Privacy, in plain English.

01Who we are and what this policy covers

Restomo is job management software for property restoration companies, operated by Brady Schwartz, doing business as Restomo, of Chicago, Illinois ("Restomo", "we" or "us"). This policy covers restomo.com, the web app at app.restomo.com, the Restomo iPhone app, Romo (the assistant inside Restomo), and the pages Restomo shows to people who receive a signing link, an upload link or a shared report from a restoration company. It takes effect on October 7, 2026.

We play two roles. For the website, for people who apply to sign up, and for account and billing details, we decide how information is used. For the information a restoration company puts into Restomo about its jobs, its customers and its crew ("Customer Data"), we process it on that company's behalf, and the company decides how it is used. If you are a homeowner, an adjuster or a crew member, the company you work with or for is responsible for your information in Restomo, and we help it answer your requests.

02On the website

If you fill in a form on restomo.com, we receive your name, company, work email, phone number if you give one, city, crew size and the software you use today, along with the page you sent it from and the time. It is stored privately in our Amazon Web Services account and emailed to us, and we use it only to reply to you and to follow up about Restomo. We do not keep your IP address or browser details with it; the IP address is used only for a moment to stop abuse of the form.

The website sets no cookies, stores nothing in your browser, and runs no analytics, advertising or tracking scripts. Its fonts are served from restomo.com itself, and it is hosted on Amazon Web Services.

03When a company signs up

When someone applies to sign up a company, we receive the company's name, city and state, the kinds of jobs it does, its franchise brand if it has one, the contact person's name, email, phone number and role, the crew size, the number of locations and the software it uses today.

Payment is taken by Stripe on Stripe's own secure page. Stripe receives the email address, the billing address and the card, and Restomo never receives the full card number. We keep the Stripe customer and subscription references, the trial end date, the last four digits of the card and the dates the company has paid through.

04What Restomo holds for a company

A restoration company and its people put the following information into Restomo, and all of it is Customer Data.

• For each person who signs in, Restomo holds their name, email address, phone number, photo, access level, company and settings. Passwords are held by Amazon Cognito, Amazon's sign-in service, and Restomo never stores them in readable form. When someone sets a new password, the first five characters of a scrambled form of it are checked against Have I Been Pwned's list of breached passwords, and the password itself is never sent.
• For each job, Restomo holds what the company enters: the customer's name, phone number, email address and property address, notes, dates, stages and dollar amounts, the names of referrers, inspectors and estimators, payments and job costs, tasks and calendar visits, moisture readings, equipment and contents inventories.
• For insurance work, Restomo holds the carrier, the claim and policy numbers, the adjuster's name, phone number and email address, the broker or agent, the date and type of loss, and the deductible and depreciation figures.
• Photos and videos taken in Restomo or attached from a phone's library are kept with the job or chat they belong to. A photo taken with Restomo's camera can carry a stamp with the date, the time, the job and, when location is allowed, where it was taken. A photo attached from a phone's library keeps whatever information the phone stored in it, which can include where it was taken.
• A room scan is a video walk of a room recorded with the phone's camera, with the phone's motion sensors read during the walk. It is processed inside Restomo's own Amazon Web Services account to make a floor plan.
• Restomo holds each job's documents, such as estimates, reports, contracts and signed files. When someone signs through a Restomo signing link, Restomo records their typed name, their drawn signature, the time, their IP address, their browser details, the consent wording they agreed to and a fingerprint of the signed file, so the signature can be proven later. Signing links and upload links stop working after 30 days.
• Team chat holds messages, photos, videos, files and audio, reactions and who has read what. Deleting a message hides it, but the message stays in the company's records. Each phone and browser keeps the newest messages and small copies of photos so chat opens quickly, and clears them when the person signs out.
• The time clock holds when each person clocks in and out, lunch breaks, notes and the job, along with the location described in the next section.
• Restomo holds the questions people ask Romo, its answers, the notes a company or a person teaches it, the facts it saves from team chat, the promises it follows up on, and what each answer and each reading of the chat cost against the company's allowance.
• To send notifications, Restomo holds each browser's push subscription and browser details, and each iPhone's notification token, app version and device type. If the iPhone app crashes or freezes, it sends Restomo a report about the failure, which does not carry job records.
• The web app records each tap on a button or link, with the screen, the button's label, the person, their access level and the time. It never records what anyone types.
• Restomo keeps a permanent record of important actions, with who did them and their email address. It also records failed sign-in attempts, with the name that was typed and the IP address they came from, to protect accounts.

05Location, and only for work

Restomo uses location for the time card and for reminders to clock in when someone arrives at a job site. It keeps three kinds of location and nothing else.

