Privacy Policy

This policy explains how the operator of YardPilot ("we", "us") collects, uses, discloses and protects personal information in YardPilot, software that service businesses use to quote, schedule, invoice and manage their work. It covers our website, the YardPilot app, public quote and proposal pages, and the customer portal (the "Service"). YardPilot is offered to businesses in the United States.

1. Our two roles

• Account information. For information about the people who sign up and use YardPilot — owners, managers and technicians — and visitors to our website, we decide how it is used.
• Business records. A business on YardPilot enters or receives records about its own customers, properties, jobs, crew and finances. We process those records on behalf of that business as its service provider (or "processor"), only to provide the Service. The business decides what to collect and is responsible for giving its customers and workers any required notices. If you are a customer of a business that uses YardPilot, please contact that business with questions about your information; we will help it respond.

2. Information we collect

• Identifiers and account details: name, email address, sign-in method (email and password, or Google), business memberships and roles, and whether authenticator (multi-factor) verification is enabled. Passwords are stored by our authentication provider in hashed form.
• Business details: business name, phone, email, city, state, service area, industry, services, prices and cost settings.
• Business records: customer names, email addresses, phone numbers and service addresses; property notes and measurements; photos; estimates, proposals, approvals and typed-name signatures; jobs, checklists and completion notes; crew time entries (clock-in and clock-out times); invoices, recorded payments and refunds; expenses and receipts; service requests; referral and lead-source information.
• Photo metadata: photos uploaded from a phone or camera may contain embedded metadata, such as the time taken and, if location tagging is on in the device, GPS location. We store photos as uploaded and do not use this metadata ourselves. Turn off location tagging in your camera settings if you prefer not to include it.
• Information submitted on public pages: name, email, phone, property address, requested service and message entered on a business's quote request page, and the name typed to approve or decline a proposal or change order. This goes to that business.
• Commercial information: your plan, seats, subscription status and billing history. Paddle, our merchant of record, collects payment card and billing address details directly; we do not receive or store full card numbers.
• Technical information: sign-in session tokens, IP address, browser and device type, and error diagnostics needed to run and secure the Service.
• AI requests: the photos or business facts you choose to send to an AI feature and the output it returns, plus counts used to enforce plan limits.

We collect this information from you, from members of your business, from your customers through public pages and the portal, from Google if you choose Google sign-in, and from Paddle about your subscription status.

3. How we use information

• To provide, maintain and support the Service, including keeping each business's records separate from every other business.
• To authenticate users, secure accounts, prevent fraud and abuse, and enforce plan limits.
• To process subscriptions with Paddle.
• To run AI features when a user requests them.
• To communicate about your account, security, billing and changes to the Service.
• To understand and improve the Service using de-identified, aggregated information.
• To comply with law, respond to lawful requests and enforce our Terms.

We do not sell personal information, we do not share it for cross-context behavioral (targeted) advertising, and we do not use it to train AI models. We do not use advertising or analytics cookies or third-party trackers. We do not use personal information to make decisions that produce legal or similarly significant effects about anyone.

4. AI features

When a user runs a photo walkthrough analysis or asks the business assistant a question, the relevant photos or business facts are sent through our hosting provider's AI gateway to a third-party AI model provider (currently OpenAI) to generate a response. Providers process this information to return the response and under their own data-use terms. AI output is shown as suggestions; it never sets prices or measurements and never changes records on its own. Avoid including information in photos or questions that is not needed for the task.

5. Who we share information with

• The business you work with. Information you submit on a business's public pages or portal goes to that business.
• Members of a business. Owners and managers see that business's records; technicians see only jobs assigned to them and never prices, costs or unrelated customers.
• Service providers that process information for us under contract:
  • Lovable Cloud and its infrastructure providers — application hosting, database, file storage, authentication and AI gateway.
  • OpenAI — AI model processing for features you request.
  • Paddle — merchant of record for subscriptions (checkout, payment, tax, receipts).
  • Google — optional Google sign-in, and web fonts loaded from Google Fonts (which receives your IP address when fonts load).
• Legal and safety. When we believe in good faith it is required by law or legal process, or needed to protect the rights, property or safety of users, the public or us.
• Business transfers. As part of a merger, acquisition, financing or sale of assets, subject to this policy, with notice to account owners.

6. Cookies and local storage

We use only storage that is strictly necessary for the Service: a sign-in session and preferences such as the business you last selected and your language (ENG or ESP). We do not use analytics or advertising cookies. Because we do not sell or share personal information for advertising, there is nothing to opt out of; we also treat Global Privacy Control signals as a request to opt out of any sale or sharing. Your browser's "Do Not Track" setting has no effect because we do not track users across sites.

7. Retention

• Account information is kept while the account is active and for a reasonable period after closure to handle disputes, security and legal obligations.
• Business records are kept while the business's account is active. After closure they are available for export on request for at least 30 days and then deleted within a reasonable time, unless we must keep them longer for legal, tax, security or dispute reasons. A business that locks after its free trial keeps its records until the owner subscribes or asks us to delete them.
• Billing and tax records are kept for as long as the law requires.
• Deleted information may remain in our hosting provider's backups for a limited period until those backups expire.

8. Security

Information is encrypted in transit. Access to each business's records is enforced in the database by business and role, and automated tests check that one business cannot read or change another's data. Photos and receipts are stored in private storage, and accounts can add authenticator-app verification. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a security breach affecting your personal information, we will notify you and authorities as required by law. Tell us promptly if you suspect unauthorized access.

9. Your privacy rights

Depending on the state where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws), you may have the right to:

• know or access the personal information we hold about you, and receive a copy in a portable format;
• correct inaccurate personal information;
• delete personal information, subject to legal exceptions;
• opt out of the sale or sharing of personal information, targeted advertising and certain profiling (we do none of these);
• limit the use of sensitive personal information (we use it only to provide the Service); and
• not be discriminated against for exercising your rights.

You can view and update most account and business information in the app. To make a request, email the contact address listed on this page once published. We will verify your identity using information associated with your account before acting, and respond within the time the law requires. You may use an authorized agent with your signed permission. If we deny your request, you may appeal by replying to our decision; if your appeal is denied, you may contact your state attorney general. If you are a customer of a business using YardPilot, we may refer your request to that business, which controls those records.

10. Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact us and we will delete it.

11. Location of processing

YardPilot is operated in, and intended for businesses in, the United States. Information is stored and processed in the United States and in other countries where our service providers operate.

12. Changes to this policy

We will post changes here and update the effective date. If changes are material, we will notify account owners by email or in the app before they take effect.

13. Contact

the operator of YardPilot. Privacy questions or requests: the contact address listed on this page once published.