Privacy Policy

1. Introduction

YardPartner LLC ("we", "us", or "our") is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

2. Information We Collect

Account Information

• Name, email address, and phone number
• Business name, address, and contact details
• Login credentials (we store only a secure, one-way hash of your password, never the password itself)

Business Data

• Client and property records you create
• Job schedules, notes, and photos
• Invoices and payment history

Payment Information

• Payment details, which Stripe collects and stores (Apple does this for App Store subscriptions); we do not store credit card numbers or full bank account numbers. We keep the card brand and last four digits, the bank name, last four digits and account type, auto-pay settings, and a record of each auto-pay authorization a customer accepts

Automatically Collected Data

• Device and browser information, such as device type, browser, operating system, app version, language and time zone; for the mobile app, a device identifier and push-notification token; and error and crash reports
• IP address and general location
• Usage patterns and feature interactions
• Location data from your device (with your permission), as described in section 10: where job photos are taken, your approximate location to suggest nearby addresses, where a crew member starts or finishes a job, and live crew location while traveling to an assigned job

3. How We Use Your Information

• Provide, maintain, and improve the Service
• Process payments and manage subscriptions
• Send transactional notifications (job updates, invoices, etc.)
• Deliver the messages and offers that a business sends to its customers through the Service
• Share a crew member's live route and estimated arrival with the customer for an active job, and show the crew member's live location to their business, when the crew member chooses to share location
• Provide customer support
• Understand how the Service is used, through the analytics described in section 9, so we can improve it
• Comply with legal obligations

4. How We Share Your Information

We do not sell your personal information. We may share data with:

• Service providers -- payment processing (Stripe), app-store billing (Apple and RevenueCat for App Store subscriptions; Google Play, which receives the amount, tax and region of subscriptions bought from our Android app), sign-in (Google, Apple), email delivery (Twilio SendGrid), SMS notifications (Twilio), push notifications (Expo, which delivers them through Apple and Google), message translation (Google Cloud Translation), address lookup (Google Places), mapping and routing services (Mapbox), error monitoring (Sentry), product analytics (PostHog), bot protection, file storage and website hosting (Cloudflare), sales-tax lookup by ZIP code (APILayer), and hosting for our servers and databases
• Your clients -- When you use features like the client portal or send notifications, relevant job and invoice information is shared with your clients
• Job customers -- When a crew member chooses to share live location while traveling to an assigned job, that job's customer can see the crew member's live route and estimated arrival until tracking stops
• The crew member's business -- While a crew member shares live location, the business they work for can see that live location in the Service
• Legal requirements -- When required by law, regulation, or legal process

4a. Message Translation

YardPartner uses Google Cloud Translation to translate text between English and Spanish. The following text may be sent to Google Cloud Translation to identify its language and, when needed, translate it: text messages and emails between a business and its customers; service-request descriptions; notes or reasons recorded with responses to estimates; and crew notes and business replies that customers can see. Internal notes, such as job instructions and property access notes, are sent only when someone at the business reads the other language. Only the text is sent, with no account, sender or recipient details attached, and anything written with digits (such as codes, prices, dates, times and phone numbers), email addresses, and web addresses that start with http, https or www are replaced with placeholders before it is sent. Translations are stored with the original and kept only as long as the original is kept; when the original is edited, its old translation is deleted. Translating never changes the stored original, and anyone shown a translation can also see the original.

Google requires us to show the following notice:

THIS SERVICE MAY CONTAIN TRANSLATIONS POWERED BY GOOGLE. GOOGLE DISCLAIMS ALL WARRANTIES RELATED TO THE TRANSLATIONS, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTIES OF ACCURACY, RELIABILITY, AND ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

5. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption in transit (TLS/SSL) and at rest
• Multi-tenant data isolation -- each business's data is kept separate, and other businesses can't see it
• Regular security audits and monitoring
• Secure password hashing

