AiboTask AiboTask Legal Public legal documents

Public legal documents

Aibo — Privacy Policy

Version: 1.6 Effective date: 16 July 2026

Platform Provider / Operator: Aibo Technologies (RUC 0924829179001) — operator of Aibo Provider registered address: 3er Cj 20A NorthEast, Guayaquil, Guayas, Ecuador 090502 Privacy contact email: legal@aibotask.com Country: Ecuador Hosting: Amazon Web Services (AWS) — us-east-1 (N. Virginia, United States) Email delivery: Amazon Simple Email Service (AWS SES) Maps / geolocation services: Amazon Location Service (AWS) Push notifications: Amazon Pinpoint (AWS) (using Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) depending on device OS) Analytics / performance telemetry: Amazon CloudWatch Real User Monitoring (CloudWatch RUM) for web portals and related AWS monitoring/telemetry; Google Analytics 4 (Google LLC) on the public marketing website only after analytics consent AI assistance (when enabled): Amazon Bedrock (AWS) for Ludo note-drafting, troubleshooting, and similar copilot responses Admin / commerce services: Aibo web administration services for tenant provisioning, user administration, subscriptions, licensing, billing, and support ticketing Payment processing (subscriptions): the authorized payment provider or app store shown at checkout or on the receipt for subscription and billing transactions Backups: No backups are stored outside us-east-1 (N. Virginia, United States) (as of the effective date)

Multi-tenant note: Aibo can be used by multiple companies (“Tenants”). In most cases, the Tenant Company (your employer/customer) is the Data Controller for work-order data, and the platform provider acts as a Data Processor under contract for that tenant.

1) Scope

This Privacy Policy explains how personal data is processed when using Aibo (the “App”) and related services (the “Service”), including:

  • technician accounts and software-managed operations (work orders),
  • individual Personal workspace accounts where available,
  • customer contact and site information,
  • proof-of-service (photos, signature),
  • GPS location while the technician is ONLINE and, where enabled, during assigned route assist for an assigned job,
  • optional AI-assisted drafting/troubleshooting and voice transcription initiated by the user in Ludo,
  • tenant provisioning, subscription administration, licensing, billing, invoices/receipts, and support ticket workflows handled through Aibo web administration services,
  • visits to the public Aibo marketing website and consented acquisition/conversion analytics described in section 3.9.

2) Roles: Data Controller vs. Data Processor (multi-tenant)

Aibo may be used by multiple companies (“Tenants”).

2.1 Tenant Company (Customer)

The Tenant Company typically acts as the Data Controller for tenant work-order data and proof-of-service, because it decides the purposes and means of processing.

How to identify the Data Controller: The Tenant Company legal name and privacy contact should be provided by your employer/customer through onboarding materials, the policy acknowledgement flow, or another tenant-designated support/privacy channel. If a tenant-specific privacy contact is shown in the app, you may use that contact.

2.2 Platform Provider (Aibo)

The platform provider typically acts as:

  • a Data Processor for tenant work-order data, and
  • a Data Controller for certain platform-level data (for example, account provisioning, license administration, billing administration, support ticketing, security logs, and support communications).

3) Personal data we may process

Depending on configuration, permissions, and user actions, we may process:

3.1 Technician account and usage data

  • Name, employee/internal ID, role
  • Login and authentication events
  • Policy/terms acceptance (version + timestamp)
  • Work order assignments and status updates

3.2 Customer, site, and equipment data (work order context)

  • Customer name, phone, email (if provided)
  • Service address / site location
  • Equipment details (brand/model/serial) entered in the work order

3.3 GPS location / assigned route assist (work-only boundary)

  • GPS points collected while the technician is ONLINE in the App
  • For eligible field technicians with an assigned scheduled or dispatched job, location may also be collected while Assigned route assist is active to keep the assigned route current and detect arrival at the assigned site
  • Assigned route assist may remain active when the app is not in the foreground if the device, OS permission, and current app flow allow it; the user can stop route assist at any time, and it should stop automatically when no eligible assigned route remains
  • Route history and arrival-assist events derived from those points
  • The last known location may remain visible after switching OFFLINE or stopping route assist (no new tracking after the active flow ends)

The collection interval is configured by the Tenant Company (typical interval: about every 5 minutes).

3.4 Proof-of-service and work evidence

  • Photos and images attached to work orders
  • Customer signature as proof-of-service
  • Notes, recommendations, and attachments

Important: Proof-of-service data may be sensitive depending on context. We apply heightened confidentiality and access controls.

