Privacy Policy

• We collect what we need to run Recoatly for the businesses that use it, and nothing for advertising.
• Businesses that use Recoatly control the information they keep about their own customers and team. We process it on their behalf and only as they instruct.
• We don't sell personal information or share it for cross-context behavioral advertising, and we don't use advertising or tracking cookies.
• We do not share mobile phone numbers or SMS consent with third parties or affiliates for marketing or promotional purposes.
• Wherever you live, you can ask us for a copy of your information, or to correct or delete it.

In this policy, "we", "us" and "our" mean the company that provides Recoatly.

Recoatly is used only by businesses — mostly contractors such as lawn care, cleaning, pressure washing, HVAC and plumbing companies in the United States, Canada, the United Kingdom, Australia, New Zealand and Ireland.

When we decide how information is used, we are the controller. This covers information about the people who sign up for and use Recoatly ("account information"), people who visit our website or contact us, and our own business contacts.

When a business uses Recoatly to run its work, that business is the controller and we are its processor (or "service provider"). This covers the information a business puts into Recoatly or collects through it about its customers, leads and team — names, contact details, service addresses, photos, estimates, invoices, messages and so on ("Customer Data"). We process Customer Data only to provide Recoatly to that business, under our Terms of Service and Data Processing Addendum.

If you are a customer of a business that uses Recoatly — for example, a contractor sent you an estimate, invoice or text, or you used their customer portal, website or quote form — that business is responsible for your information, and its own privacy notice applies. Please contact the business with questions or requests. If you contact us instead, we will pass your request to the business and help it respond.

Information about a business's team that the business manages in Recoatly — such as schedules, time entries, pay rates, job photos and location history — is also Customer Data controlled by the employer. We are the controller only for team members' own sign-in and account details.

Account information

When you sign up or accept an invitation: your name, email address, phone number (if you give it), company name, industry, country and time zone, and your password, which we store only as a scrypt hash, never in readable form. We also record when you confirmed your email address, and when you accepted our terms and which version. Your name, email address and password are needed to create an account; everything else is optional.

Subscription and billing information

Your plan, subscription status and billing history, and the billing details Stripe shares with us. Your card details are collected and stored by Stripe on its own payment pages; we never see or store your full card number.

Usage, device and log information

When you use Recoatly, our servers record technical information such as your IP address, browser type, the pages and features you use, and the time of each request. We keep a record of your sign-in sessions (with IP address and browser) so that you can stay signed in securely, and an audit log of significant actions — who did what and when, with IP address and browser — which the owners and administrators of your company can see. We also record product milestones, such as when a company sends its first estimate, and how you heard about Recoatly if you tell us.

Support and other messages

When you contact us or use the help form, we keep your name, email address, company, message and the page you were on, together with our replies.

Website visitors

Our public website may use Plausible Analytics, which counts visits without cookies and without storing IP addresses (see "Cookies and similar technologies" below). Otherwise, we only collect what you send us, for example through our contact form.

Information from others

Stripe tells us about your subscription and payments. Our email and text-message providers tell us whether messages were delivered, bounced, marked as spam or answered with STOP. When someone invites you to join their company in Recoatly, they give us your email address and the role they have chosen for you.

Depending on how a business uses Recoatly, Customer Data can include:

• contact details of customers and leads: names, email addresses, phone numbers, and service and billing addresses;
• property information: gate codes and access notes, measurements, map coordinates, and photos and videos of a property and the work done;
• estimates, contracts and e-signatures (the signer's typed name, drawn signature, the time and the IP address used), jobs, appointments, invoices and payment records (amounts, methods and payment references, not full card numbers);
• messages by email, text and the customer portal, call logs and, if used, call recordings and transcripts, reviews, and answers to forms and inspections;
• inquiries and quote requests sent through a business's hosted website, instant-quote page or lead forms; and
• information about the business's team: names, contact details, roles, schedules, availability, time entries, pay rates, commissions, expenses and receipts, and location history if a technician turns on location sharing.

Crew location sharing

Technicians can choose to share their location with their company while they work. Sharing is off until the technician switches it on, and it records only while they are on the clock. Managers with permission can see where people on shift are and the route of their day. The technician can switch sharing off at any time, which deletes their location history. Location history older than 14 days is deleted automatically.

Address lookup

To place jobs on the map and plan routes, Recoatly sends service addresses in the United States to the U.S. Census Bureau's geocoder to look up their map coordinates. Only the address is sent, without names or contact details.

