Privacy Policy
Hardpan — operated by MS2 Capital, LLC
Version 1.1 · Effective October 2026 · Contact: micah@ms2.capital
This policy describes how the Hardpan platform (web console, crew mobile application, and related services) collects, uses, and protects information. Hardpan is business operations software used by excavation and earthworks contractors and their authorized personnel. Access is by invitation from the business; the app does not offer public sign-up.
1. Information We Collect
Account information. Name, work email address, phone number, and role for users authorized by their employer to access the platform.
Operational business data. Information the business enters or generates in the course of using the platform: jobs, estimates, schedules, equipment and fleet records, timekeeping, applicant records, employment agreements and onboarding documents the business asks its personnel to provide, and related documents.
Location, only while clocked in. The mobile app records a person's precise location only while that person is clocked in to a shift, to record the job site visited and the hours worked. Because a clocked-in person may leave a site with the phone in a pocket, the app asks iOS for “Always” location permission so it can notice when a clocked-in person leaves the job site and remind them to clock out. When the person is clocked out, no location is collected. Location is visible to the person and to the business's office staff as part of the shift record. A person may decline location permission; clocking in is never blocked by it.
Photos and camera. Job photos and receipt images that a person chooses to take or upload. The camera is used only when the person taps to take a photo. Photos are stored with the job or expense they belong to and are visible to the business.
Push notifications and device identifiers. A device push token so the app can deliver schedule changes, time and request notices, and sign-in security notices, and an app install identifier used to deliver app updates. We do not use advertising identifiers and we do not track people across other companies' apps or websites. Notifications can be turned off in iOS Settings.
Inbound communications. Calls and text messages to the business's tracked phone lines are logged, and calls may be recorded and transcribed, through our call-tracking provider (CallRail) for business purposes such as responding to customer inquiries.
Financial account data. When a business owner chooses to connect the business's bank accounts, we receive account and transaction data through Plaid (see Section 3). We never receive or store bank login credentials.
2. How We Use Information
We use this information solely to provide and improve the platform: operating job and crew management, recording time and job-site attendance, delivering notices to the people the business works with, reconciling customer payments against jobs, routing and responding to inbound inquiries, and securing the service. We do not sell personal information, and we do not use it for third-party advertising.
3. Bank Data and Plaid
Bank connections are made through Plaid Inc. The account holder authorizes each connection directly through Plaid Link; bank credentials are provided to Plaid, not to us. Data retrieved through Plaid (account balances and transactions) is used only to provide the platform's financial reconciliation features. Plaid's handling of your data is described in the Plaid End User Privacy Policy. A connected account can be disconnected at any time, which ends our access to it.
4. Sharing
We share information only with the service providers that run the platform — currently Supabase (database, authentication and backend), Railway (hosting), Expo (mobile app updates and push notification delivery), Apple (push notification delivery to iOS devices), Resend (email delivery, including sign-in codes), Plaid (bank data), CallRail (call and text tracking), and Twilio (text messaging) — each limited to what is needed to provide its service, and as required by law. We do not sell or rent personal information to anyone.
5. SMS Communications
Hardpan sends text messages (via Twilio) to authorized users for operational purposes such as login verification codes and account or job notifications. Message frequency varies, and message and data rates may apply. You can opt out at any time by replying STOP to any Hardpan message; reply HELP for assistance. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.
6. Data Retention and Deletion
We retain information while the business's account is active and as needed for legitimate business records and legal obligations. Location points are kept with the shift record they belong to. When a bank account is disconnected, access is revoked at Plaid, and associated transaction data is deleted on request. Accounts are created and removed by the business; a person who wants their account or personal information removed contacts their office or micah@ms2.capital, and verified requests are honored within 30 days, except where retention is required by law. This retention practice is reviewed periodically alongside our information security policy.
7. Security
Data in transit is encrypted with TLS 1.2 or higher, and data at rest is encrypted (AES-256) on managed infrastructure. Access is limited by role-based access control, and financial data visibility is further restricted to authorized owners. Our full practices are described in our information security policy.
8. Changes
We may update this policy from time to time. Material changes will be communicated to account holders, and the current version will always be available where this policy is published.