3.5 Materials and service activities

  • Activities performed (tasks/checklists)
  • Materials/parts used and quantities
  • Time stamps and job lifecycle events (start/finish/close)

3.6 Technical, device, and security data

  • Device model, OS version, app version
  • IP address and timestamps
  • Diagnostic logs, crash reports, and error telemetry
  • Push notification token (for job alerts)
  • Push notification delivery/interaction events (e.g., sent/delivered/opened) for operational monitoring (via Amazon Pinpoint)
  • Usage analytics and performance telemetry (especially for web portals) using Amazon CloudWatch RUM and other AWS monitoring services

3.7 Ludo AI assistant and voice input (when enabled)

  • Text prompts, questions, and assistant responses generated when you use Ludo or similar copilot features
  • Limited task, equipment, work-order, and log context sent to generate draft notes, troubleshooting suggestions, or similar assistance
  • Optional voice transcription input when you tap Record voice
  • The microphone is used only during the active voice capture started by the user; no background audio recording is intended

3.8 Billing, subscription, licensing, provisioning, and support data

If your Company/Tenant purchases or manages a paid subscription through Provider-operated Aibo web administration services, or if you purchase a Personal plan/add-on through an app store where available, we may process platform-level administrative and commerce data such as:

  • Billing contact name, email, phone (if provided)
  • Company billing details (legal name, RUC/tax ID, billing address)
  • Tenant administrator and invited user account details needed for provisioning and access administration
  • Subscription plan details, license/seat entitlements, invoices/receipts, payment status
  • Support ticket content, attachments, and related communications submitted to Provider-managed support channels
  • Payment transaction references and confirmation details provided by the authorized payment provider or app store used for the transaction

Card data notice: When card payments are used, payment card data is handled by the authorized payment provider, app store, and their compliant systems. The Provider does not store full card numbers or CVV in Aibo. We may receive limited metadata (for example, transaction IDs and payment status) to reconcile billing.

Commercial-flow notice: Aibo web administration services are used for tenant administration and business commercial workflows. Where Personal in-app purchases are enabled, the app store purchase is validated server-side before the Personal workspace or credits are activated.

3.9 Public website analytics (only after consent)

If you choose Allow measurement on the public Aibo marketing website, we use Google Analytics 4 (GA4) to process a deliberately limited set of data:

  • pseudonymous browser, client, and session identifiers created by first-party _ga and _ga_<container-id> cookies,
  • the page origin, path, and title, with the query string removed; the referring-site origin; and allowlisted source/medium values,
  • low-cardinality metadata for approved website events, such as calls to action, pricing-cycle selection, the start of an onboarding handoff, contact outcomes, and allowlisted team-size-band and operation-type selections,
  • approximate geographic information, such as country or region, that Google derives from the visitor's IP address while the request is in transit; Google Analytics does not log or store that IP address, and
  • browser, device, and technical information associated with the visit. Granular location and device-data collection is disabled in GA4.

This implementation does not send GA4 free-text form fields, names, company names, email addresses, telephone numbers, messages, payment references, account/user/tenant/internal identifiers, raw error details, URL query strings, advertising-platform click identifiers, or utm_campaign, utm_content, or utm_term values. It may send only the allowlisted low-cardinality team-size-band and operation-type selections described above. Google Signals, Google Ads linking/advertising personalization, and Enhanced Measurement are disabled.

After consent, limited campaign and click-attribution values may be held in session storage for the current browser session only. If you continue to an approved Aibo onboarding or contact/demo flow, those values may accompany that first-party handoff for acquisition attribution. They are not sent to GA4 by this implementation. GA4 does not load before analytics consent, and you can withdraw consent at any time through Cookie preferences.

4) Purposes (why we process personal data)

We process personal data to:

  • create and manage technician accounts and permissions
  • dispatch and assign work orders
  • send operational communications and alerts (email and push notifications)
  • provide operational visibility, assigned route assist, arrival detection, and route history during service execution
  • produce service reports and proof-of-service for customers
  • provide optional AI-assisted drafting, troubleshooting support, and voice-to-text transcription for current log or service entries
  • manage subscriptions, licenses, invoices, payments, tenant provisioning, and support tickets for tenant accounts through Aibo web administration services
  • measure consented visits, acquisition source/medium, and approved conversion-intent events on the public website so we can improve its content and the onboarding handoff
  • support billing, warranty, and quality control
  • manage security, fraud prevention, and incident response
  • comply with legal and contractual obligations

5) Legal bases (Ecuador — high level)

Depending on the scenario and data subject, processing may be based on:

  • performance of a contract or service relationship,
  • compliance with legal obligations,
  • legitimate interest (with documented balancing, where applicable),
  • consent (for example, certain BYOD permission choices), when appropriate.

Public-website GA4 analytics are based on your consent. Rejecting or withdrawing analytics consent does not prevent access to the public website or Aibo Service.

Your Tenant Company (as Data Controller) defines the legal basis for the tenant’s work-order processing.

6) Recipients: who may access the data

Personal data may be accessed by:

  • authorized Tenant Company staff (supervisors, dispatchers, operations, billing) based on roles
  • the customer/end-customer, who may receive service reports including photos/signature
  • the Provider’s authorized personnel (support, security) on a need-to-know basis
  • service providers (e.g., cloud hosting, email delivery) under contractual safeguards

6.1 Key service providers (subprocessors)

Aibo uses the following key service providers to deliver the Service:

  • Amazon Web Services, Inc. (AWS) — cloud hosting (compute, database, storage), including AWS SES (email delivery), Amazon Location Service (AWS), Amazon Pinpoint (push messaging), Amazon Bedrock (AI assistance where enabled), and Amazon CloudWatch RUM (web performance/usage telemetry), plus related AWS monitoring/telemetry services. Primary region: us-east-1 (N. Virginia, United States).
  • Apple Inc. and/or Google LLC — platform push notification delivery services (Apple Push Notification service (APNs) for iOS and Firebase Cloud Messaging (FCM) for Android), depending on device OS.
  • Google LLC — Google Analytics 4 for the limited, consented public-website analytics described in section 3.9. Google acts as a service provider/processor for this purpose.
  • Authorized payment provider or app store shown at checkout or on the receipt — payment processing for subscription and billing transactions (for example, processing payments and returning payment confirmation/transaction references).