Voice capture

With "Say it", a User can describe something out loud and Recoatly proposes the records it describes for the User to check before anything is saved. The speech is turned into text by the User's own web browser, using that browser's speech service (for example Google's in Chrome or Apple's in Safari) under the browser provider's terms; Recoatly never receives or stores audio. The text is read by Recoatly and, where AI features are switched on, by our AI provider, and is kept as a note on the customer's record unless the User chooses not to.

The customer portal

A business's customers can see their estimates, invoices and appointments in that business's customer portal by asking for a sign-in link by email. The link, and the portal session it starts, last up to 14 days.

We use the information we control for the purposes below. If you are in the United Kingdom or the European Union, the law requires us to tell you the legal basis for each one.

• To provide Recoatly: creating and running accounts, signing you in, providing features and support, and managing your subscription. Legal basis: performing our contract with you or, for people who use Recoatly through their employer's account, our legitimate interest in providing the service that business has chosen.
• To bill for Recoatly: taking payments and keeping financial records. Legal bases: performing our contract, and complying with legal obligations such as tax law.
• To communicate with you: confirming your email address, password resets, invitations, security alerts, trial and billing notices, and changes to our terms. Legal bases: performing our contract, and our legitimate interests.
• To keep Recoatly secure: preventing fraud, abuse and spam, enforcing our terms, rate limiting, and keeping audit and server logs. Legal bases: our legitimate interests, and complying with legal obligations.
• To improve Recoatly: understanding which features are used and where people get stuck, using aggregated statistics wherever possible. Legal basis: our legitimate interests.
• To tell you about Recoatly: occasional emails about new features and getting more out of the product. Legal basis: our legitimate interests or, where the law requires it, your consent. You can unsubscribe at any time.
• To meet legal obligations and protect rights: responding to lawful requests, and establishing, exercising or defending legal claims. Legal bases: legal obligation, and our legitimate interests.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see "Your rights" below). We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

We process Customer Data only to provide Recoatly to the business that controls it, as set out in our Data Processing Addendum.

We share personal information only in these ways:

• Service providers (subprocessors) that help us run Recoatly — hosting, email delivery, text messaging, payments, AI features, address lookup and website analytics — under contracts that require them to protect it and use it only to provide their services to us. Our Subprocessors page lists them.
• At a business's direction — for example, when it sends an estimate or a message, publishes its website, takes a payment through its own Stripe account, or connects an integration or webhook.
• Within a company account. Users see the information their role allows, owners and administrators can see the audit log, and managers with permission can see shared locations.
• For legal reasons — when we believe in good faith that the law, a court order or a lawful request from a public authority requires it, or to protect the rights, property or safety of our users, the public or us. Where the law allows, we tell the affected business first.
• If our business changes hands — as part of a merger, acquisition or sale of assets. The information remains protected by this policy, or by one at least as protective, and we will let you know.
• With your consent or at your request.

No selling, no advertising

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined in California law. We have not done either in the past 12 months. We don't allow advertising networks on Recoatly.

Mobile numbers and text messaging

We do not share mobile phone numbers or SMS consent with third parties or affiliates for marketing or promotional purposes. Mobile numbers are shared only with the providers that deliver text messages, and only to deliver them. Text messaging opt-in data and consent are not shared with any third party for any other purpose.

Recoatly is hosted in the United States. If you are outside the United States, your information — and the Customer Data a business stores in Recoatly — is transferred to, stored and processed in the United States, where privacy laws may differ from those where you live. Some of our service providers process information in other places, as listed on our Subprocessors page.

• United Kingdom and European Union, including Ireland. Where the law requires it, we protect transfers with the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, which are part of our Data Processing Addendum and our contracts with service providers.
• Canada. We use contracts and other measures to give information a comparable level of protection while it is processed outside Canada. Information processed in another country may be accessible to the courts, law enforcement and national security authorities of that country.
• Australia. Personal information may be disclosed to recipients in the United States and, if we use website analytics, the European Union. We take reasonable steps, including contractual commitments, so that overseas recipients handle it consistently with the Australian Privacy Principles.
• New Zealand. We use contractual commitments so that personal information disclosed overseas is protected in a way comparable to the Privacy Act 2020.

