Privacy Policy

1. Information We Collect

1.1. Account Information

When you create an account, we collect:

• Full name and job title
• Email address
• Phone number
• Business mailing address
• Password (stored in hashed form only)

1.2. Business Information

To verify your business and display your profile, we collect:

• Business name and legal entity type
• Business license number and issuing jurisdiction
• Proof of insurance (general liability, workers' compensation)
• Google Reviews rating and review count (via public API)
• Years in operation
• Services offered

1.3. Homeowner and Property Information

When a Homeowner posts a property to request bids, we collect:

• Homeowner name
• Email address and phone number
• Property address (the exact service location)
• Photos and videos of the property that the Homeowner uploads to describe the work
• Service details (lot size, frequency, special instructions, prior pricing the Homeowner chooses to share)

To protect Homeowner privacy, the exact street address and precise coordinates are stored securely but are not shared with Landscapers. Landscapers see only an approximate display location (offset roughly half a mile) and the general area until the Homeowner pays the reveal fee and selects a winning bid, at which point the exact address is shared with that one Landscaper. See Section 11 for additional details.

1.4. Payment Information

Payment processing is handled entirely by Stripe. LawnSwap does not store, process, or have access to your full credit card numbers, debit card numbers, or bank account details. Stripe collects and processes payment information in accordance with their own privacy policy. We receive only transaction confirmations, amounts, and the last four digits of payment methods for display purposes.

1.5. Usage Data

We automatically collect information about how you interact with the Platform:

• Pages visited and features used
• Search queries performed on the Platform
• Listings viewed and interactions with listings
• IP address
• Date and time of access
• Referring URL

1.6. Location Data

To power our geographic matching features, we collect:

• Service area polygons (drawn or entered by Landscapers)
• Property locations associated with Homeowner listings, stored as an exact location but displayed to Landscapers only as an approximate area until a reveal
• General location information derived from IP addresses or zip codes

1.7. Communications

We collect and store messages sent through the Platform's messaging system between users. These messages are retained for anti-circumvention enforcement (see our Terms of Service, Section 10) and dispute resolution purposes.

1.8. Device Information

We collect basic device information to optimize your experience:

• Browser type and version
• Operating system
• Screen size and resolution
• Device type (desktop, tablet, mobile)

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Platform: Operating, maintaining, and improving the LawnSwap marketplace, including geographic matching, listing display, and connecting Homeowners with Landscapers through sealed bidding
• Processing Payments: Charging the reveal fee and any per-visit service payments and platform fees through Stripe, and settling payouts to Landscapers through Stripe
• Sending Notifications: Delivering trade updates, consent requests to Clients, account alerts, and transactional emails through Resend
• Verifying Business Credentials: Confirming business licensing, insurance, and other credentials submitted by Operators
• Enforcing Terms of Service: Monitoring for violations including anti-circumvention, fraud, and prohibited conduct
• Analytics and Improvement: Analyzing usage patterns to improve Platform features, performance, and user experience
• Legal Compliance: Meeting legal obligations, responding to legal process, and protecting our rights and the rights of our users

3. How We Share Your Information

3.1. With Other Platform Users

During the trade process, we share limited information with other Operators as necessary:

• Before a deal closes: Listings display anonymized or limited information about client contracts (such as service area, contract value, and service type) without identifying the specific Client
• After deal acceptance: Both the buying and selling Operator receive necessary information to complete the transfer, including Client details required for the consent process

3.2. With Service Providers

• Stripe: Payment processing, payouts to Landscapers, and identity verification
• Resend: Transactional email delivery (trade updates, consent requests, account notifications)
• Supabase: Database hosting and authentication services
• Vercel: Website hosting and content delivery
• Mapbox: Map rendering and geographic data processing
• Google: Places address autocomplete and public business review data
• Anthropic: AI-assisted drafting of operational and outreach messaging (no payment card data is shared)
• Sentry: Error monitoring and application diagnostics
• Upstash: Rate limiting and abuse prevention
• Meta (if enabled):The Meta Pixel, where active, measures advertising effectiveness. See Section 16 regarding how this constitutes "sharing" for cross-context behavioral advertising under the CPRA.

Each service provider processes data only as necessary to provide their respective services and is bound by their own privacy policies and our data processing agreements.

3.3. With Law Enforcement

We may disclose your information when required by law, subpoena, court order, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

3.4. What We Do Not Do

• We do NOT sell your personal information to third parties. Not now, not ever.
• We do NOT share your information with advertisers. LawnSwap does not display third-party advertisements.
• We do NOT share Client data with any Operator other than the current service provider and the proposed new provider during an active trade.

