PRIVACY
TurfIQ Privacy Policy
This Privacy Policy explains how Geointel Advantage ("Geointel Advantage", "we", "us" or "our") collects, uses, shares and protects personal information in connection with TurfIQ. TurfIQ includes the office web app, the TurfIQ crew app for iPhone, customer quote pages, and the website at turfiq.geointeladvantage.com (together, the "Service").
1. Our two roles
1.1. When we handle information about the businesses that use TurfIQ and their team members (for example, account sign-up, logins, billing and support), we decide how and why it is used. For this information we are the "controller" (or "business" under California law).
1.2. Businesses that use TurfIQ also store information about their own customers in it, such as homeowners who ask for a quote. For that information, the turf business is in charge and we act on its behalf and on its instructions, as a "processor" or "service provider". If you are a homeowner or other customer of a business that uses TurfIQ, the business's own privacy notice applies to you, and you should send privacy requests to that business. If you contact us, we will pass your request to the business where we can.
2. Information we collect
2.1. Account and business information. Business name, website, workspace name, and the name, email address, phone number and password of the person who signs up. We store passwords only as secure one-way hashes.
2.2. Team member information. Names, email addresses, roles and permissions of people invited to an account, their login and session records, and multi-factor authentication settings.
2.3. Billing information. Subscription plan, seat count, billing contact, billing address, tax details and payment history. Stripe collects card and bank details directly. We receive only limited information, such as card brand, last four digits and expiry date. We never store full card numbers.
2.4. Customer Data that a business enters or receives. Information about the business's customers and jobs, such as names, phone numbers, email addresses, property addresses, property and lawn measurements and drawings, photos of the property and the installed work, notes, quotes, quote acceptances (including the name typed to accept), invoices, deposits and payment records, schedules and crew assignments.
2.5. Crew app information. When a crew member uses the iPhone app and allows it:
- Camera and augmented reality. The camera and motion sensors are used to measure lawn areas and to take install photos. Camera images used for live measurement are processed on the phone. We store only the measurements and the photos that the crew member chooses to save.
- Location. The phone's location is used while measuring or recording a site visit, to match the measurement to the property and to record where photos were taken. We do not track crew members in the background.
- Photos may contain location and time information (metadata).
2.6. Information from homeowners using a quote link. When someone opens a quote link and accepts it, we record the acceptance, the name they typed, the time, and technical information such as a one-way fingerprint of their network address, used to prevent abuse.
2.7. Technical and usage information. IP address, browser and device type, app version, pages and features used, error reports, and security logs. We use this to run, secure and improve the Service.
2.8. Communications. Messages you send us, such as support requests, demo requests and feedback.
2.9. Website. If you fill in a form on our website, we collect the details you enter. Our website does not use advertising or third-party analytics cookies.
3. How we use information
We use personal information to:
- provide the Service, including creating accounts, storing and showing data, sending quotes and invoices on a business's behalf, and processing payments through Stripe;
- secure the Service, including logins, multi-factor authentication, preventing fraud, spam and abuse, and investigating security events;
- bill for subscriptions and manage trials;
- send service messages, such as sign-up confirmation, password resets, security alerts, billing notices and changes to our terms;
- give support and answer questions;
- understand how the Service is used and improve it, using de-identified or aggregated data where we can;
- send product news to business account contacts, only where the law allows. You can opt out at any time with the link in the email. We never send marketing to a business's customers; and
- meet legal obligations, enforce our terms, and defend legal claims.
We use Customer Data only to provide the Service to the business, as described in our Terms of Service and the business's instructions.
4. Legal bases (EEA, UK and Switzerland)
TurfIQ is offered to businesses in the United States. If data protection laws of the European Economic Area, the United Kingdom or Switzerland apply, we rely on these legal bases for the information we control: performance of our contract with the business; our legitimate interests in running, securing and improving the Service, preventing fraud and communicating with business contacts; compliance with legal obligations; and consent, where we ask for it (you can withdraw consent at any time).
5. How we share information
We do not sell personal information. We do not "share" personal information for cross-context behavioral advertising, and we do not use it for targeted advertising.
We share personal information only:
- with the turf business that controls it. For example, a quote acceptance is shared with the business that sent the quote;
- with our service providers (subprocessors), who process it for us under contracts that require them to protect it and use it only to provide their services (see section 6);
- with Stripe, when a business subscribes or takes payments. Stripe uses information under its own privacy policy for payment processing, fraud prevention and legal compliance;
- when the law requires it, or to protect the rights, safety or property of people, our users or us, after reviewing whether the request is valid;
- in connection with a merger, acquisition, financing or sale of assets, under confidentiality terms. We will tell affected businesses before their information becomes subject to a different privacy policy; and
- with consent or at the direction of the business.
6. Service providers (subprocessors)
We currently use these kinds of providers:
- Hosting: a virtual private server provider in the United States, which hosts our application servers, database and stored files.
