Grass Geeks

Grass Geeks — Privacy Policy

⚠️ DRAFT — not legal advice. Reviewed by counsel before publishing.

Effective Date: [Effective Date]

This Privacy Policy explains how [Legal Entity Name] ("Grass Geeks," "we," "us," or "our") collects, uses, shares, and protects information in connection with the Grass Geeks lawn-care marketplace at app.grassgeeks.us (the "Platform").

1. Who We Are

Grass Geeks operates a marketplace connecting residential customers with independent lawn-care crews. This Policy covers information about Customers and Crews who use the Platform.

2. Information We Collect

2.1. Information you provide

  • Identity and contact information: name, email address, phone number.
  • Property information: service address and lot/property details you provide during onboarding (used to quote and schedule service).
  • Payment information: collected and processed by our payment processor (Stripe). We do not receive or store your full card number, expiration, or CVC. We retain limited billing metadata such as the billing ZIP associated with your card and Stripe identifiers needed to manage your subscription.
  • Communications preferences and consent: including your consent to receive SMS about your appointments, captured at checkout.

2.2. Information from Crews (crew accounts)

  • Crew name, business name, email, phone.
  • Certificate of insurance (COI) documents uploaded during onboarding. [verify — confirm what identity/insurance documents crews upload]
  • Stripe Connect identifiers used to pay out completed jobs.

2.3. Information generated through use of the Platform

  • Job photos: Crews take and upload photos of the customer's property to document completed service. These are stored via Supabase Storage.
  • Service and billing records: scheduled and completed jobs, service alerts, change orders, installment/payment history, and cancellation records.
  • Technical/log data: IP address and request metadata, used for security and rate limiting.

2.4. Address autocomplete

When you enter your address during onboarding, we use Mapbox to power address autocomplete. Address input may be transmitted to Mapbox to return suggestions.

3. How We Use Information

We use information to:

  • Provide, operate, schedule, and bill for the marketplace service;
  • Quote pricing and manage your subscription, installments, and one-time charges;
  • Match you with a Crew and enable the Crew to perform and document service;
  • Send transactional communications (see Section 5);
  • Review completed-job photos before releasing crew payouts;
  • Process payments and payouts through Stripe;
  • Maintain security, prevent fraud and abuse, and enforce rate limits;
  • Comply with legal obligations and enforce our Terms.

We do not sell your personal information. [verify — confirm "do not sell/share" posture with counsel under applicable law.]

4. Third-Party Sub-Processors

We share information with the following service providers who process data on our behalf, only as needed to provide the Platform:

Sub-processor Purpose
Stripe Payment processing (customer charges) and crew payouts via Stripe Connect. Handles all payment-card data.
Supabase Authentication, application database, and file storage (including job photos and crew documents).
SendGrid Delivery of transactional email (welcome, receipts, reminders, service updates).
TextMagic Delivery of transactional SMS (appointment reminders) and STOP opt-out handling.
Mapbox Address autocomplete during onboarding.
Vercel Application hosting and delivery.
Upstash (Redis) Rate limiting / abuse prevention (processes IP addresses). [verify — include if disclosing infrastructure sub-processors]

Each sub-processor handles data under its own terms and privacy commitments. We may update this list as our providers change.

5. SMS and Email Communications; Opt-Out

5.1. Email. We send service-related email through SendGrid (e.g., welcome, receipts, appointment reminders, service and payment updates). These are transactional messages tied to your account and service.

5.2. SMS. We send text-message reminders and updates through TextMagic (e.g., day-before appointment reminders). You consent to these messages by providing your phone number at checkout. Message and data rates may apply.

5.3. Opt-out. Reply STOP to any SMS to opt out; opt-outs are honored automatically by our SMS provider on our sending number. Opting out may limit appointment reminders. Because our current messages are transactional, we do not currently operate a separate marketing-email list. [verify — confirm no marketing email/SMS program exists before publishing.]

6. Payment Data

Payment-card data is collected and processed directly by Stripe through Stripe Elements. Grass Geeks does not store your full card number, expiration, or CVC. Stripe processes this data as an independent controller/processor under its own terms and PCI-DSS compliance.

7. Job Photos

Crews upload photos of the customer's property to document completed service. These photos are stored via Supabase Storage and are used to verify work, support administrative review before crew payout, and for customer service and record-keeping. Access is limited to the customer, the assigned crew where applicable, and Grass Geeks administrators. [verify — confirm exact access scope of stored photos.]

8. Cookies and Analytics

8.1. Cookies. We use cookies that are necessary for the Platform to function, including authentication/session cookies set by our authentication provider (Supabase). These keep you signed in and secure your session.

8.2. Analytics. As of the Effective Date, the Platform does not integrate third-party analytics or advertising trackers (e.g., Google Analytics, Meta Pixel, Segment, or similar); no such libraries are present in the application. If we add analytics in the future, we will update this Policy. [verify — re-confirm before each publish that no analytics/advertising SDK has been added.]

9. Data Retention

9.1. We retain personal information for as long as your account is active and as needed to provide the service, comply with legal, tax, and financial-record obligations, resolve disputes, and enforce our agreements.

9.2. Certain financial records (e.g., Stripe records and billing aggregates) are retained as part of our authoritative financial records even after account deletion. See Section 11 for how deletion is handled. [verify — confirm specific retention periods with counsel.]

10. Data Security

10.1. We use administrative and technical safeguards to protect information, including authenticated access, database row-level security, rate limiting, and reliance on established sub-processors (Stripe, Supabase, Vercel) for infrastructure-level protections.

10.2. No method of transmission or storage is completely secure. We cannot guarantee absolute security. [verify — describe breach-notification practices consistent with applicable state law.]

11. Your Rights and Choices

11.1. Access and update. Customers can view and update contact information (name, phone, email) from the account dashboard.

11.2. Customer account deletion. Customers can delete their account from the dashboard. On deletion, we (a) cancel any active subscription, and (b) anonymize the customer's personal information — for example, replacing name with a placeholder, replacing the email with a non-identifying anonymized value, and clearing phone and billing ZIP — while retaining non-identifying records and Stripe identifiers needed for financial record-keeping and referential integrity. The associated login is disabled. This is an anonymization, not a full hard delete of every record.

11.3. Crew account deletion. Crew accounts are removed by an administrator as a soft delete that anonymizes the crew's personal information and disables their login. [verify — crew self-service deletion does not currently exist; only admin-initiated deletion.]

11.4. SMS opt-out. Reply STOP to any SMS (Section 5).

11.5. How to exercise rights. For requests not available in-app, contact us using Section 14. [verify] — confirm the process, identity-verification steps, and response timelines with counsel.

12. Children's Privacy

The Platform is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from children under 13 (or the minimum age in your jurisdiction). If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.

13. State-Specific and International Privacy Rights

[CCPA/GDPR applicability — confirm with counsel.] Grass Geeks currently operates in a limited U.S. service area. Whether the California Consumer Privacy Act (CCPA/CPRA), the EU/UK General Data Protection Regulation (GDPR), or other state privacy laws (e.g., Florida, Virginia, Colorado) apply — and what additional disclosures, consumer-rights mechanisms, "do not sell/share" provisions, or data-processing terms are required — must be determined by counsel based on where customers and data subjects are located. This section is a placeholder pending that review.

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by updating the Effective Date and, where appropriate, by additional notice.

15. Contact

Questions about this Policy or your data:

  • Email: info@grassgeeks.us [confirm contact email]
  • Mailing address: [Business mailing address]
  • Entity: [Legal Entity Name]