4. Data Security

We implement industry-standard security measures to protect your information:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS/HTTPS
• Encryption at rest: Data stored in our database (Supabase) is encrypted at rest using AES-256 encryption
• Access controls: We implement role-based access controls and Row Level Security (RLS) at the database level to ensure users can only access data they are authorized to view
• Authentication: Passwords are hashed using industry-standard algorithms. We support secure session management through Supabase Auth
• Regular security audits: We conduct periodic reviews of our security practices and infrastructure
• Incident response: We maintain incident response procedures and will notify affected users and relevant authorities in the event of a data breach as required by law

While we take reasonable measures to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law.

You may request deletion of your data at any time (see Section 6). Deletion requests are subject to the retention requirements listed above. Data that must be retained for legal or compliance reasons will be deleted after the applicable retention period expires.

6. Your Rights

You have the following rights regarding your personal information:

• Right to Access: You may request a copy of the personal information we hold about you.
• Right to Correction: You may request that we correct any inaccurate or incomplete personal information.
• Right to Deletion: You may request that we delete your account and personal information, subject to the retention requirements described in Section 5.
• Right to Opt Out of Marketing:You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email or by contacting us directly. Opting out of marketing does not affect transactional emails related to your account or active trades.
• Right to Data Portability: You may request a machine-readable copy of your personal information for transfer to another service.

To exercise any of these rights, contact us at lawnswapai@gmail.com. We will respond to your request within 30 days.

7. Tennessee Privacy Protections

LawnSwap operates in compliance with the Tennessee Information Protection Act (TIPA), effective July 1, 2025. Under TIPA, Tennessee residents have the following rights:

• Right to know: You have the right to confirm whether we are processing your personal information and to access that information.
• Right to delete: You have the right to request deletion of your personal information, subject to legal retention requirements.
• Right to opt out of sale: We do not sell personal information. If this practice ever changes, we will provide a clear opt-out mechanism as required by TIPA.
• Right to opt out of targeted advertising: LawnSwap does not engage in targeted advertising based on personal information.
• Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise your rights under TIPA, contact us at lawnswapai@gmail.com. We will respond within 45 days as required by law. You may appeal any decision regarding your request by contacting us at the same address.

8. Alabama Privacy Considerations

8.1. Data Breach Notification

LawnSwap complies with the Alabama Data Breach Notification Act of 2018 (Ala. Code Section 8-38-1 et seq.). In the event of a security breach involving your personal information, we will:

• Notify affected Alabama residents as expeditiously as possible and without unreasonable delay, but no later than 45 days after determination that a breach has occurred
• Provide notification that includes a description of the breach, the types of information involved, and steps you can take to protect yourself
• Notify the Alabama Attorney General if the breach affects 1,000 or more Alabama residents

8.2. Security Measures

In accordance with Alabama law, we implement and maintain reasonable security measures to protect the personal information of Alabama residents from unauthorized access, use, or disclosure.

9. Children's Privacy

9.1. The LawnSwap Platform is intended for use by adults who are at least 18 years of age. We do not knowingly collect personal information from anyone under the age of 18.

9.2. If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information promptly.

9.3. If you believe that a minor has provided us with personal information, please contact us at lawnswapai@gmail.com.

10. Cookies and Tracking

10.1. Essential Cookies

We use essential cookies that are required for the Platform to function:

• Session cookies: Used for authentication and maintaining your login state
• Security cookies: Used for CSRF protection and fraud prevention

These cookies cannot be disabled as they are necessary for basic Platform functionality.

10.2. Analytics Cookies (Optional)

We may use analytics cookies to understand how users interact with the Platform. These cookies are optional and can be declined. Analytics data is collected in aggregate form and does not identify individual users.

10.3. No Advertising Cookies

LawnSwap does not use third-party advertising cookies. We do not serve ads on the Platform and do not allow third-party advertisers to place cookies or tracking pixels on our site.

11. Client (Homeowner) Data

LawnSwap collects and processes limited data about homeowner Clients whose service contracts are listed on the Platform. We take the following measures to protect Client information:

• Minimal collection: We collect only the Client data necessary for the consent process: name, email address, and property address (service location).
• Purpose limitation: Client data is used solely for the consent process and to ensure continuity of service during a contract transfer. We do not use Client data for marketing, profiling, or any purpose unrelated to the trade.
• Limited visibility: Client data is never visible to any Operator other than the current service provider and the proposed new provider during an active trade.
• No marketing: We do not send marketing emails or promotional communications to Clients. All communications with Clients are strictly transactional and related to the consent process.
• Right to deletion: Clients may request deletion of their personal information at any time by contacting us at lawnswapai@gmail.com. We will honor deletion requests subject to legal retention requirements.