• If a person's phone allows location, Restomo records where they are when they clock in and when they clock out, on that time card entry.
• While a person is clocked in and location is allowed for Restomo, Restomo records where their phone is. With Restomo open on the screen, that is about once a minute or every 50 meters. With the iPhone app closed, it is a new position each time the phone moves about 500 meters.
• If arrival reminders are on for a person, Restomo records when they arrive at and leave a job site they are scheduled at. These are kept only between 5 a.m. and 9 p.m. on days they have visits, and only the job site and the time are kept, never the position.

Restomo never records where anyone goes when they are off the clock and away from a job site. For arrival reminders, the iPhone compares its own position with the job sites the person is scheduled at and sends only the site and the time.

Arrival reminders are off until the company's Owner turns them on and confirms that every employee was given the notice, and they stay off for each person until that person agrees on the notice screen in the app. Anyone can turn them off at any time in Settings, and clocking in works the same with location turned off.

A person can see their own location records, and so can the people at their company whose access level lets them see hours and locations. Other crew members cannot.

Arrivals, departures and positions while clocked in are deleted after 13 months. Clock-in and clock-out points stay on the time card for as long as the company keeps time cards, and lose their location if the person deletes their account.

When someone taps On my way, Restomo uses the phone's position once to work out the drive time with Amazon Location Service and does not store it. Job addresses are turned into map points, and maps are drawn, by Amazon Location Service.

06Voice and dictation

When you dictate into a form in the web app, your browser's built-in speech recognition turns your speech into words. Depending on your browser, that can be done by the company that makes it, such as Google, Microsoft or Apple, under that company's terms. Restomo receives only the words.

When you talk to Romo in the iPhone app, the iPhone turns your speech into words on the phone itself, and the audio never leaves the phone. When you talk to Romo on the website, your browser sends the audio to Amazon Transcribe, a service in Restomo's own Amazon Web Services account, which turns it into words. Restomo keeps the words, not the audio.

Audio files that people attach to chat or a note are kept with that chat or note. Restomo does not use face recognition, and it does not create voiceprints or any other biometric identifier from photos, video or audio.

07Romo and AI

To answer a question or do something a person asks, Romo sends the question, the company records it needs and, when asked about one, a photo, to an AI model. Romo reads only what the asking person's access level lets them see, and anything it prepares for someone outside the company waits until a person has read it and chosen to send it.

Romo also reads the company's team chat as messages are sent, including private channels and two-person chats, unless the Owner switches this off or the chat has muted Romo. It sends the new messages and, when it needs one, a photo to an AI model in the same way, and it reads each chat as a member of that chat would. From what it reads, Romo suggests the job a photo belongs to, offers to do the work a chat asks for, answers and posts in the chat under the name Romo, saves facts about the company's work, and asks people about what they said they would do. A fact Romo learns in a private channel or a two-person chat is shown only to the people in that chat, and what Romo learns in one company is never used for another company. Every fact Romo saves is listed on Romo's brain map in Restomo, where it can be forgotten, and anyone in a channel can mute Romo there.

The models are Claude, made by Anthropic; GLM, made by Z.ai; and Nova, made by Amazon. Romo reaches them only through Amazon Bedrock, inside Restomo's own Amazon Web Services account, in Amazon's Ohio, Virginia and Oregon regions in the United States. Amazon Bedrock does not share what Romo sends with the companies that made the models, and none of it is used to train a model. Restomo does not use Customer Data to train AI models, and does not use a company's records to test or develop Restomo without that company's permission.

Romo can also search the public web for general facts, such as a drying standard or a building code. Those searches go to DuckDuckGo, and Romo can open the public web pages it finds. Romo refuses to search for anything that carries a name, an address, a phone number or a claim number from your company's records, and an admin can turn web search off in Settings.

A person can also connect other apps they use, such as Gmail, Google Calendar, Slack or HubSpot, to Romo through Composio, a connection service. Composio holds that person's sign-in for each app they connect. When the person asks, Romo looks things up in a connected app, and it changes something in that app only after the person taps to confirm. Composio receives an identifier for the person, the words Romo uses to find the right action, what each action asks for and what the app sends back. Nothing is connected unless a person chooses to connect it, and they can disconnect an app at any time.

08Google Calendar and Gmail

Restomo connects to Google only for a person who chooses to connect their own Google account, and only for these features. A person can also connect Gmail or Google Calendar to Romo through Composio, as described in "Romo and AI"; that connection uses Composio's own sign-in, under Composio's terms.

• With Google Calendar, Restomo reads the names of the person's calendars and the title, description, start and end of the events in the calendar they choose, copies those events into their Restomo schedule, and writes their Restomo visits, with titles, times and addresses, into that calendar.
• With Gmail, Restomo writes drafts into the person's own Drafts folder and sends the emails they choose to send from their own address, such as insurance packets, review requests and emails Romo drafted for them. Restomo does not read the messages in their mailbox.

Restomo keeps the credential Google issues for the connection encrypted, where no browser can read it. Calendar events copied into Restomo become part of the company's schedule, which the person and the people their company allows can see, and Romo can read them when someone with access asks about the schedule.

Nobody at Restomo reads your Google data unless you ask us to, it is needed for security, or the law requires it. We never sell Google data, never use it for advertising, never use it to train AI models, and never transfer it to anyone except to provide these features, for security, as the law requires, or as part of a merger or sale of Restomo with notice to you.

You can remove Restomo's access at any time at myaccount.google.com/permissions, and deleting your Restomo account also deletes the connection.

Restomo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

09How we use information

We use information to provide and support Restomo, to run the features a company or a person turns on, to take payment, to keep Restomo and its users secure, to find and fix problems, to understand which parts of Restomo are used so we can improve it, to reply when someone contacts us, and to meet our legal duties.

We do not sell personal information, we do not share it for cross-context behavioral advertising, we do not use Customer Data for advertising, and we do not disclose personal information to third parties for their own direct marketing.

10Who receives information

People at a company see the records their access level allows, and nothing from any other company. People a company sends something to, such as a signing link or a shared report, see what was sent. Texts that Restomo prepares for a customer, such as On my way, a signing link or a review request, are sent from the worker's own phone and messaging app, through their own carrier.

A small number of Restomo administrators, who are Restomo's owners and the people who build it, can open a company's account to support it, keep Restomo secure and working, or meet the law, and each is bound to keep it confidential. One of Restomo's owners also owns a restoration company that uses Restomo, and nobody at Restomo uses what they see in one company's account for the benefit of another.

These service providers handle information for us, each only for its own job.

• Amazon Web Services runs Restomo: the servers, the database, file storage, sign-in (Amazon Cognito), email (Amazon SES), iPhone notifications (Amazon SNS), room scan processing, maps, addresses and drive times (Amazon Location Service), speech to text for Romo on the website (Amazon Transcribe), Romo's AI models (Amazon Bedrock) and the website.
• Stripe takes payment for subscriptions.
• Apple delivers notifications to iPhones and to Safari. Google delivers browser notifications to Chrome and Android, and Mozilla delivers them to Firefox, encrypted so that Google and Mozilla cannot read them.
• Google provides Calendar and Gmail to the people who connect them.
• Photon, an address search service run by komoot, suggests addresses as someone types a customer's address. It receives the typed part of the address and the company's map area, and it may process them outside the United States.
• Composio connects the apps a person chooses to connect to Romo. It holds that person's sign-in for each app and passes Romo's requests to the app and the app's answers back.
• DuckDuckGo receives the words of Romo's web searches, which never include a name, address, phone number or claim number from a company's records.
• Sentry receives error reports from the web app when error reporting is switched on, set so that it is not sent personal details.

The full list, with what each one does, is at restomo.com/subprocessors.

We also disclose information when the law requires it, telling the people concerned where we are allowed to; to protect the rights, property or safety of our users, the public or Restomo; with a person's permission; and to a buyer or successor if Restomo is merged or sold, who must then follow this policy.

11Text message alerts

Text alerts are optional. They stay off unless a person switches them on for their own number in Settings, Text and email alerts. A person's number and their consent are used only to send the alerts they chose, every opt-in and opt-out is logged, and anyone can switch texts off again in the same place.

Mobile numbers and the fact that you agreed to receive texts are never shared with or sold to third parties or affiliates for marketing.

12The iPhone app

The Restomo iPhone app uses the same account as the web app and keeps your session in the iPhone's Keychain. It asks for location only when you tap something that needs it, and every phone permission it uses is optional: location for the time card and arrival reminders, the camera and photo library for job photos, the microphone and speech recognition for talking to Romo, and notifications. The app contains no advertising, analytics or tracking code from other companies.

13Where information is stored

Restomo stores its data in the United States, in Amazon Web Services, mainly in Amazon's Ohio region. The service providers listed above handle what they receive in their own systems, and Photon may do so outside the United States. Phones and browsers keep the session and recent chat on the device.

Restomo is offered to businesses in the United States. If you use it from somewhere else, your information is processed in the United States.

