Privacy Policy

2.1 Personal Information

We collect the following personal information:

2.2 Location Data

We collect location information when you:

• Use our mapping and measurement tools
• Enable location services for job site tracking
• Provide addresses for client locations
• Use GPS features for route optimization

2.3 Measurement and Calculation Data

When you use our measurement and calculation tools, we collect and process:

• Satellite imagery measurement data (property boundaries, area calculations, distance estimates)
• Augmented reality (AR) camera measurement data from mobile devices
• Chemical calculator inputs and outputs (chemical types, mixture ratios, dilution rates, application volumes)
• Measurement history and saved calculations

2.4 File and Media Data

We store and process:

• Photos and images uploaded for job documentation
• Receipts and expense documentation
• Business documents and contracts
• Audio recordings (if enabled for voice notes)

2.5 Communication Data

We process:

• Email communications sent through our platform
• SMS messages sent to clients
• Internal team communications
• Customer support interactions

3.1 Information You Provide

• Account registration and profile setup
• Data entry through our application forms
• File uploads and document submissions
• Communication through our platform

3.2 Information Collected Automatically

• Usage analytics and performance metrics
• System logs and error reports
• Device and browser information
• Location data (with your consent)

3.3 Information from Third Parties

• Payment processors (Stripe)
• Authentication providers (Supabase)
• Mapping services (Google Maps)
• Communication services (Twilio, SendGrid)

4.1 Data Storage

Your data is stored securely using industry-standard practices:

• Primary Storage: Data is stored in secure, encrypted databases hosted by Supabase (PostgreSQL) with AES-256 encryption at rest
• File Storage: Documents, images, and media files are stored in encrypted cloud storage with access controls
• Backup Systems: Regular automated backups are performed to ensure data availability and recovery
• Geographic Location: Data is primarily stored in United States data centers, with backups in redundant locations
• Data Replication: Critical data is replicated across multiple data centers for high availability

4.2 Data Retention

We retain your data for the following periods:

• Active Accounts: Data is retained for as long as your account is active and for 30 days after account closure
• Financial Records: Payment and transaction data is retained for 7 years as required by tax and accounting regulations
• Legal Requirements: Some data may be retained longer if required by law or for legitimate business purposes
• Deleted Data: Upon account deletion, data is permanently deleted within 30 days, except where legal retention requirements apply

5.1 Payment Processing

All payment processing is handled by Stripe, a PCI-DSS Level 1 certified payment processor. We do not store your full credit card information on our servers.

• Payment Data Collection: When you make a payment, Stripe collects and processes your payment information (credit card number, billing address, etc.)
• Data Sharing: We share necessary payment information with Stripe to process transactions, including transaction amounts, customer identifiers, and billing information
• Security: All payment data is encrypted in transit (TLS 1.3) and processed according to PCI-DSS standards
• Tokenization: Stripe uses tokenization to securely store payment methods without exposing sensitive card details

5.2 Payment Fees

The following fees apply to payment processing:

5.3 Payment Data Privacy

Your payment information is handled according to Stripe's privacy policy and security standards. We only receive:

• Payment confirmation and transaction status
• Billing address and contact information
• Last 4 digits of payment methods (for display purposes)
• Payment method type (card, ACH, etc.)

We do not have access to your full credit card number, CVV, or other sensitive payment authentication data.

5.4 Apple In-App Purchases

When you subscribe to Prosperia CRM through the Apple App Store, your subscription is processed by Apple. In connection with Apple In-App Purchases, we collect and store:

• Transaction Identifiers: Apple transaction ID and original transaction ID to verify and track your subscription
• Product Information: The subscription product purchased (e.g., paid plan, employee seat add-on)
• Receipt Data: Apple purchase receipts for server-side verification of subscription validity
• Subscription Status: Whether your subscription is active, expired, in a billing retry period, or in a grace period
• Renewal Information: Expiration dates, renewal status, and whether auto-renewal is enabled

We do not receive or store your Apple ID credentials, Apple Pay payment details, or credit card information used for App Store purchases. Apple handles all payment processing for in-app subscriptions according to their own privacy policy. For more information, see Apple's Privacy Policy.

Apple may send us server-to-server notifications about subscription lifecycle events (renewals, cancellations, billing issues). These notifications contain only transaction and subscription status data — no personal payment information.

6.1 Service Provision

We use your information to:

• Provide and maintain our CRM services
• Process payments and manage subscriptions
• Enable communication with clients and team members
• Generate reports and business insights
• Provide customer support

6.2 Business Operations

We use your information to:

• Improve our services and develop new features
• Analyze usage patterns and optimize performance
• Ensure security and prevent fraud
• Comply with legal obligations
• Communicate important updates and changes

6.3 AI and Automation

We use your data to:

• Provide AI-powered business insights
• Enable automated workflows and notifications
• Improve service recommendations
• Generate predictive analytics

7.1 Consent Collection

We obtain your explicit consent for data processing activities that require it, including:

• Account creation and service usage (collected via checkbox during signup)
• Privacy Policy and Terms of Service acceptance (tracked with timestamps and IP addresses)
• Marketing communications (opt-in required)
• Location data collection (permission requested when needed)
• Non-essential cookies and tracking (managed via cookie consent banner)

7.2 Consent Withdrawal

You can withdraw your consent at any time by:

• Updating your account preferences in Settings
• Unsubscribing from marketing emails using the link in any email
• Disabling location services in your device or browser settings
• Managing cookie preferences through our cookie consent tool
• Contacting us at privacy@prosperiacrm.com

Note: Withdrawing consent for essential services may limit your ability to use certain features of our platform.

