Privacy Policy

This Privacy Policy explains how EaveHQ collects, uses, shares, retains, and protects information when people use EaveHQ's websites, contractor account tools, client portal pages, estimate workflows, payment workflows, emails, support, and related services (collectively, the “Services”).

This Privacy Policy applies to:

• contractors and their authorized users;
• homeowners or clients who receive or access quotes, invoices, payment links, or portal pages through EaveHQ;
• website visitors;
• people who contact EaveHQ for support, sales, feedback, or privacy requests.

1. EaveHQ's privacy role

EaveHQ is a B2B software provider for contractors. In some contexts, EaveHQ decides how information is used, such as for contractor accounts, billing, subscriptions, support, analytics, security, marketing, legal compliance, and product operations. In other contexts, EaveHQ processes homeowner/client/job data on behalf of the contractor that submitted or generated the data through the Services.

Contractors are responsible for their own customer relationships, privacy notices, legal bases, permissions, and consents for collecting homeowner/client information and submitting it to EaveHQ. If you are a homeowner or client and your information was provided to EaveHQ by a contractor, some privacy requests may need to be handled by or coordinated with that contractor.

2. Information EaveHQ collects

EaveHQ may collect the following categories of information.

Contractor account and business information

• name, email address, phone number, login/authentication information, role, permissions, and account settings;
• company name, logo, business address, service area, brand settings, pricing settings, proposal settings, and contractor profile information;
• subscription status, plan, billing history, invoices, support history, and account activity.

Homeowner/client and job information

Contractors may enter or upload information about homeowners, clients, properties, jobs, estimates, proposals, and invoices, including:

• names, email addresses, phone numbers, property addresses, and contact details;
• job notes, customer-visible notes, private contractor notes, project status, schedule information, photos, files, attachments, imported CSV/job history data, and communications;
• estimate options, line items, pricing, deposits, balances, materials, measurements, roofline traces, proposal details, invoice details, and portal activity.

Property, imagery, and estimate data

EaveHQ may process property addresses, satellite/map imagery-related data, roofline traces, measurements, estimate calculations, pricing settings, and proposal outputs used to provide estimating and quote workflows.

Payment and Stripe information

EaveHQ uses Stripe and/or other payment processors. EaveHQ does not store raw card numbers, CVV codes, or bank credentials. EaveHQ may collect or receive payment-related metadata, such as:

• Stripe customer IDs, subscription IDs, connected-account IDs, checkout-session IDs, invoice IDs, payment intent IDs, charge IDs, refund IDs, dispute IDs, payout status, subscription status, payment status, payment history, refund/dispute metadata, and transaction metadata;
• card brand, last four digits, expiration month/year, or similar non-sensitive payment details if provided by Stripe;
• connected-account status, onboarding status, capability status, KYC/business verification status, payout/transfer metadata, and payment-risk metadata depending on the Stripe Connect implementation.

Contractors may provide identity, tax, banking, and business verification information directly to Stripe when using Stripe Connect Express. Stripe's terms and privacy policy apply to Stripe's processing.

Device, log, usage, and security information

EaveHQ may collect IP address, device type, browser type, operating system, pages/features used, referring URLs, timestamps, session data, authentication events, error logs, diagnostic logs, security logs, and similar technical information.

Cookies and similar technologies

EaveHQ may use cookies, local storage, pixels, SDKs, or similar technologies for authentication, security, remembering settings, analytics, debugging, and product operations. If EaveHQ later uses advertising pixels or cross-context behavioral advertising, EaveHQ will update this policy and provide legally required notices and choices before use.

Communications and support information

EaveHQ may collect support messages, bug reports, screenshots, attachments, feedback, sales inquiries, emails, email delivery events, email open/click events where enabled, and marketing preferences.

Information from third parties

EaveHQ may receive information from contractors, homeowners/clients, Stripe, authentication providers, email providers, mapping/imagery/geocoding providers, analytics/error-logging tools, support tools, and other service providers.

