Effective Date: August 19, 2026 · Last Updated: October 24, 2026
Cox Toolworks LLC ("Company," "Platform," "we," "us," or "our") operates Halden Pro as a multi-tenant business-to-business (B2B) software-as-a-service (SaaS) platform designed specifically for independent contractors, service professionals, and trade businesses (including HVAC, plumbing, electrical, landscaping, handyman, and roofing operations across the United States). This Privacy Policy explains how we collect, use, disclose, process, and protect information when independent contractor businesses ("Subscribers"), their authorized employees and users ("Authorized Users"), and their customers ("End Customers") interact with the Halden Pro web application, progressive web app (PWA), mobile applications, APIs, and associated services (collectively, the "Platform").
This Privacy Policy and all matters arising out of or relating to it shall be governed by and construed in accordance with the laws of the State of Florida. By accessing or using Halden Pro, you acknowledge that you have read and understood this Privacy Policy.
We collect various types of information depending on how users interact with the Platform:
We obtain information through three primary methods:
We process and use collected information exclusively for legitimate business and operational purposes, including:
Halden Pro incorporates artificial intelligence features powered by third-party large language models to assist with estimates, scheduling, document drafting, and communications.
Data submitted to AI features ("Inputs") and the resulting generated text or data ("Outputs") are transmitted securely to third-party AI service providers solely to generate the requested response for the Subscriber.
Cox Toolworks LLC explicitly warrants that Subscriber business data and End Customer personal information (PII) are never used to train public foundational AI models. We strictly prohibit our third-party AI providers from retaining or utilizing your data for public model training.
We reserve the right to utilize strictly anonymized, non-identifiable aggregated data derived from feature usage to optimize and improve internal Platform functionality. No individual personal data or tenant-specific information is ever exposed or identifiable in this process.
The Halden Pro mobile application and PWA include optional GPS time-tracking, location services, and field routing features.
The Subscriber bears sole and absolute legal responsibility for notifying their employees, subcontractors, and field personnel, and for obtaining all legally required consents prior to enabling GPS tracking features on any device.
Cox Toolworks LLC processes geolocation data strictly as a data processor directed by the Subscriber. We bear zero liability for any employment, privacy, labor law, or civil claims brought by field personnel arising from GPS tracking enabled by the Subscriber.
Halden Pro integrates with third-party telecommunications infrastructure to facilitate SMS invoicing, dispatch notifications, and customer updates.
The Subscriber is the legal originator and sender of all SMS communications sent to End Customers through the Platform. The Subscriber bears the sole burden for compliance with the Telephone Consumer Protection Act (TCPA), the Florida Telephone Solicitation Act (FTSA), the CAN-SPAM Act, and all applicable telecommunications laws, including securing initial consumer consent.
The Platform maintains secure logs of message delivery metadata, consent markers, and opt-out requests (including inbound "STOP," "UNSUBSCRIBE," "CANCEL," or "QUIT" replies). We retain these logs strictly for the protection of the Subscriber and to enforce mandatory communication blocklists.
The Platform automatically records an SMSLog entry for every outbound SMS transmission attempt, capturing the destination phone number, message content, delivery status (SENT, BLOCKED_LIMIT_REACHED, or FAILED), and timestamp. SMSLog data is processed exclusively for the following purposes: (1) enforcing monthly SMS allocation limits per subscription tier; (2) auditing SMS delivery accuracy; and (3) detecting and preventing abuse of the Platform's telecommunications infrastructure. SMSLog records containing personal data (destination phone numbers and message content) are retained as described in Section 15.
Subscribers and their field crews frequently upload job site photographs, property videos, and digital attachments to document completed work.
Images or attachments may occasionally capture incidental facial geometry, physical features, or biometric identifiers of workers, bystanders, or End Customers.
The Subscriber acts as the sole data controller for any such media. The burden of compliance with the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and all other applicable biometric or privacy statutes rests entirely with the Subscriber. Cox Toolworks LLC stores these files strictly as static assets within secure cloud storage at the direction of the Subscriber.
Payments collected directly from Subscribers for platform access are processed by Stripe, acting as our merchant of record. We do not store raw credit card numbers on our local database servers.
Payments collected by Subscribers from their End Customers are processed through Stripe Connected Accounts. Cox Toolworks LLC is not the merchant of record for these transactions, does not hold or control funds transferred between Subscribers and End Customers, and does not retain raw financial credentials. All financial data handled via Stripe is governed by the Stripe Services Agreement.
We do not rent, lease, or trade personal information. We share data only with trusted third-party infrastructure and service providers bound by contractual obligations to protect data security.
Our application is hosted on Railway in the United States (US East, Virginia), and our database is hosted on Neon on AWS in US East (N. Virginia).
Halden Pro is a multi-tenant SaaS platform.
Access to an organization's data is limited to that organization's signed-in users.
Data is sent between your browser and our servers over HTTPS/TLS.
No system is perfectly secure, and we cannot guarantee that your data will never be accessed without authorization.
(CCPA, VCDPA, CPA, CTDPA, UCPA, TDPSA, OCPA, NJDPA, TIPA, IDPL, and all 2026 enacted laws)
Cox Toolworks LLC acts strictly as a "Service Provider" under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), and as a "Processor" under the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), the Texas Data Privacy and Security Act (TDPSA), the Oregon Consumer Privacy Act (OCPA), the New Jersey Data Privacy Act (NJDPA), the Tennessee Information Protection Act (TIPA), the Indiana Data Privacy Law (IDPL), and all other enacted and future comprehensive US state data privacy laws.
