Privacy Policy
This pack contains 18 working-draft legal documents. None of them have been reviewed by Texas counsel or counsel licensed in any other jurisdiction. They are a starting point for a real attorney engagement, not a finished publication. Brackets [highlight] indicate custom options to finalize.
This Privacy Policy describes how SiteFlows, LLC collects, uses, shares, and protects personal information through our websites, mobile applications, and services. It applies to Operators, Workers, end-customer data processed through the Service, and visitors to siteflows.ai.
1. Information We Collect
1.1 Information you provide to us
- Account & identity: name, email address, phone number, password.
- Payment information: handled by Stripe; we do not store full card numbers on our systems.
- Worker payout information: last 4 digits of bank account or debit card, tax-residence country (collected via Stripe Connect onboarding).
- Job content: photos, GPS coordinates of job sites, time entries, checklist items, dispute statements.
- Communications: emails, chat transcripts, support requests.
1.2 Information collected automatically
- Device and log data: IP address, browser type, operating system, device identifiers, pages viewed, timestamps.
- Location: precise GPS during active jobs (Worker app, with explicit permission). We do not track Workers off-shift or outside an active job.
- Cookies and similar technologies: see our Cookie Policy.
1.3 Information from third parties
- Stripe and Stripe Connect: identity verification, payout status.
- Identity providers (Apple Sign In, Google Sign In, Clerk): profile name and email.
2. How We Use Information
We use personal information to:
- provide, maintain, and improve the Service;
- process transactions, including Locked Pay escrow and payouts;
- verify identity, prevent fraud, and enforce our Terms and Acceptable Use Policy;
- analyze and verify Proof of Work, including AI-assisted photo verification (see AI Disclosure);
- communicate with you about your account, transactions, security, and product updates;
- comply with legal obligations and enforce our rights.
3. Legal Bases (where applicable)
For users located in jurisdictions requiring a legal basis (e.g., GDPR-protected jurisdictions if reached), we process personal data on the bases of contract performance, our legitimate interests in operating and securing the Service, your consent (where required), and compliance with legal obligations. Where consent is the basis, you may withdraw it at any time without affecting the lawfulness of prior processing.
4. Sharing & Disclosure
We share personal information with:
- Service providers (sub-processors): see the Sub-processor List for the current set, including Stripe, AWS, Postmark, Twilio, PostHog, Anthropic, OpenAI, and Clerk.
- Operators: Worker job records, GPS, photos, and time logs are visible to the Operator who dispatched the job.
- Workers: their own records; they may export their data at any time.
- Legal and safety: we may disclose information to comply with law, valid legal process, or protect the rights, property, or safety of SiteFlows, our users, or the public.
- Corporate transactions: in connection with a merger, acquisition, financing, or sale of assets, with notice to affected users.
We do not sell personal information for money. We do not "share" personal information for cross-context behavioral advertising as defined under CCPA/CPRA. See Section 9.
5. Data Retention
6. Security
We use industry-standard administrative, technical, and physical safeguards: encryption in transit (TLS 1.3) and at rest (AES-256), least-privilege access, audit logging, and routine security reviews. See Trust & Security. No system is perfectly secure; you should use a strong unique password and enable multi-factor authentication.
7. Your Rights
Depending on your jurisdiction, you may have the right to:
- access the personal information we hold about you;
- request correction of inaccurate information;
- request deletion (subject to lawful retention);
- request a portable copy of your data;
- opt out of certain processing, including profiling and targeted advertising (we do not engage in either);
- appeal a denied request through the contact channel below.
To exercise these rights, submit a request through your account, or use in-app data export. We will respond within 45 days (extendable by 45 additional days where permitted).
8. Children
The Service is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If we learn we have collected such information, we will delete it.
9. CCPA/CPRA Notice (California Residents)
California residents have the right to know what personal information we collect, the right to delete, the right to correct, and the right to limit use of sensitive personal information. We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising. See our CCPA · Do Not Sell or Share page for full disclosures and a “Limit the Use of My Sensitive Personal Information” link.
Global Privacy Control (GPC): we honor the GPC signal as an opt-out preference signal under CCPA/CPRA where applicable.
10. International Transfers
The Service is operated from the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data-protection laws may differ from those of your home jurisdiction.
11. Changes to This Policy
We will notify users of material changes by email and via in-Service notification at least 14 days before they take effect.
12. Contact
For privacy questions, requests, or complaints: