Release candidate 0.4 — 25 October 2026. Selected retention and processing rules; not yet published. The effective date will be assigned at publication.
Operator and contact
Field Service Desk is operated by Jacobus Venter, an individual operating from South Africa. Service/contact address: 12 Goudrif Avenue, Allen Grove, Kempton Park, 1619, Gauteng, South Africa. Privacy/support email: prismage.visuals@gmail.com. Platform: https://desk.prismage-visuals.com.
This notice concerns the field-service platform. The separate Prismage Visuals website offers different services and uses a different set of providers. Its notices do not automatically govern workspace records here.
Who is responsible for which information
The operator determines relevant purposes for platform account administration, support, security and service operations. A service company generally determines the purposes and instructions for customer and staff records it puts into its workspace; the platform processes those records to provide the service. Roles depend on the actual activity and applicable law. Direct questions about a plumber's or other service company's customer/job records to that company first; the operator can help route a request.
Information processed
The platform handles account identifiers, names, verified email and session information; company, customer and staff contact details and service addresses; technician assignments and appointment dates; quotes, invoice details and manually recorded payment references; work notes, checklists, visits, materials and handover details, including an optional drawn signature; communication drafts and activity/access histories; and support correspondence.
The separate privacy-request register contains request types, review notes, verification outcomes, responsible persons and response references. Do not submit identity documents or unnecessary sensitive information in that register or ordinary support email.
Enabled public appointment pages collect the contact details, service address, description and preferred date/time provided by the visitor, plus the acknowledgement and form-review records needed for staff review and duplicate handling. A public request is not a confirmed appointment. The page identifies the receiving service company and displays that company's privacy information. Turnstile checks the submission for abuse. Public appointment pages do not require platform sign-in.
Infrastructure and authentication providers can process connection, session and security information. Independent monitoring checks a public health URL; that endpoint returns no customer information. Monitoring account contacts receive operational notifications.
Live job-photo uploads are currently disabled. Practice photographs remain temporary in the demo browser tab. Before live photo storage is enabled, its provider, purposes, retention and controls must be disclosed. This is a business service, not a service designed for children.
Purposes and legal grounds
Information is used to operate requested accounts and workspaces, manage permissions, record and retrieve service work, generate documents/exports, review appointment and privacy requests, support users and protect service security. The operator may also need records to meet legal obligations or establish, exercise or defend claims.
The operator's own processing activities need an appropriate legal ground: performance of an agreement where the individual is a party and the processing is necessary; applicable legal obligations; or justified legitimate interests such as account/security administration after assessing the person's rights. Where consent is required for a separate purpose, request it separately and allow withdrawal. A subscriber's contract does not automatically supply a legal basis for all of its customers' or employees' data. The subscriber must determine the grounds for its own processing instructions. For security and operational administration the identified interests are preventing unauthorised access, preserving reliable records and responding to faults. These purposes require minimisation, appropriate access restrictions and consideration of affected individuals; they do not authorise unrelated advertising or sale of personal data. The internal purpose/basis record must be maintained as operations change.
Sharing and providers
Authorised company users can access records according to their roles. Owners manage permissions. Users decide when to download or externally share generated documents and exports.
Current provider roles include Cloudflare hosting, D1 database services and Turnstile verification; Clerk authentication; and HetrixTools checks of the public availability endpoint and operational alert delivery. Selecting a Google Maps directions link sends the selected addresses to Google, which handles that interaction under its own terms. No Google Maps location tracking is claimed. Ordinary support correspondence also uses the operator's email service.
The platform has not connected Google Analytics, Web3Forms, Cloudinary, PayPal or PayFast as application services merely because those names appear in the separate visual-production website notice. Automatic email/SMS delivery and direct accounting sync are not connected. A live audit must still check hosting-injected features and authentication SDK behaviour before making a complete tracker inventory claim.
International processing and provider arrangements
The platform uses Cloudflare for hosting, D1 and Turnstile, and Clerk for authentication. Those services operate through international infrastructure and subprocessors. No South Africa-only data residency has been purchased or promised. Applicable provider contracts and transfer safeguards govern processing; privacy acknowledgement is not consent to an otherwise unlawful transfer.
Public provider processing terms are available at https://www.cloudflare.com/cloudflare-customer-dpa/ and https://clerk.com/legal/dpa. Their contractual arrangements can include relevant transfer safeguards, but the mechanism applicable to a particular processing activity must be established from the actual account relationship and current law. Information about applicable safeguards can be requested from the operator. No claim of a custom agreement, completed transfer assessment or appointed overseas representative is made solely because those pages exist.
HetrixTools monitors public website/health responses and sends operational alerts to the operator. It is not given workspace credentials or customer database contents. Its account/contact processing is described at https://hetrixtools.com/privacy-policy/. Support correspondence uses the operator's Gmail address; minimise personal details and do not email database exports, identity documents or unnecessary customer files. Account-specific provider evidence is maintained separately from this notice.
