Privacy Policy

Scope

This Privacy Policy applies to mavtrek.com, the Mavtrek hosted work and asset management service, and Mavtrek support resources operated by Thinking Hats Technologies, LLC (“Thinking Hats,” “we,” “us,” or “our”). Mavtrek is a business application for local governments, municipalities, utilities, and their authorized personnel. It is not a consumer-facing service.

A customer organization decides who may use its Mavtrek account and controls the operational and GIS data submitted to the service. We process that customer-controlled information to provide Mavtrek and as described in the applicable customer agreement. If a signed master services agreement, order form, statement of work, or other customer agreement addresses privacy or data handling, that agreement controls for the customer relationship.

Information We Collect

Website visitors and people who contact us

When you visit our website, Google Analytics collects information about how the site is used, such as pages viewed, approximate location derived from an IP address, browser and device information, referring pages, and interaction events. If you submit a HubSpot contact form, contact us, or ask for support, we receive the information you provide, such as your name, organization, email address, telephone number, and message.

Customer administrators and authorized users

Customers and authorized users may provide account and profile information such as name, username, work email address, work or mobile telephone number, organization, role, profile image, and account preferences. Mavtrek also records authentication and security information such as login history, IP address, browser or user-agent information, session and device identifiers, and account activity.

Google Sign-In data

When an authorized user chooses Google Sign-In, Mavtrek requests only the Google email and profile scopes. Google may provide a unique account identifier, email address, name, and profile image. We use this information only to identify the user, link the Google identity to an existing Mavtrek account, and authenticate future sign-ins. Google Sign-In does not give Mavtrek access to Gmail, Google Drive, Google Calendar, contacts, or other Google services.

Mavtrek stores the returned Google identity record, token expiration information, an access token, and, when Google provides one, a refresh token. The refresh token allows Mavtrek to refresh the authentication connection without asking the user to sign in again each time. Tokens and Google profile information are not used for advertising. When a Google identity record is deleted, Mavtrek attempts to revoke the associated Google tokens.

We share Google identity data only with Google as needed to operate Google Sign-In, with service providers that host or protect Mavtrek, with the applicable customer organization as necessary to administer its users, or when legally required. We do not sell Google user data.

Customer content and operational data

Customers and their authorized users may submit or create operational and GIS information in Mavtrek. Depending on a customer’s configuration, this may include assets and locations, maps and spatial features, work requests, work orders, tasks, inspections, forms, notes, attachments, photographs, labor and resource records, notifications, and related business records. This information is customer-controlled content and may include personal information selected by the customer.

How We Use Information

We use information to:

• provide, configure, secure, maintain, and support Mavtrek;
• authenticate users and administer customer accounts;
• process customer-controlled work, asset, GIS, notification, and reporting functions;
• respond to inquiries, demonstrations, and support requests;
• send service-related email and SMS notifications selected by customers or users;
• monitor reliability, diagnose errors, prevent misuse, and protect the service; and
• understand website use and improve our website and service.

We do not use personal information for cross-context behavioral advertising.

Cookies and Analytics

The public website uses Google Analytics cookies or similar identifiers to measure site activity. Pages containing our HubSpot contact form may also use HubSpot technologies needed to operate and measure the form. Mavtrek uses essential session, authentication, and device cookies to keep authorized users signed in and protect their accounts. These application cookies are required for the service to function.

We do not use advertising cookies on the Mavtrek website or application. You can restrict nonessential cookies through your browser settings. Blocking essential application cookies will prevent sign-in or other authenticated features from working.

Service Providers and Third-Party Services

We use service providers to operate Mavtrek. They receive information only as needed to provide their services or as directed by a customer. Current providers include:

• Amazon Web Services GovCloud (US) for primary application hosting, databases, file storage, backups, logging, and infrastructure;
• Google for Google Sign-In and Google Analytics;
• HubSpot for website contact forms;
• Mailgun for application email;
• Twilio for SMS notifications;
• Honeybadger for application error monitoring; and
• Esri and customer-selected ArcGIS services for optional mapping, GIS, and identity integrations.

Customers may configure Mavtrek to exchange information with other systems they select. Those customer-directed integrations are governed by the customer’s arrangements with the applicable provider.

When We Disclose Information

We may disclose information to the customer organization that controls the relevant account; to the providers described above; when a customer directs an integration or disclosure; to comply with law, legal process, or a valid government request; to protect users, customers, Thinking Hats, or the public; or as part of a merger, acquisition, financing, or sale of business assets subject to appropriate protections.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

Retention, Deletion, and Backups

We generally retain website inquiries, support communications, application logs, and monitoring information for 30 days unless a longer period is required to address an active request, protect the service, comply with law, or establish or defend legal claims.

Customer account information and customer content are retained while needed to provide the service. Following termination or an approved deletion request, we delete applicable customer content from active systems within 30 days, subject to the signed customer agreement, legal requirements, and records that the customer must retain. Production backups are created daily and retained for up to 30 days. Deleted information may remain in protected backups until those backups expire through the normal retention cycle.

Google identity information is retained while the identity remains linked to an authorized Mavtrek user and is removed within 30 days after the identity is unlinked or the applicable account is terminated, subject to the same legal and backup limitations.

Google Analytics retains user-level and event-level data according to the retention setting available in Google Analytics, and aggregated reports may remain available longer. This provider-controlled Analytics retention is separate from the 30-day retention practices described above.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, or alteration. Mavtrek’s primary customer-data infrastructure is hosted in AWS GovCloud (US). No security program can guarantee that every incident will be prevented.

Privacy Rights and Requests

You may ask to access, correct, delete, or obtain a copy of personal information that we control. Email privacy@mavtrek.com. We may need to verify your identity and the organization associated with your request.

For personal information contained in customer-controlled content, the customer organization is generally responsible for deciding how to respond. We may refer your request to that organization and assist it as required by the customer agreement. Customer administrators can also correct or disable many user-account details directly.

Children

Mavtrek is a business service for organizations and their authorized personnel. It is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13. If you believe a child has provided information to us, contact privacy@mavtrek.com.

Processing Location

Mavtrek is currently offered to customer organizations in North Carolina, and its primary customer-data infrastructure is hosted in AWS GovCloud (US). Providers used for website analytics, contact forms, identity, communications, and monitoring operate their own infrastructure and may process limited information from locations described in their own privacy documentation.

Changes to This Policy

We may update this policy when our service or data practices change. We will post the revised policy on this page and update the “Last updated” date. If a change materially affects customer-controlled information, we will provide any additional notice required by the applicable customer agreement or law.

Contact Us