3. How EaveHQ uses information

EaveHQ may use information to:

• provide, operate, maintain, secure, and improve the Services;
• create and manage contractor accounts;
• authenticate users and manage permissions;
• generate, store, display, send, and manage estimates, roofline traces, proposals, invoices, client portals, and job records;
• process contractor subscriptions and payment workflows through Stripe or another Payment Processor;
• support Stripe Connect onboarding, payment status, payout status, refunds, disputes, and related payment operations;
• send transactional emails, quote links, portal invitations, payment confirmations, final-payment requests, follow-ups, account notices, security notices, and support messages;
• provide customer support and troubleshoot issues;
• process imports, exports, deletion requests, and account settings;
• analyze usage, diagnose errors, improve reliability, and prioritize product improvements;
• detect, prevent, and respond to fraud, abuse, spam, security incidents, unauthorized access, payment risk, and policy violations;
• enforce Terms of Service and other policies;
• comply with legal, tax, accounting, regulatory, audit, and contractual obligations;
• send marketing or product updates where permitted, subject to opt-out rights.

4. How EaveHQ shares information

EaveHQ may share information as described below.

With contractors and authorized users

Information in a contractor account may be available to the contractor and its authorized users. Homeowner/client portal activity, estimate selections, payment status, contact information, and project information may be visible to the contractor that sent the portal or payment link.

With homeowners or clients

Information may be displayed to homeowners or clients through portal pages, quote links, invoices, payment pages, or emails sent by or on behalf of the contractor. This may include contractor business information, estimate options, pricing, project notes intended for the client, invoice details, and payment status.

With service providers and subprocessors

EaveHQ may share information with service providers needed to run the Services, such as:

• Supabase for database, backend, authentication, storage, and related infrastructure;
• Vercel for hosting, deployment, CDN, and web infrastructure;
• Stripe for subscriptions, Stripe Connect, payment processing, fraud/risk review, connected-account onboarding, refunds, disputes, payouts, and payment metadata;
• Resend or another email provider for transactional and product emails;
• mapping, satellite imagery, geocoding, or address providers used in estimate workflows;
• analytics, error-logging, monitoring, security, support, and customer communication tools;
• professional advisors, such as attorneys, accountants, tax advisors, auditors, and insurers.

These providers may process information on EaveHQ's behalf or as independent providers depending on the service and applicable law.

With Stripe and payment processors

Payment information and payment metadata may be shared with Stripe or another Payment Processor to process payments, subscriptions, refunds, disputes, chargebacks, payouts, connected-account onboarding, risk review, compliance, and related payment operations.

For legal, safety, and compliance reasons

EaveHQ may disclose information if we believe disclosure is reasonably necessary to comply with law, legal process, regulation, subpoena, court order, tax/accounting requirement, payment-network rule, or government request; to enforce Terms; to protect rights, privacy, safety, or property; to detect or prevent fraud, abuse, or security issues; or to respond to disputes.

Business transfers

If EaveHQ is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, information may be disclosed or transferred as part of that transaction, subject to appropriate protections.

With consent or direction

EaveHQ may share information with other parties when a user, contractor, or homeowner directs us to do so or gives consent.

5. No sale of personal information

EaveHQ does not sell homeowner/client personal information as a business model. As of the last updated date above, EaveHQ does not share personal information for cross-context behavioral advertising.

If EaveHQ changes this posture, EaveHQ will update this Privacy Policy and provide legally required notices and choices before doing so.

6. Cookies, analytics, and email tracking

EaveHQ may use essential cookies and similar technologies for login, account security, session management, preferences, and app functionality. EaveHQ may also use analytics, diagnostic, and error-logging tools to understand usage and improve reliability.

Some emails may include delivery, open, or click tracking where enabled. Contractors are responsible for making sure their own use of EaveHQ communications complies with applicable email, privacy, and customer-communication laws.

You can use browser settings to control certain cookies. Disabling some cookies may affect login or functionality.

7. Browser privacy signals

As of the last updated date above, EaveHQ does not sell personal information or share personal information for cross-context behavioral advertising. Because EaveHQ does not currently engage in those activities, EaveHQ does not currently respond to browser “Do Not Track” signals in a separate way. If legally required opt-out signals such as Global Privacy Control become applicable to EaveHQ's practices, EaveHQ will update its process and disclosures.

8. Marketing choices and communications

You may unsubscribe from EaveHQ marketing emails using the link or instructions in the email or by contacting EaveHQ. Even if you opt out of marketing, EaveHQ may still send transactional or service-related messages, such as account notices, security alerts, billing notices, quote/portal emails, payment receipts, support messages, and policy updates.