7.3 Consent Records

We maintain records of your consent, including when it was given, the method of consent, and any withdrawals. These records are kept for compliance purposes and to demonstrate our commitment to privacy regulations.

7.4 AI Data Processing Consent

Before using any AI-powered features (including Prosperia AI assistant and Price Assist), you must explicitly consent to AI data processing through an in-app consent modal. This consent is separate from your general Privacy Policy acceptance and covers the specific data processing described in Section 6.3.

The consent modal will:

• Appear the first time you attempt to use an AI feature
• Clearly disclose what data is sent, the AI provider, and data retention practices
• Require explicit action (clicking "I Understand and Accept") to proceed
• Not appear again once accepted, unless the consent version is updated

Withdrawing AI consent: You can withdraw your AI data processing consent at any time by emailing privacy@prosperiacrm.com. Withdrawing consent will prevent you from using AI features but will not affect your access to other platform functionality. Previously processed data will be handled according to our standard retention policies.

9.1 Third-Party Service Providers

We share information with trusted third parties who assist us in operating our service:

9.2 Legal Requirements

We may disclose information when required by:

• Court orders or legal process
• Government investigations
• Law enforcement requests
• Regulatory compliance requirements

10.1 Technical Safeguards

We implement comprehensive security measures:

• Encryption of data in transit (TLS 1.3)
• Encryption of data at rest (AES-256)
• Regular security audits and penetration testing
• Multi-factor authentication for administrative access
• Network security and intrusion detection

10.2 Organizational Safeguards

• Employee training on data protection
• Access controls and role-based permissions
• Regular security assessments
• Incident response procedures
• Data breach notification protocols

11.1 Access and Portability

You have the right to:

• Access your personal information
• Receive a copy of your data in a portable format
• Request correction of inaccurate information
• Update your account information

11.2 Deletion and Restriction

You may request:

• Deletion of your personal information
• Restriction of processing in certain circumstances
• Objection to processing based on legitimate interests

11.3 Communication Preferences

You can:

• Unsubscribe from marketing emails
• Opt out of SMS notifications
• Control cookie preferences
• Manage notification settings

11.4 Exercising Your Rights

To exercise your rights, contact us at privacy@prosperiacrm.com with your account information, specific request details, and verification of your identity. You can also submit a request directly through our Privacy Rights Center.

12.1 Types of Cookies

We use several types of cookies:

12.2 Cookie Management

You can control cookies through your browser settings and preferences, our cookie consent banner, and third-party opt-out tools.

16.1 SMS Communications

Our platform enables contractors to send SMS messages to their customers for:

• Appointment confirmations and reminders
• Job status updates and arrival notifications
• Invoice delivery and payment reminders
• Service-related communications

16.2 Phone Number Collection and Consent

When a contractor's customer receives their first estimate or service request:

• The customer provides their phone number voluntarily
• The customer must actively check a box to consent to SMS communications
• Consent is specific to receiving messages from that contractor via ProsperiaCRM
• The customer can see examples of message types they'll receive
• No mobile information will be shared with third parties/affiliates for marketing/promotional purposes

16.3 SMS Opt-In Process

Customers receive an initial opt-in confirmation message stating:

• Who they're receiving messages from (contractor's business name)
• What types of messages they'll receive
• How to get help (reply HELP)
• How to stop messages (reply STOP)
• That message and data rates may apply
• Message frequency varies

16.4 SMS Opt-Out Rights

Customers can opt-out of SMS messages at any time by:

• Replying STOP to any message
• Contacting the contractor directly
• Replying with any standard opt-out keyword (STOP, CANCEL, UNSUBSCRIBE, END, QUIT, STOPALL)

Upon opting out, customers will receive one final confirmation message and will not receive further SMS communications unless they opt-in again.

16.5 SMS Data Processing

• SMS messages are processed through Twilio, our third-party messaging service provider
• Message content and delivery logs are stored for service quality and compliance
• SMS data is retained for 12 months or as required by law
• No mobile information will be shared with third parties/affiliates for marketing/promotional purposes
• Customers can request deletion of their SMS data by contacting privacy@prosperiacrm.com

16.6 SMS Compliance

We comply with:

• Telephone Consumer Protection Act (TCPA)
• CAN-SPAM Act requirements
• CTIA Messaging Principles and Best Practices
• Carrier-specific messaging guidelines
• Twilio's Acceptable Use Policy

16.7 Customer Rights Regarding SMS Data

Customers whose contractors use our platform have the right to:

• Access logs of SMS messages sent to their phone number
• Request deletion of their phone number and message history
• Opt-out of SMS communications at any time
• File complaints about SMS practices by contacting privacy@prosperiacrm.com