Privacy Policy Spudmark Effective Date: September 25, 2026 1. WHAT THIS COVERS AND WHO WE MEAN This policy explains what personal information Spudmark collects and how we use it. - "Business Customer" means the company that signs up for Spudmark and its owner/admin. - "Authorized Users" means that Business Customer's crew members who use Spudmark to submit reports. - "End Customers" means the Business Customer's own customers and properties, whose information the Business Customer enters into Spudmark. For End Customer information, Spudmark acts as a service provider processing that data on the Business Customer's behalf -- we are not the party that collected it directly. The Business Customer is responsible for providing any notices and obtaining any permissions required, under applicable law, for the information it collects and uploads about its End Customers, including photos, signatures, and location data. 2. INFORMATION WE COLLECT - Account information: your name, email, authentication credentials, and company details when you sign up. - Crew information: worker names and their sign-in codes. - Customer/property information the Business Customer enters: name, address, phone number, and email address. - Job records: checklist responses, notes, custom-field answers, photos (which may include location and timestamp data captured at the time), and signatures. - Technical information: IP address, browser/device information, and the session cookies used to keep you signed in. We also log the IP address and timestamp when you agree to these terms, to keep a record of consent. 3. HOW WE USE INFORMATION - To operate the service -- store your records, generate reports and PDFs, and let your crew and customers access what they're authorized to see. - To send emails you or your customers are expecting (e.g. a completed-job notification), when that feature is turned on. - To provide customer support and improve the product. - We do not sell your information, and we do not use it for advertising. 4. WHO WE SHARE IT WITH Our current service providers include: - Supabase (database, authentication, file storage) - Vercel (hosting) - Resend (sending emails) We share information with them only as necessary to run Spudmark, under agreements that limit what they can do with it. We may also disclose information if required by law. 5. DATA SEPARATION BETWEEN COMPANIES Each company's data is kept isolated from every other company's data through database-level access controls, so one Spudmark customer cannot see another's records. 6. HOW LONG WE KEEP INFORMATION We keep your information as long as your account is active. If you cancel your account, we'll complete a deletion request within 30 days, except that backup copies may persist temporarily (up to 90 days) until they naturally rotate out -- matching the timeline in our Terms of Service. 7. YOUR RIGHTS Depending on where you live, you may have the right to access, correct, or request deletion of your personal information. If Spudmark is subject to the CCPA, California residents -- including, where applicable, employees and business contacts -- have specific rights under that law. Regardless of whether the CCPA formally applies to us, we'll do our best to honor a reasonable request; we may ask you to verify your identity first. If you are an End Customer or Authorized User and your information was entered into Spudmark by a Business Customer, that Business Customer is primarily responsible for your data and is usually the right party to contact first. If you contact us directly, we'll either fulfill the request or route it to the relevant Business Customer, consistent with our role as their service provider for that information. 8. SECURITY INCIDENTS If we become aware of a security breach that compromises your personal information, we will notify affected Business Customers without unreasonable delay and in accordance with applicable law. 9. CHILDREN'S PRIVACY Spudmark is a business tool and is not directed at, or knowingly used by, children under 13. 10. SECURITY We use industry-standard measures (encrypted connections, access controls) to protect your information, but no system is perfectly secure, and we can't guarantee absolute security. 11. CHANGES TO THIS POLICY We may update this policy from time to time. If we make a material change, we'll notify you before it takes effect. 12. CONTACT Questions about this policy: balaw3@gmail.com.