Privacy notice
Job Frame is operated by Elijah Rosado, an individual doing business as Job Frame. This notice describes how the service handles information. Updated September 11, 2026.
Information the app stores
Job Frame stores your Google account identifier, name, and email; business settings; employee invitations and memberships; customer contacts; quotes and invoices; job schedules and notes; payment records entered by you; and email delivery history. Signed-in sessions use secure cookies.
Google connections
Google sign-in shares your basic profile and email. Connecting Gmail is optional and allows sending a reviewed document email from your account. The app does not request permission to read your mailbox. Connecting Google Sheets is optional and grants access to files used by this app so you can manually export or update your business workbook.
Connection tokens are stored encrypted on the server. You can disconnect through the app or revoke access in your Google account settings. Previously sent emails and exported Google files remain in their destinations.
How information is used and shared
Information is used to operate your workspace and the features you choose. Owners manage business records. Employees see the customer details and notes on jobs assigned to them. Email recipients receive only the message and PDF you review and send. Google receives data when you use its connected features. Stripe processes subscription checkout and payment-method management; Job Frame does not store full card numbers.
The application is hosted through OpenAI Sites and its hosting infrastructure. Job Frame does not include advertising trackers or sell customer lists. Google user data is used for the user-facing features described here, not for advertising or training generalized AI models.
Google user data and Limited Use
Job Frame's use of information received from Google APIs adheres to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements.
Job Frame does not use, transfer, or sell Google user data, including raw, aggregated, or derived data, to create, train, or improve foundational or generalized artificial intelligence or machine learning models. The current Gmail and Google Sheets integrations do not send Google user data to AI or machine learning model APIs. Google data is used only to provide the connected features described in this notice, not for advertising.
How we protect sensitive data
- Encryption in transit: the public website uses HTTPS, and server connections to Google and Stripe use HTTPS to protect data in transit.
- Google connection credentials: stored Google OAuth refresh tokens are encrypted with AES-256-GCM and cryptographically bound to the corresponding account. The encryption key and OAuth client secret are supplied through server-side runtime configuration and are not included in browser code.
- Session protection: production session cookies use Secure, HttpOnly, and SameSite=Lax settings. The database stores a SHA-256 hash of each session token rather than the usable token, and sessions expire.
- Access controls: server-side authentication and business ownership checks restrict access to records. Employee access is limited to permitted team features and assigned jobs. State-changing requests are checked against the application origin.
- Google authorization: sign-in validates Google identity tokens and uses OAuth state, nonce, and PKCE checks. Gmail sending and Google Sheets connections require the relevant user authorization. Job Frame does not collect Google passwords or request mailbox-reading permission.
- Connection controls: users can disconnect Google integrations in the app or revoke access through their Google account. Data deletion requests are verified before processing.
These safeguards help reduce unauthorized access, alteration, and disclosure. No service can guarantee absolute security. Contact us at the address below if you suspect unauthorized access to your Job Frame account.
Your records and choices
Owners can export records and download a business backup. After your trial or paid subscription access ends, export your business records within 90 days. We will email advance notice before deleting those records. Support handles deletion, which may take additional processing time. Contact support from your account email for access, correction, earlier deletion, or recovery requests. We verify requests before acting. Limited billing, security, dispute, and legally required records may be retained separately, and provider backups may expire on separate schedules. Deletion in Job Frame does not delete emails or files already saved outside the service.