12. Changes to This Privacy Policy

12.1. We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. For material changes, we will provide at least thirty (30) days' prior notice before the changes take effect.

12.2. Notice of material changes will be provided by:

• Posting the updated Privacy Policy on the Platform with a revised "Last Updated" date
• Sending an email notification to the address associated with your registered account

12.3. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

14. Categories of Personal Information, Sources, and Purposes

This section summarizes, for transparency and to support privacy rights under California and other state laws, the categories of personal information ("PI") we collect, where each category comes from, and the business purposes for which it is used. We do not retain or use any category for purposes incompatible with those disclosed below.

Sensitive Personal Information.Precise geolocation and the property street address you provide are treated as "Sensitive Personal Information" under the California Consumer Privacy Act, as amended (CCPA § 1798.140(ae)). We use Sensitive PI only for the purposes described below (matching homeowners with nearby landscapers and facilitating the service) and not to infer characteristics about you. California residents may limit the use of Sensitive PI as described in Section 15.

15. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the CCPA, as amended by the CPRA:

• Right to know / access: Request the categories and specific pieces of PI we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to delete: Request deletion of PI we collected from you, subject to legal retention exceptions (see Section 5).
• Right to correct: Request correction of inaccurate PI we maintain about you.
• Right to opt out of sale or sharing:We do not sell PI for monetary consideration. To opt out of any "sharing" for cross-context behavioral advertising, use the "Do Not Sell or Share My Personal Information" and "Cookie Preferences" controls in our website footer.
• Right to limit use of Sensitive PI:You may direct us to limit the use of your Sensitive PI (including your property address) to what is necessary to provide the service. Use the "Limit the Use of My Sensitive Personal Information" control available through your account settings or by contacting us.
• Right to non-discrimination: We will not discriminate against you for exercising any of these rights.
• Right to data portability: Receive a copy of your PI in a portable, machine-readable format.
• Authorized agents: You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof of authorization and may require you to verify your identity directly.

To exercise these rights, contact us at lawnswapai@gmail.com. See Section 19 for how we verify requests. We respond within 45 days (extendable by an additional 45 days where permitted).

16. "Do Not Sell or Share" and Cookie Controls

We do not sell personal information for monetary consideration. We have not sold PI in the preceding twelve (12) months and have no plans to do so.

If the Meta Pixel is enabled on our site, the resulting transfer of certain online identifiers to Meta for measuring and targeting advertising may be considered "sharing" for cross-context behavioral advertising (and may constitute a "sale" under some state definitions). You can opt out of this activity at any time using the "Do Not Sell or Share My Personal Information" link and the Cookie Preferences control in our website footer. We also honor Global Privacy Control (GPC) browser signals as a valid opt-out of sharing.

17. Other State Privacy Rights (VA, CO, CT, UT)

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have analogous rights, which may include the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. To exercise these rights, contact lawnswapai@gmail.com. We respond within 45 days and offer an appeal process where required by your state's law.

18. International Users

LawnSwap is operated from the United States and intended for users located in the United States. We do not target or actively market the service to residents of the European Union or the United Kingdom. If you access the Platform from outside the United States, you understand that your information will be processed in the United States, where data protection laws may differ from those in your jurisdiction, and you consent to that processing.

19. How We Verify Privacy Requests

To protect your information, we verify privacy requests before acting on them. For account holders, we ask you to sign in to your account and confirm the request from the email address on file. We may request additional information to confirm your identity where reasonably necessary, and we will only use that information for verification. We do not require you to create an account solely to submit a request.

20. Children and Minors (COPPA)

The Platform is not directed to children under 13, and we do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA). If we learn we have collected such information, we will delete it promptly. The Platform is intended for adults; minors aged 13–17 may use the Platform only with the involvement and permission of a parent or legal guardian. If you believe a child under 13 has provided us information, contact lawnswapai@gmail.com.

21. Security Summary

We protect data in transit using TLS (TLS 1.3 where supported) and encrypt data at rest. Payment card data is collected and stored by Stripe; we do not store full card numbers. While we use reasonable administrative, technical, and physical safeguards, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. See Section 4 for additional detail.

22. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: