Privacy policy

1Who we are

BoreIQ is job software for geotechnical and environmental drilling contractors: quotes, jobs, daily driller's reports, invoices and the QuickBooks sync. It is built and run by its founder. In this policy, "BoreIQ", "we" and "us" mean the operator of the service.

This policy covers boreiq.com and the BoreIQ app. Questions about it go to [email protected].

2What we collect

• Account details. Your name, email address and role in your company. Your password is stored only as a one-way hash, and two-factor sign-in keeps a secret for your authenticator app.
• Your company's records. Whatever you and your team put into BoreIQ: customers and contacts, prices, quotes, jobs, borings, daily reports, invoices and the documents you upload.
• Messages you send us. If you use the contact form or email us, we keep your name, email address, company and what you wrote, so we can reply.
• Basic request information. Our servers see your IP address, browser and the time of each request. We use it to keep the service secure and to limit abuse, such as repeated sign-in attempts.
• Sign-in and activity records. We keep a record of each sign-in to your account, including failed attempts, with the IP address and browser, and a record of each change to your company's records: who made it, when, and what changed. They're kept for as long as your company uses BoreIQ, so that you can always see who did what.
• Usage records. When you use the app, BoreIQ notes which part you used (quotes, daily reports, the field app and so on), when, and whether it worked: the kind of page, never which record or what you typed in it. We use these to see which features help and where people get stuck. Your company's admins can see who on their team used BoreIQ and when. They're kept in our own database, with no cookie of their own and no outside analytics service.

We don't buy data about you, and we don't collect more than the service needs.

3How we use it

We use your information to run BoreIQ for you: to sign you in, to show your company its records, to send the emails the service needs (such as invitations, password resets and the documents you choose to send), to answer your questions, and to keep the service secure.

We don't sell your information, we don't share it with advertisers, and we don't use your company's records for anything except providing BoreIQ to you.

4When BoreIQ looks at your records

A small number of BoreIQ staff can view any company's records, including its Activity log and sign-in records. Each of them must use two-factor sign-in. We use this access purely to manage the platform.

When we look, it's read-only: nothing in your records can be changed from our side.

We can also act on accounts when needed:

• lock an account, or sign someone out
• send a password reset
• reset two-factor sign-in, after checking it's really that person
• suspend a company, for example for non-payment. A suspended company's people can't sign in, but nothing is deleted.

Every record we open and every action we take is logged with who did it and when, and every action also records why. That log is kept apart from your company's Activity log, so you won't see our visits there.

5Cookies and tracking

BoreIQ sets one cookie: a session cookie that keeps you signed in. It's only set when you sign in, and it's removed when you sign out or the session ends.

There are no advertising trackers, no analytics cookies and no third-party marketing pixels on boreiq.com or in the app.

The app counts its own use: each page you open sends BoreIQ the kind of page it was, on the session you're already signed in with. That record stays in BoreIQ's own database and is never shared with an analytics or advertising company.

6Where your data is stored

Your company's records are stored in a PostgreSQL database on servers we run ourselves, not on a shared hosting platform. Each company's records are kept separate from every other company's.

Files, such as photos of signed field tickets, site photos and the PDFs BoreIQ emails, are stored with Cloudflare R2 in a private bucket. BoreIQ checks that you may see a file before it gives your browser a link to it, and that link stops working after a few minutes.

We take a backup of the database and the files every night and store it with Backblaze B2, so your records and their files can be recovered if a server fails.

7Services that help us run BoreIQ

A few outside services handle specific jobs. Each one gets only what it needs for that job.

• Cloudflare Email Service delivers the emails BoreIQ sends, so it handles the recipient's address and the message.
• Cloudflare Turnstile checks that a person, not a bot, is signing in or sending a form. To do that, Cloudflare looks at information about your browser and connection.
• Cloudflare R2 stores the files you upload and the PDFs BoreIQ sends.
• Backblaze B2 stores our nightly backups.
• Have I Been Pwned tells us whether a new password has appeared in a known data breach. Your password never leaves BoreIQ: we send only the first five characters of a hash of it, and the check happens on our side (a method called k-anonymity).
• QuickBooks Online (Intuit), if you connect it. BoreIQ then sends your customers and invoices to your QuickBooks company and reads back whether they've been paid. Intuit's own privacy policy covers what happens there.

AI drafting, from 2027

From 2027, BoreIQ may use the Claude API from Anthropic to read documents you upload, such as a request for proposal or a paper field ticket, and draft a quote or report from them. A person checks every draft before it goes anywhere. We'll tell you before this is turned on for your company. Anthropic's terms for this service don't allow it to train its models on your data.

8Your data belongs to you

Your company owns the records it puts into BoreIQ. You can export them as CSV whenever you like, without asking us.

You can ask us to see, correct or delete the personal information we hold about you. If your company closes its account, we delete its records from the live database, and they then age out of our backups. Email [email protected] for any of this.

If your company's administrator invited you, they manage your account, and some requests about your company's records may need to go through them.

9Security

Every account uses two-factor sign-in. Passwords found in known breaches are refused. Access is limited by role, so a crew lead's account never receives your prices or financials. No system is perfectly secure, but if something goes wrong that affects your data, we'll tell you promptly.

10Children

BoreIQ is a business tool for drilling companies. It isn't meant for children, and we don't knowingly collect information from anyone under 16.

11Changes to this policy

When this policy changes, we'll update it here and change the date at the top. If a change affects how we use your company's records, we'll email account administrators before it takes effect.

12Contact

Email [email protected], or use the contact form. A person reads every message.