- Network and security: Cloudflare, Inc., which provides DNS, content delivery, encryption in transit and protection against attacks. Traffic to the Service passes through Cloudflare.
- Payments: Stripe, Inc., for subscription billing and for payments that businesses collect from their customers through Stripe Connect.
- Email delivery: a transactional email provider, which sends account, security, quote and invoice emails.
- Apple, for distributing the iPhone app through the App Store and TestFlight.
You can ask for the current list of named subprocessors at [email protected]. We will give businesses notice of a new subprocessor that processes Customer Data before it starts, where a signed data processing agreement requires it.
7. How long we keep information
7.1. We keep account and Customer Data while the business's account is active or read-only.
7.2. After a subscription ends or an account is closed, the account stays read-only for 30 days so that the business can export its data. We then delete or de-identify Customer Data within 90 days, unless the law requires us to keep it longer.
7.3. Backups are encrypted and overwritten on a regular schedule. Deleted data can remain in backups until they are overwritten.
7.4. We keep billing and tax records, and records of terms accepted, for as long as tax and other laws require (generally up to 7 years). Security logs are kept for up to 12 months. We keep information longer if it is needed for a legal claim or investigation.
8. Security
We protect personal information with measures that include encryption in transit (HTTPS), encryption of backups and sensitive secrets, hashed passwords, multi-factor authentication, separation of each business's data in the database, role-based access, and logging of administrative access. No system is perfectly secure. If we learn of a breach that affects your personal information, we will notify you and the authorities as the law requires.
9. Your rights and choices
9.1. Depending on where you live, you may have the right to: know what personal information we hold about you and get a copy of it; correct it; delete it; get it in a portable format; opt out of the sale of personal information, sharing for targeted advertising, and certain profiling (we do not do these things); and withdraw consent.
9.2. Business users can see and change most of their information in the app, and an account owner can export the business's data at any time.
9.3. To make a request, email [email protected] from the address linked to your account or tell us how to contact you. We will confirm your identity before we act. You may use an authorized agent; we may ask for proof that the agent has your permission. We will respond within 45 days. If we need more time (up to another 45 days), we will tell you why.
9.4. We will not discriminate against you for using your privacy rights.
9.5. California residents. Under the California Consumer Privacy Act, as amended, you have the rights above. In the past 12 months, we collected the categories of personal information described in section 2: identifiers, customer records, commercial information, internet and network activity, geolocation information, audio or visual information (photos), and professional information. We collected them from you, from the business you work for or buy from, and from your devices, for the purposes in section 3. We disclosed them for business purposes to the recipients in sections 5 and 6. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that require an opt-out right. Business account passwords are used only to authenticate you.
9.6. Texas residents. Under the Texas Data Privacy and Security Act, you have the right to confirm whether we process your personal data, to access, correct and delete it, to get a portable copy, and to opt out of targeted advertising, sale and certain profiling. We do not sell personal data, including sensitive personal data, and we do not process it for targeted advertising. If we refuse your request, you can appeal by replying to our decision or emailing [email protected] with "Appeal" in the subject line. We will answer your appeal within 60 days. If you are not satisfied, you can contact the Texas Attorney General at https://www.texasattorneygeneral.gov/consumer-protection.
9.7. Other states. Residents of other states with privacy laws can make the same requests in the same way.
9.8. Homeowners and other customers of turf businesses should send requests to the business. We will help the business respond.
10. Children
The Service is for businesses. It is not meant for anyone under 18, and we do not knowingly collect personal information from children under 13. If you think a child has given us personal information, contact [email protected] and we will delete it.
11. International transfers
We store and process information in the United States. If you use the Service from outside the United States, your information is transferred to and processed in the United States, where privacy laws may be different from those in your country. Where the law requires it, we use appropriate safeguards, such as standard contractual clauses.
12. Cookies and similar technology
12.1. We use only cookies and browser storage that the Service needs to work. These keep you signed in, protect forms against cross-site request forgery, remember your settings, and keep the app working offline on crew devices.
12.2. We do not use advertising cookies or third-party analytics. Cloudflare may set strictly necessary cookies to protect the Service from attacks.
12.3. You can block or delete cookies in your browser, but the Service will not let you sign in without them. We do not respond to "Do Not Track" signals because we do not track you across other sites. We honor Global Privacy Control signals as a request to opt out of sale and sharing, which we already do not do.
13. Mobile app permissions
The iPhone app asks before it uses the camera, location or photo library. You can change these permissions at any time in the phone's Settings. If you turn off a permission, the features that need it will not work.
14. Changes to this policy
We may update this policy. Each version has a version number and date. If we make a material change, we will tell business account owners by email or in the app before it takes effect.
15. Contact
Geointel Advantage
Privacy questions and requests: [email protected]
Legal notices: [email protected]
Website: https://turfiq.geointeladvantage.com