This policy explains what information Sholar Solutions LLC collects when you use Toferon, how we use it, and the choices you have.
1. Information we collect
- Account information — your name, email address, and password (stored as a strong one-way hash, never in plain text).
- Workspace data — the business records you and your team store: clients, quotes, invoices, jobs, payments, and settings, including your logo and brand color. This includes job photos your team uploads, time-clock and mileage records, and materials or expenses logged against jobs.
- Location data — only when a signed-in team member chooses to use it: tapping “use my location” or building a route for verified mileage sends the device’s coordinates to compute an address or road distance, and the confirmed addresses and coordinates of a trip are stored as part of that mileage record. Toferon never collects location in the background.
- Property access notes — customers (or staff) may record how a crew should access a property (for example gate codes). These are visible only to the workspace serving that customer, and the customer can update or clear their own note from the portal at any time.
- Customer portal access — your customers sign in with secure, single-use email links; we store their email address and the records you keep about them on your behalf.
- Operational logs — security-relevant events (sign-ins, invitations, changes to money records) kept as an audit trail for your workspace.
2. How we use it
We use this information solely to operate Toferon: authenticating you, running your workflows, sending the emails you trigger (quotes, invoices, sign-in links), and keeping the service secure. We do not sell personal information, and we do not use your workspace data for advertising.
3. Cookies
Toferon uses only essential cookies: a session cookie to keep you signed in and a preference cookie for your light/dark theme. There are no third-party advertising or tracking cookies.
4. Service providers
- Email delivery — transactional emails are delivered by Resend.
- Payments — online payments run through your own Stripe account, and Toferon subscriptions run through ours; card details go directly to Stripe and never touch our servers.
- Text messages — optional “on my way” texts are delivered by Twilio; the customer’s mobile number and the message content are shared with Twilio to send them.
- Maps & routing — address suggestions and route distances are computed by a geocoding provider (Mapbox, or OpenStreetMap-based services); only the addresses or coordinates being looked up are sent — never names or other records.
- AI drafting — when you use an AI-drafting feature, the text you submit is processed by Anthropic to generate the draft; it is not used to train their models.
- Hosting — the service and its database run on infrastructure we manage; backups are encrypted in transit and stored off-site.
5. Text messaging (SMS)
Businesses on eligible plans can send service-related texts — such as an “on my way” notice when a technician is heading to an appointment — to customers who provided their phone number when requesting or booking service.
- No sharing for marketing. Mobile numbers and text-messaging consent are never sold or shared with third parties or affiliates for their own marketing purposes. Numbers are shared only with our SMS delivery provider (Twilio), solely to deliver the message.
- Message frequency varies with your service appointments — typically one text per scheduled visit.
- Message and data rates may apply, depending on your mobile carrier and plan.
- Opting out — reply STOP to any text to stop receiving messages, or HELP for help. You can also ask the business serving you to remove your number.
The full messaging program — including how consent is collected — is documented at toferon.com/sms.
6. Data isolation and security
Every workspace’s data is isolated by tenant at the application layer and enforced again at the database with row-level security. Passwords are hashed with Argon2, secrets are encrypted at rest, and sign-in links are single-use and expire quickly.
7. Retention and deletion
We keep your data for as long as your workspace is active. Workspace owners can download a complete export and delete the workspace themselves at any time from Settings → Your data; deletion removes your workspace from the live system immediately, with residual copies aging out of backups on a fixed schedule. Questions or recovery requests: [email protected].
8. Your customers’ rights
For the customer records a business stores in its workspace, that business is the data controller and Sholar Solutions LLC is a processor acting on its instructions. If you are a customer of a business that uses Toferon, direct requests about your data to that business; we will support them in fulfilling it.
9. Changes
We will update this policy as the service evolves and notify workspace owners of material changes. Questions are always welcome at [email protected].