What we collect, why, and who touches it.

Effective 30 July 2026.

Who we are

Locate Desk LLC ("Locate Desk", "we", "us") makes 811 locate ticket management software for underground utility contractors. This policy explains how we handle information across our website and our application. If you have a question about anything here, reach us at [email protected] or (815) 979-7327.

Two roles, so this is clear up front

For your own account (the name, email, and company you sign up with), Locate Desk decides how that information is used, so we are the controller of it.

For the working data you enter about your business (your customers, their contacts, job sites, 811 tickets, notes, and photos), you decide what goes in and why. There, Locate Desk is a service provider that processes that data on your behalf and under your instructions. You are responsible for having the right to provide the information you enter, and for what you do with it. We do not sell it and we do not use it for our own purposes beyond running the service for you.

What we collect

• Account information. Your name, email address, company name, phone number, and role, so we can create a login, show who did what, and reach you about the service.
• Your business data. The records you enter or import: your customers and their contact details, job sites and addresses, 811 ticket numbers and confirmation details, facility-owner responses, field notes, mark-verification records, and photos you attach.
• Forwarded 811 email. If you use the email intake, the confirmation emails you forward and their attachments are received and parsed into tickets. Mail that comes from a sender we do not recognize is held for review rather than turned into a record.
• Authentication data. Sign-in is handled by our authentication provider. Your password is stored by that provider as a salted hash. We never see, store, or have access to your plain-text password.
• Technical and usage data. Standard server logs such as IP address, browser and device type, and the pages or actions requested, kept for security, troubleshooting, and abuse prevention.
• Local storage. Small values kept in your browser for the app to work and to remember your preferences, such as your sign-in session, your theme, and whether the navigation is collapsed. These are not advertising cookies, and we do not run third-party ad or cross-site tracking.

How we use it

• To provide the service: run your board, compute dig readiness, manage tickets, jobs, and customers.
• To authenticate you and keep accounts and companies separated from one another.
• To send email you have turned on, such as the automatic morning status to your crews, and service messages such as invitations and important notices.
• To provide support and respond to your requests.
• To keep the service secure: detect and prevent abuse, fraud, and unauthorized access, and to keep audit records.
• To meet legal, tax, and accounting obligations.

We do not sell your information, and we do not share it for cross-context behavioral advertising.

Who processes it for us

We keep the list of providers short and use each for a specific job. They handle information only to provide their service to us, under their own terms and security commitments.

• Supabase hosts the database, authentication, and file storage.
• Cloudflare hosts this website and the application, provides content delivery and the access gate in front of the app, email routing for the intake, and bot protection on forms and sign-in.
• Resend delivers the transactional email we send, such as the morning status and invitations.
• Anthropic reads a forwarded 811 confirmation that our own parser could not, so intake keeps working on formats nobody has written a rule for. This is a fallback and not the normal path: a confirmation we can read never leaves our systems. When it does run, the email text is sent to Anthropic's API to be read verbatim, every field it returns is checked back against the original before anything reaches your board, and it is used under commercial terms that do not train models on your data.
• Stripe processes subscription payments and holds the billing details you give it. We never see or store your full card or bank account numbers.
• Mapbox performs address lookup, and only if you choose to enable it by adding a map key.

We may also disclose information if the law requires it, to enforce our agreements, or to protect the rights, safety, and property of Locate Desk, our customers, or the public. If we are ever part of a merger or acquisition, information may transfer as part of that transaction, and this policy will continue to apply to it.

Where it is stored

The service is operated in the United States and information is stored on servers in the United States. If you use the service from elsewhere, you understand your information is processed here.

How long we keep it

We keep your account and business data for as long as your account is active, and for a reasonable period afterward to meet legal, accounting, and dispute-resolution needs. Because this software exists to document work that can be cited in a damage claim years later, some records are retained longer for that purpose. Encrypted backups are kept on a rolling basis and then age out. When you close your account, you can ask us to delete your data, subject to the limited retention above.

How we protect it

Traffic is encrypted in transit with TLS, and data is encrypted at rest by our hosting provider. Each company's records are isolated at the database level so one account cannot read another's. The application sits behind an access gate, passwords are stored only as salted hashes by our authentication provider, and administrative keys are held server-side and never shipped to the browser. No system is perfectly secure, but we take reasonable measures appropriate to the sensitivity of the data.

If something goes wrong

If we determine that a breach has affected your account or your business data, we will notify you without undue delay and in any case within 72 hours of confirming it. The notice will tell you what we know: what happened, what data was involved, what we have done about it, and what we recommend you do. Where the law requires notice to a regulator or to individuals, we will make it and will help you meet any obligation of your own.

Because you decide what goes into your account, you are the one who must notify your own customers if their information is affected. We will give you what you need to do that.

For business customers

If your own contracts or insurers require a data processing agreement, ask us at [email protected] and we will put one in place. It restates what this policy already says — that your business data is yours, that we process it only to run the service for you, and that we do not sell it — in the form your procurement team expects.

Your choices and rights

You can view and correct most of your information inside the application. To ask for a copy of your data, to correct it, or to have it deleted, email [email protected] from the address on your account and we will verify the request and respond.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act and similar state laws: to know what we collect, to access or delete it, to correct it, and to not be discriminated against for exercising those rights. To exercise a right, contact us at the address above.

How we handle a request. We will confirm we received it, verify that it comes from you or from someone you have authorized in writing to act for you, and respond within 45 days. If a request is genuinely complicated we may take one further 45 days, and we will tell you before the first period runs out and say why. There is no charge for this.

If we say no, you can appeal. Reply to our decision within 60 days and ask us to reconsider. A different person reviews it, and we will write back within 45 days with the outcome and the reasoning. If we still decline, we will tell you how to complain to your state attorney general.

Things we do not do, so there is nothing to opt out of:

• We do not sell personal information, for money or anything else of value.
• We do not share it for cross-context behavioral advertising, and we run no ad or cross-site tracking.
• We do not collect sensitive categories of personal data — health, biometrics, precise geolocation of a person, racial or ethnic origin, religion, immigration status, sexual orientation, or genetic data.
• We do not make automated decisions that produce legal or similarly significant effects about a person. The software's dig-readiness conclusion is about a ticket, not about anyone's rights, and a person on site decides whether to break ground.
• We do not use your business data to train artificial intelligence models, and neither do the providers we send it to.

Email you can turn off. Service messages — invitations, security notices, billing — come with the account and cannot be switched off while it is open. Everything else, including the automatic morning status, is yours to turn on and off in the application. If we ever send marketing email, every message will carry a working unsubscribe link.

If the request concerns data your contractor entered about you (for example, you are a customer of one of our contractors), we will refer you to that contractor, who controls that information, and assist them as their service provider.

Children

This is business software and is not directed to children. We do not knowingly collect information from anyone under 16. If you believe a child has provided information, contact us and we will remove it.

Changes to this policy

We may update this policy as the service changes. When we do, we will revise the date at the top, and for material changes we will give notice through the service or by email. Continuing to use Locate Desk after an update means the updated policy applies.

Contact

Locate Desk LLC
Email: [email protected]
Phone: (815) 979-7327