Privacy Policy

Company: SepticStream ("we", "us") Effective date: July 13, 2026

1. Scope

This policy explains how we handle personal information for SepticStream (the "Service"). For data our business customers put into the Service about *their* own customers, we act as a processor on their behalf (see our Data Processing Addendum); they are the controller.

2. Information we collect

four digits / tokens, not full card numbers.

names, addresses, phone numbers, job/inspection/invoice history).

  • Account data: name, business name, email, phone, role.
  • Billing data: processed by Stripe; we store subscription status and the last
  • Customer Data: records our business customers enter (their customers'
  • Usage & device data: logs, IP address, timestamps, and error diagnostics.

3. How we use it

To provide, secure, support, and improve the Service; process payments; send service and transactional messages; and comply with law.

4. SMS / text messaging

We send SMS through Twilio on behalf of our business customers (appointment confirmations, dispatch/ETA notices, invoice notices). Consent is collected by the business before messaging; recipients can opt out anytime by replying STOP and get help by replying HELP.

**We do not sell or share opt-in data, mobile numbers, or SMS consent with third
parties for their own marketing.** Phone numbers are used only to deliver the
messages described above.

5. How we share

Only with: (a) sub-processors that run the Service (e.g., Supabase/hosting, Stripe for payments, Twilio for SMS) under contract; (b) as required by law; or (c) in a business transfer. We do not sell personal information.

6. Retention

We keep data while your account is active and as needed for legal/operational reasons. On account closure, data may be exported for 30 days then deleted.

7. Security

Encryption in transit, tenant data isolation, access controls, and least-privilege credentials. No method is 100% secure, but we work to protect your data.

8. Your rights

Depending on your location (e.g., GDPR/CCPA), you may request access, correction, deletion, or export of your personal information. Business customers can export or delete their workspace in-app or by contacting us. Requests: briansmith364@gmail.com. (Where we act as a processor, we route end-user requests to the relevant business customer.)

9. International

The Service is operated from the United States. If you access it from outside the US, you consent to your information being processed in the US.

10. Children

The Service is for businesses and not directed to children under 16.

11. Changes

We may update this policy; material changes will be notified.

12. Contact

briansmith364@gmail.com