Because we process End Customer data strictly on behalf of our Subscribers, any consumer rights requests received directly by Cox Toolworks LLC will be redirected to the respective Subscriber (the data controller), who maintains primary responsibility for fulfilling consumer rights under applicable law.
Cox Toolworks LLC explicitly does not sell, rent, release, disclose, disseminate, make available, or otherwise share End Customer personal data to any third parties for monetary or other valuable consideration.
We do not share End Customer personal information with third parties for cross-context behavioral advertising or targeted marketing purposes.
Halden Pro is a professional B2B software platform built exclusively for commercial trade contractors and business entities. The Platform is not directed to, marketed toward, or intended for use by individuals under the age of 18. We do not knowingly collect, solicit, or maintain personal information from children under the age of 13. If we discover that a user under 13 has provided personal data, we will terminate the account and purge the data immediately in strict compliance with the Children's Online Privacy Protection Act (COPPA).
Halden Pro's application is hosted on Railway in a U.S. region. Our database is hosted on Neon (AWS US East 1), and uploaded files and job photos are stored on Cloudflare R2. Our primary systems are located in the United States. Some service providers we use (for example, payments, messaging, email and AI features) process data on our behalf under their own terms.
We keep a Subscriber's data for as long as the Subscriber's account exists. We do not currently delete data automatically on a schedule. This includes business records, End Customer information, estimates, invoices, job site photos, GPS location records captured by the time clock, and SMS and consent logs. We keep SMS consent and opt-out records for as long as we need them to demonstrate compliance with messaging laws.
Subscription billing and payment records are also maintained by our payment processor, Stripe. We retain financial and tax records where the law requires.
If a Subscriber cancels, the account is locked from the dashboard and from making changes, and the Subscriber can still export their data. A cancelled account's data is not deleted automatically. A Subscriber may delete the account at any time, or ask us to delete it, as described below.
An account Owner can delete the account at any time in Settings. Deletion cancels the subscription and permanently removes the organization's data and uploaded files from our systems. This cannot be undone. Copies may remain in routine backups for a limited time, and we may keep information where the law requires. You can also email [email protected] to request deletion, and we will respond as required by applicable law.
Subscribers can export core records (customers, jobs, invoices, estimates, crew, time entries and review requests) as CSV files in Settings.
We plan to introduce scheduled retention and deletion periods. Before we do, we will update this Privacy Policy and notify Subscribers as described in Section 16.
We reserve the right to update or modify this Privacy Policy at any time. When material changes are made, we will provide notice to registered Subscribers via email to their registered address at least thirty (30) days prior to the effective date of the update. Continued use of the Halden Pro platform following the effective date of any modification constitutes full acceptance of the revised Privacy Policy.
For any questions, concerns, or legal inquiries regarding this Privacy Policy or our data practices, please contact:
Cox Toolworks LLC
Attn: Privacy and Legal Compliance
Orlando, Florida 32807
Email: [email protected]
Cox Toolworks LLC is committed to safeguarding Subscriber and End Customer data through continuous monitoring via tools including Sentry error monitoring. In the event that Cox Toolworks LLC confirms a data breach resulting in the unauthorized access or disclosure of End Customer personal data, we will formally notify the affected Subscriber (acting as the data controller) within seventy-two (72) hours of confirmation. Upon notification, it is the sole responsibility of the Subscriber to notify their End Customers in accordance with applicable state and federal laws.
In compliance with the Florida Information Protection Act (FIPA), Cox Toolworks LLC will provide direct notification to the Florida Department of Legal Affairs if a confirmed breach affects five hundred (500) or more individuals within the State of Florida. Immediately following the discovery of a breach, Cox Toolworks LLC will take all commercially reasonable steps to contain the incident, remediate structural vulnerabilities, and restore platform security.
To ensure the security and functionality of the Halden Pro web application and Progressive Web App (PWA), the Platform utilizes strictly necessary technical tools. We use secure session cookies to maintain authenticated access. We also rely on secure, HttpOnly authentication tokens (such as NextAuth JWT) to safeguard user sessions. Additionally, browser localStorage is utilized strictly to cache user preferences and enable essential offline functionality for field operations.
We use PostHog for product analytics, such as page views and clicks on sign-up and pricing links. For signed-in users, this analytics data is associated with the user's email address, organization identifier, and plan. Product analytics runs whether you choose Accept All or Decline on the cookie banner; the banner choice does not currently turn it off.
Like PostHog, HeyCatch analytics runs whether you choose Accept All or Decline on the cookie banner.
Our cookie banner appears on public pages. Only if you choose Accept All do we turn on Sentry session replay for error monitoring, with text masked and media blocked. If you choose Decline, session replay is not turned on. Your choice is remembered in a cookie for up to 365 days.
We do not use third-party advertising cookies or marketing pixels on the Platform.
All of the above categories exclude text messaging originator opt-in data and consent. SMS opt-in data and mobile numbers will not be sold or shared with third parties for promotional or marketing purposes. Information needed to deliver messages you requested is handled only by our service providers and wireless carriers, solely to deliver those messages. We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign.