Privacy Notice

This Privacy Notice applies to Expected’s websites, provider and technician workspaces, secure customer visit pages, and related authentication and transactional messaging. A service company may have its own privacy notice for the services it performs. That company controls the customer and visit information it enters into Expected and remains responsible for its own collection and use of that information.

Account and company information. We process names, work contact details, organization details, roles, login events, preferences, and company branding supplied by provider owners, administrators, dispatchers, and technicians.

Optional company directory information. A company can ask to appear in Expected’s public directory and provide a public category and summary. We may also record the scope, date, expiration, reviewer, operator attestation, and operator-recorded outcome of a manual review covering business identity, applicable license and insurance records, technician identity, and technician background-check status. The outcome meets_current_listing_requirements means the listed checks met Expected’s then-current listing requirements at that dated review. The directory feature does not accept or publish raw identity documents, license or insurance files, or background reports.

Visit information. We process customer contact details, service and scheduling information, property information, assigned-technician details, visit status, messages, checklist results, work notes, photos, support requests, consent records, and payment status. Restricted property-access instructions are encrypted and are available only through authorized workflows.

Customer access information. A customer can open a high-entropy visit link without creating an account. Sensitive actions require a short-lived phone verification session. We record link, verification, and security events needed to operate and protect that access.

Payment and communications information. Stripe processes card and payout details; Expected receives transaction identifiers, amounts, status, receipts, refunds, and dispute information. Twilio processes transactional SMS delivery and phone verification. We record delivery status and opt-in or opt-out evidence.

Technical information. We may process device and browser data, approximate network information, diagnostics, security events, and privacy-filtered product analytics. We configure monitoring to exclude secure-link tokens, message contents, contact details, addresses, payment secrets, and other sensitive form contents.

We use information to create and administer workspaces; schedule, assign, communicate, and document visits; show customers who is assigned and what is happening; support payments, receipts, tips, and refunds; send authentication and transactional messages; respond to support requests; prevent abuse; maintain audit history; troubleshoot the service; and comply with legal obligations.

We also use company directory information to process optional listing requests and record a manual, point-in-time review. A “Safety checks reviewed” status means only that an Expected operator recorded that the listed checks met Expected’s current listing requirements on the displayed review date for the company and technician roster then on file. It is not an automated judgment, certification, clearance, endorsement, or guarantee of conduct, workmanship, or safety. A roster change or expired review removes that public status until a new review is completed.

Visit information is shared among the service company, its authorized team members, the assigned technician, and the customer according to their role and the current visit. A customer’s public link returns a limited visit view; messages, work evidence, payment, receipts, and support actions require additional phone verification.

For a company that opts into the public directory and completes review, we may display only its public profile fields, service area, review status, review scope, and review date or validity period. We do not make raw review documents or background reports public. A company can withdraw its directory request without losing access to its workspace.

We use service providers to operate Expected, including infrastructure, database and authentication, messaging, payment, error-monitoring, and privacy-filtered analytics providers. They process information for us under their own contractual and security obligations. We may also disclose information when required by law, to protect people or the service, or as part of a business transaction subject to appropriate protections.

We do not sell personal information or use it for cross-context behavioral advertising. Mobile phone information, SMS consent records, and opt-in data are not shared with third parties or affiliates for their marketing or promotional purposes. We may share them with messaging vendors solely to deliver and operate the requested communications.

Service companies must record the customer’s voluntary agreement before sending visit-related text messages. In the default program, standardized transactional messages identify Expected and the applicable service company; free-form provider and technician messages remain inside the secure visit page. Reply STOP to stop Expected-branded text messages, START to remove the carrier-level block where supported, or HELP for help. START does not restore consent for every service company: each company must record fresh consent before its messages resume. An organization using its own separately registered sender has a sender-specific opt-out list. Opting out of SMS does not cancel a service appointment, so contact the service company directly about scheduling or service changes.

We retain information for as long as needed to provide the service, preserve required visit, payment, and review records, resolve disputes, enforce agreements, and meet legal obligations. Retention periods can vary by data type and by the service company’s instructions. Expected uses access controls, row-level authorization, private storage, encryption for restricted access notes, high-entropy revocable links, short-lived verification sessions, signed webhooks, and audit records. No security measure can guarantee absolute protection.

Provider and technician users can ask their organization administrator to correct workspace information. Customers should contact the service company shown on their visit page to correct visit or customer information, request access, or ask about deletion. You may also contact Expected at privacy@expected.link. We may need to verify a request and may retain information where permitted or required by law.

Expected is a business service and is not directed to children under 13. The service is operated from the United States, and information may be processed where our service providers operate. We may update this notice as the product or law changes. We will post the revised date and provide additional notice when legally required.