6. Data Retention

We retain your data while your account is active or as needed to provide the Service. When your account is closed or deleted, it can no longer be used to sign in, and we mark it as deleted rather than erasing it right away; the name and contact details on the account are erased after the required holding period, except where they appear in our audit records or in records that payment and messaging rules require us to keep. When the last owner of a business deletes their account, the business is closed: no one can sign in to it, and after 90 days its business records, such as customers, properties, jobs, invoices and messages, are permanently deleted, except records that payment and messaging rules require us to keep, which we keep for as long as those rules require. We also keep our audit records, including a record that the deletion happened. While your account is open, an owner or an admin who manages billing can download a copy of your business's records at any time from Settings; each prepared file can be downloaded for 7 days after you request the export. After your account is closed, you may request an export of your data within 30 days, unless you chose immediate permanent deletion. If you are the business's owner and its only admin, you can also choose to permanently delete all of your business's data when you close your account; the deletion finishes within about 2 days and can't be undone, with the same exceptions as for a closed business. Anyone else can contact us to request immediate deletion.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Opt out of marketing communications
• Withdraw consent for GPS location tracking

8. SMS Communications

If you or your customers opt in to SMS notifications:

• We use Twilio to deliver SMS messages
• Phone numbers are stored securely and used for Service-related text messages, such as notifications from a business to its customers, two-way conversations between a business and its customers, replies to keywords a customer texts (such as YES, PAY, REQUEST or HELP), sign-in codes for the customer portal, and offers a business chooses to send by text
• Reply STOP (or ALTO) to opt out at any time. Reply START to opt back in; if more than one business texts you from the same number, START may not restore messages from all of them
• Message and data rates may apply
• We do not share phone numbers with third parties for marketing purposes

9. Cookies and Tracking

We use essential cookies to keep you signed in and to remember your preferences. We do not use advertising cookies, and we do not sell analytics data or use it for advertising.

We use PostHog, an analytics provider, to understand how people use YardPartner. On our public website, PostHog records which pages you visit, what you click, and when you fill in or submit a form, without linking that activity to your name. It does not run on the customer portal, payment, estimate or job-tracking pages that businesses send to their customers. In the YardPartner web app, PostHog records the pages you open, what you click, and when you fill in or submit a form, including the text shown on the buttons and links you use, which can include information shown on screen, such as a customer's name. That activity is linked to your account, including your name, email address, role and business account. PostHog also receives standard technical details, such as your browser type and IP address. We have turned off PostHog's session recording, and if your browser sends a Do Not Track signal, PostHog collects no analytics from it. PostHog stores an identifier in your browser's local storage to recognize your browser between visits. In the YardPartner mobile app, PostHog records which screens you open, when the app is opened, updated or moved to the background, and certain actions, such as starting, completing or skipping a job, adding a customer, creating or sending an estimate or invoice and whether it was accepted for sending, sending an on-my-way message and whether anyone was notified, recording a payment, sending an offer, and whether a job photo uploaded. It records the type of screen, such as a job's details, but not which job or customer it shows, and it does not record what you type or the text on your screen. That activity is linked to your account, your role and your business account. PostHog also receives standard technical details, such as the app version, your phone's operating system, language and time zone, and your IP address; we have set PostHog not to use your IP address to estimate your location. The mobile app does not record your sessions, and PostHog stores an identifier on your phone to recognize the app between uses.

10. Mobile Location Sharing

With your permission, the YardPartner mobile app uses your device's location to record where a job photo was taken, which is saved with the photo, and to suggest nearby addresses when you type one, which sends your approximate location to Google Places. We also read the location, capture time, and camera make and model stored inside uploaded job photos and save them with the photo. When a crew member starts or finishes a job in the web app and allows location access, we record where that happened. A crew member can also choose to share live location while traveling to an assigned job. With permission, that location may be collected while the app is closed or not in use to display the crew member's live route and estimated arrival to that job's customer, and the business the crew member works for can see that live location too. Location sharing stops automatically when the crew member starts or finishes the job, or when tracking is otherwise stopped for that active job. We keep the last location reported with that job's tracking record. YardPartner does not sell location data or use it for advertising.

11. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. When a change needs your agreement, the Service will ask you to accept the updated policy. If you accepted the earlier policy before the update took effect, you can keep using the Service as before for 30 days from that date. After that, or if we have no earlier acceptance on record, you must accept the updated policy to keep using the Service.

13. Contact Us

For questions or concerns about this Privacy Policy or your data, contact us at:

Email: [email protected]