Privacy Policy

ayrflow ("ayrflow," "we," "us," or "our") operates the ayrflow software-as-a-service platform available at ayrflow.io (the "Service"). This Privacy Policy explains how we collect, use, share, and protect information when you use the Service.

By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

1. Who This Policy Applies To

This policy covers two distinct groups:

• Customers (Account Holders): Contractors, business owners, and their employees who sign up for and use ayrflow to run their business.
• End Users (Customer Data Subjects): The clients, leads, and customers of our Customers, whose information passes through ayrflow because our Customers chose to use ayrflow to manage that information.

If you are an End User and want to exercise privacy rights over your data in ayrflow, the Customer who collected your information is the controller of that data. Contact them directly. ayrflow acts as a data processor on their behalf and will assist them in responding to your request.

---

2. Information We Collect

2.1 Information You Provide to Us

• Account information: Name, email, phone number, business name, business address, password (hashed).
• Billing information: Payment card details (collected and stored by our payment processor, Stripe — we never see your full card number), billing address, tax ID if provided.
• Content you upload: Customer records, leads, quotes, jobs, invoices, photos, plot plans, notes, rate book items, and any other data you import or create in ayrflow.
• Communications: Support requests, feedback, and messages you send us.

2.2 Information We Collect Automatically

• Usage data: Pages visited, features used, clicks, session duration, timestamps, referring URLs.
• Device data: IP address, browser type, operating system, device identifiers, screen resolution.
• Cookies and similar technologies: Session cookies for login, preference cookies, and limited analytics cookies. See Section 9.

2.3 Information from Third-Party Integrations

When you connect ayrflow to a third-party service (Housecall Pro, Jobber, Gmail, Stripe, etc.), we receive data from that service per the permissions you grant during authorization. This may include:

• Customer lists, contacts, addresses
• Quote, estimate, job, invoice, and visit records
• Calendar events and scheduling data
• Email content forwarded to your ayrflow lead address
• Webhook payloads about events in the connected service

We only access data necessary to provide the Service. We do not access data outside the scopes you authorized.

2.4 Information from End Users

When an End User submits a lead form, sends an email to your ayrflow inbox, or otherwise generates data in your ayrflow account, we collect and store that data on your behalf. We do not control what End User data Customers collect.

---

3. How We Use Information

We use information to:

• Provide, maintain, and improve the Service.
• Process transactions and send billing communications.
• Authenticate users and prevent fraud and abuse.
• Provide customer support and respond to inquiries.
• Send service-related announcements (security, billing, feature changes). You cannot opt out of these while you have an active account.
• Send marketing communications, only if you opted in. You can unsubscribe at any time.
• Monitor and analyze trends, usage, and performance.
• Comply with legal obligations, enforce our Terms of Service, and protect our rights.
• Train and improve AI features used in the Service, only on aggregated, de-identified data, or on data you explicitly opt in to share. We do not train third-party AI models on your customer data without your consent.

---

4. How We Share Information

We do not sell your personal information. We do not sell End User data. We share information only as described below.

4.1 Service Providers (Sub-Processors)

We share data with vendors who help us run the Service. Each is contractually bound to protect your data and use it only for the purposes we direct. Current sub-processors include:

We will update this list as sub-processors change. Material changes will be announced in-app or by email.

4.2 Third-Party Integrations You Authorize

When you connect Housecall Pro, Jobber, Gmail, or any other integration, data flows between ayrflow and that service per your authorization. Those services have their own privacy policies that govern their handling of your data.

4.3 Legal Disclosures

We may disclose information if required by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

4.4 Business Transfers

If ayrflow is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred. We will notify you and the acquirer will be bound by this Privacy Policy unless you are given notice and opportunity to delete your data.

4.5 With Your Consent

We share information for any other purpose only with your explicit consent.

---

5. Your Rights

5.1 All Users

You can:

• Access the information we hold about you.
• Correct inaccurate information.
• Delete your account and associated data, subject to legal retention requirements.
• Export your data in a portable format (JSON or CSV).
• Object to certain processing or restrict how we use your data.
• Withdraw consent at any time where processing is based on consent.

Email privacy@ayrflow.io to exercise any right. We will respond within 30 days.

5.2 California Residents (CCPA / CPRA)

California residents have additional rights including:

• Right to know what personal information is collected, used, shared, or sold.
• Right to delete personal information held by us.
• Right to correct inaccurate personal information.
• Right to opt out of "sale" or "sharing" of personal information. ayrflow does not sell personal information.
• Right to limit use of sensitive personal information.
• Right to non-discrimination for exercising rights.

To exercise these rights, email privacy@ayrflow.io or use the privacy controls in your account settings.

5.3 EU / UK / EEA Residents (GDPR / UK GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, you have rights including access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with your local supervisory authority.

The legal basis for our processing is:

• Contract — to provide the Service you signed up for.
• Legitimate interests — to operate, secure, and improve the Service.
• Consent — for optional marketing and AI training where applicable.
• Legal obligation — to comply with applicable laws.

ayrflow is the data controller for Customer account information. ayrflow is a data processor for End User data that Customers upload. International transfers from the EEA/UK to the United States rely on Standard Contractual Clauses where required.

---

6. Data Retention

• Active accounts: We retain your data for as long as your account is active.
• Cancelled accounts: We retain account data for 90 days after cancellation to allow reactivation, then delete or anonymize it, except where longer retention is required by law (e.g., financial records retained 7 years for tax purposes).
• Backups: Encrypted backups are purged on a rolling 35-day cycle.
• Anonymized analytics: May be retained indefinitely in aggregated, non-identifiable form.

You can request immediate deletion at any time by emailing privacy@ayrflow.io.

---

7. Data Security

We use commercially reasonable safeguards including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Hashed passwords (bcrypt or equivalent).
• Role-based access controls and audit logging.
• Tenant isolation via row-level security at the database layer.
• Regular security reviews and dependency monitoring.

No system is 100% secure. If we learn of a security breach affecting your personal information, we will notify you and applicable regulators as required by law. Notification will be sent within 72 hours of discovery where legally required.

---

8. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If we learn we have collected such information, we will delete it. Contact privacy@ayrflow.io if you believe a child has provided us information.

---

9. Cookies and Tracking

We use:

• Strictly necessary cookies — required for login and core functionality. Cannot be disabled.
• Preference cookies — remember your settings (theme, layout).
• Analytics cookies — help us understand usage. Anonymized where possible.

We do not use advertising cookies or third-party ad tracking. You can control cookies through your browser settings, but disabling necessary cookies will prevent the Service from functioning.

We honor Global Privacy Control (GPC) signals as a valid opt-out request for California residents.

---

10. International Users

The Service is hosted in the United States. If you access the Service from outside the US, your information will be transferred to, stored, and processed in the US. By using the Service, you consent to this transfer. We rely on Standard Contractual Clauses for transfers from the EEA, UK, and Switzerland where required.

---

11. Third-Party Links

The Service may contain links to third-party sites. We are not responsible for the privacy practices of those sites. Review their privacy policies before providing them with information.

---

12. Changes to This Policy

We may update this Privacy Policy. Material changes will be notified by email or in-app notice at least 14 days before taking effect. Continued use of the Service after the effective date constitutes acceptance.

---

13. Contact Us

ayrflow Attn: Privacy Colorado Springs, Colorado, USA Email: privacy@ayrflow.io

For EU/UK data subject requests, use the same email and identify your jurisdiction.