14How long we keep information

• A company's records, including jobs, customers, documents, photos, scans, notes, chat, time cards and Romo conversations, are kept while the company uses Restomo. Restomo archives records rather than deleting them, so an archived job can be brought back.
• After a company's subscription ends, we keep its data so it can come back or take a full copy. The Owner can ask us to delete it at any time, and we then delete it within 30 days. If a company has had no active subscription for 12 months, we may delete its data after emailing the Owner at least 30 days ahead.
• When an Owner deletes the company in the app, its data is removed 30 days later.
• Arrivals, departures and positions while clocked in are deleted automatically after 13 months.
• The record of important actions and failed sign-ins, and the log of text message consents, are kept permanently, because they are the record of who did what and who agreed to what.
• Earlier versions of replaced or deleted files are kept for 90 days. Database backups are kept for 7 days, and the archive copies we take before major maintenance are kept for 400 days. Backups are used only to recover Restomo.
• Server logs are overwritten as they fill up, and the room scan service's logs are deleted after 30 days.
• What you send through the website, sign-up applications and emails to us are kept as long as we need them to follow up with you, and we delete them when you ask.
• Billing records are kept for as long as tax and accounting law requires.

15Deleting an account

Anyone can delete their own account inside Restomo. In the iPhone app, open Settings and choose Delete my account. In the web app, open Settings, Your account, Delete account. Either way, you type DELETE to confirm, and it cannot be undone.

Deleting an account signs the person out everywhere and ends their sign-in. Their name becomes Former team member, their email address, phone number and photo are removed from their profile, and their location history, phone and browser registrations, notification settings, Google connection, chat memberships and the audio files they attached are deleted.

Some records stay with the company because they are its business records: the jobs they worked on, their time cards (with their first name and last initial and no locations), the chat messages they wrote, the questions they asked Romo, and the permanent record of important actions and the text consent log, which keep the details recorded at the time, including the email address.

An Owner can delete the whole company in the same place. That cancels the subscription, signs everyone out and removes all of the company's data 30 days later, and until then the Owner can write to support@restomo.com to bring it back. If you cannot sign in, restomo.com/delete-account explains how to ask us by email.

16Security

Every record carries its company's identifier, and the database itself keeps each company's data separate. Data is encrypted in transit and at rest, files are shared through links that expire after 10 minutes by default, passwords are held by Amazon Cognito, and sign-in attempts are limited. The full list is at restomo.com/security. No system is perfectly secure, and we do not claim certifications we do not hold.

If a breach affects personal information, we tell the companies affected without undue delay, and we notify people and authorities as the law requires.

17Your privacy rights

Wherever you live in the United States, you can ask us what personal information we hold about you, ask for a copy of it, ask us to correct it, and ask us to delete it. We do not sell personal information or share it for advertising, so there is nothing to opt out of, and if we ever did, we would honor a Global Privacy Control signal as an opt-out. Browser Do Not Track signals have no common standard, so we do not respond to them, and because the website does not track you, there is nothing for them to switch off.

To make a request, write to privacy@restomo.com. We confirm it within 10 business days and answer within 45 days. If we need more time, we tell you why and take up to 45 more days. We check who you are by matching what we already hold, usually your account email and one more detail. Someone acting for you needs your signed permission, and we may ask you to confirm your identity directly.

If we decline your request, you can appeal by replying to our answer. We respond within 45 days, and if you still disagree, we tell you how to contact your state attorney general. We never deny service, charge a different price or give worse service because someone used a privacy right.

If your request is about Customer Data, such as a homeowner's details held by a restoration company, we pass it to that company and help it answer, because the company decides what happens to that data.

18Sensitive information

Restomo handles two kinds of information that privacy laws call sensitive: precise location, as described in "Location, and only for work", and the credentials people use to sign in. We use them only to provide the service people asked for and to keep it secure, so there is no further use to limit.

19California privacy disclosures

In the categories California law uses, in the past 12 months we have collected identifiers, customer records, commercial information, internet or network activity, geolocation, audio, electronic and visual information, professional or employment information, and sensitive personal information (precise location and account credentials). We collect them from the sources, use them for the purposes and disclose them only to the recipients described in this policy, and we have not sold or shared any of them. We do not disclose personal information to third parties for their own direct marketing.

20Crew members and office staff

If you use Restomo through your employer, your company decides what is recorded and who sees it, within the access levels it sets. That can include your time cards, your location as described above, the work and photos you log, and your use of Romo. Questions about your information go to your employer first, and we help it answer.

21Children

Restomo is a work tool for adults. Accounts are for people 18 and older, and we do not knowingly collect information from children. A job photo may show a child by chance. Companies should avoid that, and if you write to privacy@restomo.com, we work with the company to remove such a photo.

22Changes to this policy

When this policy changes, we update the date at the top of this page. For a change that matters, we email the Owner of every company before it takes effect, and we never apply a material change to information we already hold without the consent the law requires. Earlier versions are available on request, and we review this policy at least once a year.

23Contact

Restomo is operated by Brady Schwartz, doing business as Restomo, in Chicago, Illinois. For privacy questions and requests, write to privacy@restomo.com. For help with Restomo, write to support@restomo.com, and to report a security problem, write to security@restomo.com.