• Account information: for as long as you have an account. When an account is deleted, we remove it from our live database within 30 days and from our backups within 90 days.
• Customer Data: for as long as the business keeps it in Recoatly, and in line with the business's instructions. When a company account is deleted, its Customer Data is removed from our live database within 30 days and from our backups within 90 days. A company account that has had no active subscription for 12 months may be deleted after at least 30 days' notice to its owners.
• Location history: no more than 14 days, and deleted at once when a technician switches sharing off.
• Sign-in sessions and links: sessions last up to 30 days and customer-portal sign-in links up to 14 days; password-reset links expire after one hour, email-confirmation links after seven days and invitations after 14 days.
• Billing records: for as long as tax and accounting laws require, typically up to seven years.
• Support requests: for as long as we need them to help you and to keep a record of our support history.
• Server logs: for a short period for security and troubleshooting, normally no more than 30 days.
• Unsubscribe and bounce records: a minimal record of email addresses that unsubscribed, bounced or reported spam, kept so that we can keep honoring those choices.

We may keep information for longer where the law requires it or to resolve a dispute, and we may keep statistics that have been aggregated so that they no longer identify anyone.

We protect information with measures that include HTTPS encryption in transit, passwords stored only as scrypt hashes, isolation of each company's data, role-based permissions, rate limiting, audit logs and encrypted backups. No system is perfectly secure, but we work hard to protect your information, and we will tell affected businesses without undue delay if a personal data breach affects their data. Our Security page explains more.

Wherever you live, you can ask us for a copy of the personal information we hold about you as a controller, and ask us to correct or delete it. You can unsubscribe from our marketing emails at any time using the link in each email. You can update much of your account information yourself in Recoatly; for anything else, contact us through the contact page at https://recoatly.com/contact. We will confirm your identity before acting on a request, respond within the time the law requires, and won't treat you differently for exercising your rights.

If your request is about Customer Data — for example, because you are a customer of a business that uses Recoatly — we will refer it to that business, because it controls that information, and help it respond.

United Kingdom, Ireland and the European Union

Under the UK GDPR and the EU GDPR, you have the right to access your personal information; to have it corrected or erased; to restrict or object to how we use it, including an absolute right to object to direct marketing; to receive it in a portable format; and to withdraw consent at any time where we rely on consent. You can also complain to a supervisory authority: in the United Kingdom, the Information Commissioner's Office (ico.org.uk); in Ireland, the Data Protection Commission (dataprotection.ie). We would appreciate the chance to deal with your concern first.

United States

Depending on where you live — for example, in California — you may have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of the sale or sharing of personal information and of targeted advertising (we do neither); and not to be discriminated against for using these rights. You can use an authorized agent, and if we decline your request, you can appeal by replying to our decision. We treat a Global Privacy Control signal as a request to opt out of sale and sharing.

In the past 12 months, we have collected these categories of personal information as a controller: identifiers, such as name, email address and IP address; commercial information, such as subscription and billing history; internet or other electronic network activity, such as how you use Recoatly; professional information, such as your company and role; and the contents of messages you send us. The sources, purposes, recipients and retention periods are described above. We use sensitive personal information, such as your account password, only for purposes the law permits, such as signing you in securely.

Canada

Under PIPEDA and provincial privacy laws, you can ask to access and correct the personal information we hold about you, and withdraw your consent, subject to legal and contractual limits. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial privacy regulator, such as the Commission d'accès à l'information du Québec.

Australia

Under the Privacy Act 1988 and the Australian Privacy Principles, you can ask to access and correct your personal information. If you have a complaint about how we have handled it, contact us first and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand

Under the Privacy Act 2020, you can ask to access and correct your personal information. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

Recoatly is a business tool for adults. It is not directed to children, and we don't knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it. Businesses are responsible for any information about children that they choose to store in Recoatly.

We use only the cookies needed to keep people signed in to Recoatly or to a business's customer portal, plus a setting in your browser that remembers whether you prefer light or dark appearance. We don't use advertising or tracking cookies. If we use Plausible Analytics on our website, it works without cookies. Our Cookie Notice has the details.

Some parts of Recoatly take you to services run by other companies — for example, Stripe's payment pages when you subscribe or when a customer pays an invoice, or a review site that a business asks you to post on. Their own privacy policies apply there. When the measuring tool shows aerial imagery, your browser loads it directly from the U.S. Geological Survey's National Map, which receives your IP address and the map area you are viewing.

We will post any changes on this page and update the "last updated" date. If a change is significant, we will tell account owners by email or in Recoatly at least 30 days before it takes effect, unless we must make it sooner for legal reasons.

For privacy questions or requests, contact us through the contact page at https://recoatly.com/contact.