If a contractor uses EaveHQ to send communications to homeowners or clients, the contractor is responsible for lawful sender identity, permission, consent, opt-out handling, and message content.

9. Data retention

EaveHQ retains information for as long as reasonably needed to provide the Services, maintain accounts, support users, comply with legal/tax/accounting obligations, resolve disputes, enforce agreements, prevent fraud/abuse, maintain security, preserve backups, and operate the business.

Retention periods may vary by data type, account status, legal requirement, backup cycle, payment/dispute status, and operational need. For example:

• account and billing records may be retained while an account is active and for a reasonable period afterward for legal, tax, accounting, dispute, and fraud-prevention purposes;
• job, estimate, homeowner/client, file, and portal data may be retained while needed for the contractor account and related service workflows;
• payment metadata may be retained as needed for accounting, reconciliation, refund, dispute, chargeback, fraud-prevention, and legal purposes;
• logs and diagnostic data may be retained for security, troubleshooting, and audit purposes;
• backups may retain data for a limited period before being overwritten or deleted according to backup cycles.

Deletion requests may be limited by legal, tax, accounting, security, fraud-prevention, backup, dispute-resolution, or contractor-controlled data obligations.

10. Export, correction, and deletion requests

Contractors may request access, correction, export, or deletion of account data by contacting EaveHQ at [TBD privacy/support email]. Early launch requests may be handled manually.

Homeowners or clients may contact EaveHQ at [TBD privacy/support email], but if the information was provided by a contractor, EaveHQ may need to verify the request and/or coordinate with the contractor that controls the project/customer relationship.

EaveHQ may need to verify identity, account authority, or request authorization before responding. EaveHQ will respond to privacy requests as required by applicable law.

11. State privacy rights

Depending on your location and applicable law, you may have rights to request access, correction, deletion, portability, or to opt out of certain processing. EaveHQ will honor legally required privacy rights requests and may voluntarily respond to other reasonable requests where practical.

EaveHQ does not discriminate against users for exercising applicable privacy rights. If you use an authorized agent, EaveHQ may require proof of authorization and identity verification where allowed by law.

EaveHQ is an early-stage B2B SaaS and may not currently meet the thresholds for every comprehensive state privacy law. If EaveHQ's user base, revenue, data volume, advertising practices, or data-sharing practices change, this policy and operational rights process should be reviewed and updated.

12. Security

EaveHQ uses reasonable administrative, technical, and organizational safeguards designed to protect information, such as managed infrastructure, HTTPS/TLS, access controls, restricted admin access, authentication controls, backups, logging/monitoring, and avoiding raw card storage.

No system is perfectly secure, and EaveHQ cannot guarantee absolute security. Users are responsible for maintaining strong passwords, protecting account credentials, limiting account access to authorized users, and promptly reporting suspected unauthorized access.

EaveHQ will respond to security incidents and provide notices where required by law or applicable agreements.

13. Children's privacy

The Services are not directed to children under 13, and EaveHQ does not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to EaveHQ, contact [TBD privacy/support email] so EaveHQ can review and delete it where required.

Contractors should not upload children's personal information unless it is necessary for a legitimate project purpose and they have all required rights, notices, and consents.

14. International data processing

EaveHQ is intended primarily for users in the United States. Information may be processed in the United States and other locations where EaveHQ or its service providers operate. If EaveHQ begins intentionally serving users outside the United States, this policy and related data-transfer obligations should be reviewed.

15. Third-party links and services

The Services may contain links to third-party websites, services, payment pages, or resources. Third-party privacy practices are governed by their own policies, not this Privacy Policy. For example, Stripe's privacy policy applies to Stripe's processing of payment and connected-account information.

16. Changes to this Privacy Policy

EaveHQ may update this Privacy Policy from time to time. If changes are material, EaveHQ will make reasonable efforts to provide notice, such as by posting the updated policy, updating the effective date, sending an email, or providing in-app notice.

Your continued use of the Services after an updated Privacy Policy becomes effective means the updated policy applies as permitted by law.

17. Contact

Questions or requests about this Privacy Policy should be sent to:

Email: [TBD privacy/support email]
Mailing address: [TBD legal/mailing address]