tracking cookies. We do not engage in cross-site tracking. You can manage cookie preferences through your browser settings, but disabling essential cookies will prevent you from using the platform.
We share the minimum data necessary with the following third-party service providers to deliver platform functionality: (a) Stripe - for payment processing and subscription billing; receives payment details, billing information, and transaction amounts. (b) Twilio - for SMS and text message delivery; receives phone numbers and message content. (c) Mailgun - for transactional and notification email delivery; receives email addresses, sender information, and message content. (d) Google Maps Platform - for geocoding, directions, distance calculations, and map display; receives physical addresses and coordinates. (e) Google Gemini AI - for AI-powered route optimization; receives job locations and scheduling parameters. (f) OpenAI - for the AI help assistant; receives user questions about 86Steps features (no personal customer data is sent to OpenAI). Each third-party service operates under its own privacy policy and data handling practices. We encourage you to review their respective privacy policies. We select our third-party partners carefully but are not responsible for their data handling practices or policy changes.
86Steps uses artificial intelligence and automated processing in the following ways: (a) Route Optimization - Google Gemini AI analyzes job locations, crew assignments, and scheduling constraints to suggest optimal route ordering. Location data and job parameters are shared with Google for this purpose. (b) AI Help Assistant - OpenAI processes user questions about 86Steps features to provide contextual help and guidance. Only the user's question and relevant platform documentation are shared; no personal customer data or business records are sent to OpenAI. (c) Standard Routing - Google Maps Directions API calculates travel times and distances between job locations. No automated decisions with legal or similarly significant effects are made solely by AI systems. Route optimization suggestions are advisory and can be modified or overridden by users at any time.
In the event of a data breach that affects your personal information or your end-customers' data, we will: notify affected users within 72 hours of becoming aware of the breach, in accordance with applicable data breach notification laws; provide details about the nature of the breach, the categories and approximate number of records affected, and the likely consequences; describe the measures we have taken or propose to take to address the breach and mitigate its effects; and cooperate with relevant supervisory authorities as required by law. We maintain incident response procedures to detect, investigate, and respond to security incidents promptly.
You have the right to: access your personal data and request a copy in a structured, commonly used format; correct inaccurate or incomplete personal data; request deletion of your personal data (subject to legal retention requirements and legitimate business needs); restrict or object to certain processing of your data; withdraw consent for optional data processing at any time without affecting the lawfulness of processing based on consent before its withdrawal; and lodge a complaint with a supervisory authority if you believe your data protection rights have been violated. To exercise any of these rights, please contact us at admin@86steps.com. We will respond to your request within 30 days and may ask for identity verification before processing your request.
We retain your account data and associated end-customer data for as long as your account is active and as needed to provide you with the service. Upon termination or cancellation of your account, you may request a copy of your data within 30 days. After this 30-day period, we will permanently delete your data from our active systems within 90 days, except where retention is required by applicable law, regulation, or legitimate business purposes (such as resolving disputes, enforcing our agreements, or complying with legal and accounting obligations). Communication delivery logs are retained for up to 12 months for service reliability purposes. Aggregated or anonymized data that cannot be used to identify any individual may be retained indefinitely for analytics and service improvement purposes. You may request deletion of your data at any time by contacting us at admin@86steps.com, and we will process such requests in accordance with applicable data protection laws.
86Steps is operated from the United States. If you access the platform from outside the United States, your data may be transferred to, stored in, and processed in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from the laws of your country. By using 86Steps, you consent to the transfer of your information to the United States and other jurisdictions as necessary to provide the service. Where required by applicable law, we implement appropriate safeguards for international data transfers, including standard contractual clauses or other approved transfer mechanisms, to ensure that your personal data receives an adequate level of protection regardless of where it is processed.
86Steps is a business-to-business platform designed for field service companies and is not directed at children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal data from a child under 13, we will take steps to delete such information promptly. If you believe that a child under 13 has provided personal information to us, please contact us at admin@86steps.com so we can take appropriate action.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting a notice on the platform or sending an email to your registered address at least 30 days before the changes take effect. Your continued use of 86Steps after the updated policy takes effect constitutes your acceptance of the changes. We encourage you to review this Privacy Policy periodically. The "Last updated" date at the top of this page indicates when the policy was most recently revised.
If you have any questions about this Privacy Policy, how we handle your data, or wish to exercise any of your data protection rights, please contact us at: admin@86steps.com. We will respond to privacy-related inquiries within 30 days.