Retention and closure
The following are operator retention rules, subject to a documented legal hold, a valid earlier deletion instruction, and applicable statutory duties. They do not authorise keeping information longer than necessary. Closure dates and material exceptions are recorded. Deletion work is currently performed through an operator procedure, not an automatic self-service erasure system.
| Category | Retention rule |
|---|---|
| Active customer/company, job, quote, invoice, payment and work records | Kept while the workspace is used to provide the agreed service and as lawfully instructed. Earlier deletion requests are assessed for authority and required recordkeeping. |
| Closed workspace: ordinary live data, messages, company links/page configuration and related access history | Owner export opportunity for 30 calendar days after service ends; removal from the active database by day 45 unless a documented legal hold applies. Removing a company membership does not erase a person's separate account or work for another company. |
| Public appointment requests not yet part of a retained business record | Spam removed within 30 days of classification; closed non-spam requests removed within 90 days of closure. An open request is reviewed at least monthly; it is not left open to avoid expiry. |
| Privacy-request outcomes and minimal supporting audit | Up to three years after final closure for accountability and complaints, with unnecessary free text or identity details removed sooner. |
| Routine support correspondence | Up to 12 months after resolution; longer only where needed for an identified dispute, statutory record or legal hold. |
| Operator-collected operational/security event records | Up to 90 days, except an identified incident or legal hold. Provider-managed logs may have different, shorter or legally required retention. |
| Minimal service agreement, acceptance, cancellation/refund and dispute evidence | Up to three years after service ends or the dispute is resolved, whichever is later; financial records separately follow applicable statutory retention. This is not permission to retain a full former customer's database for a potential dispute. |
| Operator tax/accounting records for platform fees | Kept for the applicable statutory period. South African rules generally include five years measured from the relevant tax-return submission, with different triggers or longer retention for unsubmitted returns, audits or disputes. This does not set the retention rule for every subscriber's own invoices. |
| Operator-controlled SQL backups and recovery copies | Maximum 35 days from capture; a shorter approved drill period may apply. Protected from ordinary use, then removed through the backup-retention process. |
The latest ordinary live copy can be kept through day 45 after account closure; a backup captured just before its removal can therefore persist through day 80. A provider-managed recovery copy, account/security record or documented legal hold can have a separate applicable retention cycle. Clerk identity deletion and Cloudflare-managed recovery/technical records require provider-specific procedures. The operator must record the actual provider setting rather than present 35 days as a promise covering every provider copy.
Business backups, separate registers, provider copies and subscriber downloads exist separately. When restoring older information, reconcile relevant erasures and access revocations before reopening service. The subscriber controls its own exported copies. The operator does not promise immediate erasure of every backup or deletion of another subscriber's legitimate records.
Security
Access and live-session checks, company roles, protected exports, tested database recovery and basic availability monitoring help reduce risk. No online service can promise absolute security. The processing agreement addresses access, confidentiality, incident assistance and return/deletion. Avoid credentials, card details, identity documents and unnecessary sensitive information in job notes or support messages. A documented incident requires preservation of relevant evidence and assessment of applicable notification duties; routine deletion must not destroy necessary incident evidence.
Requests and complaints
Email prismage.visuals@gmail.com with the nature of a request and the relevant service company. Verification of identity and authority must be proportionate before disclosure or changes; do not send sensitive proof unsolicited. Depending on applicable law, rights can include access, correction, deletion, restriction, objection, portability and withdrawal of a consent. Exceptions and necessary recordkeeping can apply. A company's ordinary business-record backup is not an appropriate disclosure to a single individual.
The request register supports manual review; it does not calculate statutory deadlines, send responses or automatically erase data. The operator targets an acknowledgement within two business days and assesses the statutory response deadline when a request arrives. A local target does not extend or replace a legal deadline. Requests, verification, decisions and any extension must be recorded and followed up manually. A person may complain to the relevant supervisory authority, including South Africa's Information Regulator where applicable, without first exhausting support. For overseas users, applicable local rights remain available. Contact the operator to identify the appropriate complaint/representation channel for the processing concerned. An assessment of representation duties for actively targeted markets is required; no representative is claimed to have been appointed by this notice.
Cookies, notice changes and acknowledgement
See the separate Cookie Notice. Necessary sign-in storage supports requested account functions. Any optional tracking or marketing use requires the controls and legal ground applicable to it. No blanket tracking consent is requested by accepting service Terms.
Published revisions must identify their date and be communicated through a working service channel when appropriate. Acknowledging this notice records that it was made available; it does not waive privacy rights or amount to consent for every processing activity.
Optional device drafts and closure reviews
Technicians may explicitly enable job-card drafts on a personal device. This stores work notes, materials, labour minutes and work checks in IndexedDB, scoped to the signed-in account, company and technician profile. It does not store sign-in tokens, invoices or a full company database. Jobs must first be loaded online; this version supports signal loss in an already open field page, not offline sign-in or cold start. Manual sync checks current permissions and job changes. Local drafts are not company saves or a server backup. Drafts are kept until successful sync or explicit clearing; signing out through the field view clears the enabled current scope. Browser clearing or storage eviction can remove them. Other device/browser users may access local storage, and remotely revoked access cannot recall copies already viewed or stored offline. Do not enable on a shared/public device; follow company instructions and clear device data before handing it to another person. An inaccessible old technician profile may leave a local copy requiring browser storage cleanup. The separate closure/retention register holds owner-supplied dates, responsible persons, references, notes and server-attributed review history. Its dates track operating-policy reviews, not automatically calculated statutory deadlines. It does not close accounts, delete records, send exports or verify reported deletion evidence. It follows the applicable minimal audit/retention rules and must be reviewed through the operator process.