Privacy Policy

Effective Date: October 10, 2026 (previous version: July 30, 2026)

This Privacy Policy explains how MaplesBoneYard LLC ("5th Bull," "we," "us," or "our") collects, uses, and shares information in connection with the 5th Bull software for fleet maintenance, fire and EMS departments, and field service businesses, including our website, web application, and API (the "Service"). It applies to the companies and organizations that use the Service ("Customers"), the individual users those Customers create accounts for (owners, chiefs, mechanics, drivers, firefighters, technicians, managers, etc.), and visitors to our website. 5th Bull is a business-to-business tool - it's not directed at, and we don't knowingly collect information from, individual consumers acting outside a business context, or from anyone under 18.

1. Information We Collect

Account and profile information. Company name, and for each user your company creates: username, role, and optionally an email address and/or phone number (used for password recovery and for email alerts you choose to receive).

Operational data ("Customer Data"). Whatever your company enters into the Service: equipment, vehicle and apparatus records, work orders, inspections and checks, parts and medical supply inventory, preventive-maintenance schedules, compliance and testing records, personnel certification dates, training records, water supply records, time entries, documents, notes, and any photos or PDF attachments your team uploads.

Information about your own customers (Field Service). If your company uses the Field Service features, Customer Data can include information about your customers: names, contact people, phone numbers, email addresses, service addresses and access notes, signatures captured on a technician's device, job photos, quotes, and invoices. Your company decides what to collect and is responsible for having the right to collect it; we process it only to provide the Service to you.

No patient information. The Service is not designed to store patient or clinical information, and you should not enter it. Medical supply features record item usage and an optional incident/run number only.

Billing information. Subscription plan and billing status. Payment card details are collected and stored directly by our payment processor, Stripe - we never see or store your full card number. Fuel card features store only the last four digits of a card.

Usage and device data. Standard web server logs (IP address, browser user-agent, request timestamps), used for security, rate limiting, and troubleshooting.

Website analytics. On our public website pages and the read-only demo, we use Google Analytics to understand how visitors find and use the site (see Cookies, below). Google Analytics is not loaded inside a real customer's logged-in account.

Support and communications. Anything you send us directly, like support requests, chat messages, or emails.

2. How We Use Information

To provide, maintain, and secure the Service, including enforcing that each company can only see its own data (multi-tenant isolation).
To process payments and manage subscriptions, via Stripe.
To send email: password resets, alerts and summaries you've opted into, billing notices, and - when your company uses those features - service reports, quotes, invoices, and payment reminders sent to your own customers on your behalf. Email is delivered by our email provider, Resend.
To respond to support requests.
To detect, investigate, and prevent fraud, abuse, errors, and security incidents.
To understand website traffic and improve the Service.

We do not sell your information, we do not use Customer Data for advertising, and we do not run third-party advertising on the Service.

3. Cookies

We use a session cookie to keep you logged in (marked HttpOnly and SameSite, and Secure in production so it's only ever sent over HTTPS). On our public website pages and the demo, Google Analytics sets its own cookies to measure visits; these are not set inside a real customer's logged-in account. You can block or delete cookies in your browser settings - the Service will still work, but you'll need to log in again.

4. Who We Share Information With

We share information only as needed to run the Service:

Render (application hosting and database infrastructure) - all data stored in the Service, as our hosting provider.
Stripe (payment processing) - billing and subscription data.
Resend (email delivery) - the email address and content needed to send a specific email.
Sentry (error monitoring) - technical details about errors in the Service, so we can fix them. It's configured not to send request cookies, IP addresses, or logged-in user identity by default.
Google - website analytics on public and demo pages (Google Analytics), and the web fonts the Service displays (Google Fonts), which means your browser requests those files from Google.
Lookup and map services - when you use VIN lookup, the VIN is sent to the U.S. National Highway Traffic Safety Administration's public vehicle database; the water supply map loads map tiles from OpenStreetMap.
Systems you choose to connect - if your company connects QuickBooks Online (Intuit), generates an API key, or configures a webhook, the relevant data flows to that destination, under your control.
Law enforcement or legal process - if required to comply with applicable law, or to protect our rights, users, or the public.
A successor - if we're involved in a merger, acquisition, or asset sale, in which case we'll provide notice before data is transferred.

We don't sell Customer Data or personal information to third parties.

5. Data Retention

We retain your data for as long as your account is active. If you cancel your subscription (or a trial ends without a paid plan), access to the Service stops but your data is kept so you can come back and pick up where you left off - we don't run an automatic deletion process. If you'd like your company's data permanently deleted (after cancellation or at any other time), contact us at the address below and we'll process that request within a reasonable time. We recommend exporting anything you need first, using the Service's CSV downloads and printable reports.

6. Data Security

Passwords are hashed, never stored in plain text. We support two-factor authentication (TOTP) for user accounts, and an account owner can require it for everyone in their company. Data is transmitted over HTTPS. Every company's data is scoped to that company, so one company's data is never visible to another. No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable measures to protect your information and to detect and respond to incidents.

7. Your Choices and Rights

Depending on your role and jurisdiction, you may be able to: access, correct, or export your company's data directly within the Service (CSV export and print/PDF reports are available for most record types); request deletion of your account or company's data by contacting us; and choose which alert emails you receive from your account settings. If your company is based somewhere with specific statutory privacy rights (for example, GDPR in the EU/UK or the CCPA/CPRA in California), contact us and we'll work with you to fulfill applicable requests. If you're a customer of one of our Customers (for example, you received a service report or invoice through 5th Bull), please contact that business first - they control that information - and we'll help them respond.

8. Where Data Is Stored

The Service and its database are hosted in the United States, in our hosting provider's Oregon (US West) region. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll provide reasonable notice (such as an in-app notice or email) before they take effect.

10. Contact

Questions about this Privacy Policy, or a data request? Reach us at privacy@5thbull.com.