We do not currently use a third-party support ticketing system (such as Zendesk). If we introduce additional subprocessors, we will update this Privacy Policy.

No advertising / no sale of personal data: Aibo is a business and productivity service. We do not sell personal data and we do not use personal data for targeted advertising. Public-website GA4 is not linked to Google Ads, Google Signals and advertising personalization are disabled, and we do not intentionally "track" users across unrelated apps or websites for advertising purposes.

7) International transfers / cross-border processing

The Service is hosted on cloud infrastructure located in the United States:

  • Cloud provider: Amazon Web Services (AWS)

  • Region: us-east-1 (N. Virginia, United States)

  • Backups: No backups are stored outside us-east-1 (as of the effective date).

For Ecuador-based tenants, this involves cross-border processing/transfer of personal data. Appropriate safeguards should be implemented as required by applicable Ecuadorian data protection law and SPDP rules (for example, contractual measures with providers and security measures).

When you consent to public-website GA4 analytics, Google LLC may process the limited analytics data in the United States and other locations where Google operates, subject to the applicable Google contractual terms and transfer safeguards. This processing is separate from Aibo's AWS hosting and backup location described above.

8) Security measures (summary)

We implement reasonable organizational and technical measures, such as:

  • role-based access controls and least privilege
  • authentication and session controls
  • logging and monitoring for reliability and incident response
  • secure backups and access governance

Users must also protect their devices (screen lock, updates, no credential sharing).

9) Retention

We keep personal data only as long as necessary for the purposes described.

Recommended default retention (may be configured by Tenant policy):

  • Work orders, photos, signatures, materials, service activities: up to 5 years
  • GPS route history: up to 12 months
  • Security/diagnostic logs: up to 12 months
  • Support tickets and communications: up to 2 years
  • CloudWatch RUM telemetry (web portals): 30 days by default (unless configured to store copies in CloudWatch Logs with a different retention)
  • GA4 event-level and user-level data used in Explorations and funnel reports for the public website: 2 months; this control does not affect standard aggregated reports, and Google deletes covered user/event data monthly after the retention period
  • First-party GA4 cookies (_ga, _ga_<container-id>): up to 180 days, without rolling renewal
  • Analytics consent record: valid for up to 180 days; an older local-storage record is treated as expired and removed on the next page load; same-session campaign/click-attribution storage ends with the browser session
  • Billing and invoice records: as required by applicable accounting/tax obligations

When you withdraw analytics consent through Cookie preferences, the public website stops GA4 collection and clears accessible GA4 cookies on the next page load or interaction. Browser controls may also be used to remove site data.

10) Data subject rights (Ecuador)

Under Ecuador’s data protection framework, data subjects may have rights such as:

  • access,
  • rectification/update,
  • deletion,
  • opposition,
  • portability, and other applicable rights.

10.1 How to exercise rights

  • Requests about tenant work-order/service data should be sent to the Tenant Company (Data Controller). Use the tenant privacy contact provided in your onboarding materials, policy acknowledgement flow, or HR/Operations contact. If the app shows a tenant-specific privacy contact, you may use that contact.
  • Requests about platform-level data (for example, Aibo Admin provisioning records, support communications, subscription/billing administration, or platform security logs) can be sent to the Provider: legal@aibotask.com.

For tenant work-data or identifiable platform/account requests, include only what is reasonably necessary to verify identity and scope: full name, ID only where proportionate, request description, and a contact method.

You may also file complaints with the Ecuadorian data protection authority (SPDP) where applicable.

For public-website analytics, you may reject analytics initially or withdraw consent at any time through Cookie preferences, without affecting access to the website or Service.

Requests for access to or deletion of historical pseudonymous GA4 data can be sent to legal@aibotask.com. For a GA4-only request, provide only the approximate date range and the _ga client identifier if it is available in your browser's site data. Do not include your name, government ID, company/tenant, account details, or other sensitive information unless Aibo later explains why a proportionate verification step is necessary. GA4 data is not keyed to your name or email, so Aibo may be unable to match it without that pseudonymous identifier. Aibo will use available Google Analytics access or deletion controls where applicable, subject to validating the request's scope and legal or technical limits.

11) Children

The Service is not directed to children. Do not submit children’s personal data unless strictly necessary and legally permitted.

12) Changes to this Privacy Policy

We may update this Privacy Policy. We will post the updated version and update the effective date. If changes are material, we may provide notice within the Service.