Your dataDraft

Privacy Policy

⚠️ DRAFT — FOR INTERNAL REVIEW ONLY. NOT LEGAL ADVICE. This document was generated as a starting point and MUST be reviewed, completed, and approved by a licensed attorney before it is published or relied upon. Bracketed [PLACEHOLDERS] mark information that must be supplied or decisions that must be made.

Yardly Privacy Policy

Operated by: [LEGAL ENTITY NAME], a [ENTITY TYPE] ("Yardly," "we," "us," or "our") Registered address: [REGISTERED ADDRESS] Contact: [CONTACT EMAIL] Effective date: [EFFECTIVE DATE] Last updated: [EFFECTIVE DATE]

Plain-language summary (not a substitute for the full policy)

Yardly is an on-demand lawn-care marketplace app that connects homeowners who need lawn services with independent providers who perform them. Yardly does not cut grass itself — we run the platform that matches the two sides and processes the payment.

What we collect: your account details, contact info, property address(es), precise location (to match you and show live job tracking), before/after yard photos, device identifiers and push-notification tokens, and a tokenized reference to your payment method.
What we do NOT do: We do not sell your personal data. We never store your raw card number — all card data is handled by our payment processor, Stripe, under PCI-DSS.
Who we share with: the provider or homeowner matched to your job, Stripe (payments), and the infrastructure/service vendors that help us run the app.
Your choices: Depending on where you live, you can access, correct, delete, or limit certain uses of your data. See Section 9.
Children: Yardly is for adults. The app is not for anyone under 18.

If anything below conflicts with this summary, the full policy governs.

1. Scope of this Policy

1.1. This Privacy Policy describes how Yardly collects, uses, discloses, and protects personal information when you:

(a) download, access, or use the Yardly mobile application (the "App");
(b) create or use a Homeowner account to request lawn-care services;
(c) create or use a Provider account to offer lawn-care services as an independent contractor; or
(d) otherwise interact with Yardly (collectively, the "Services").

1.2. Yardly operates a two-sided marketplace. Some information you provide as one type of user is shared with the other side of a transaction (for example, a homeowner's service address is shared with the matched provider). This Policy explains those flows.

1.3. Yardly is the merchant of record for transactions on the platform. Payment processing is performed by Stripe (our "Payment Processor"). Yardly's role and Stripe's role in handling payment data are described in Section 6.

1.4. This Policy does not cover the independent privacy practices of providers, homeowners, or third parties whose services you may separately engage. Providers and homeowners are responsible for their own handling of any personal information they obtain through the Services.

2. Who we are and how to contact us

2.1. The data controller / business responsible for your personal information is [LEGAL ENTITY NAME], a [ENTITY TYPE] located at [REGISTERED ADDRESS].

2.2. For privacy questions or to exercise your rights, contact us at:

Email: [CONTACT EMAIL]
Mailing address: [REGISTERED ADDRESS]
[Privacy request webform / in-app privacy settings link — PLACEHOLDER]

2.3. [Data Protection Officer / Privacy Officer name and contact — PLACEHOLDER; required only if appointed.]

3. The personal information we collect

We collect the categories of information below. Not all information is collected from every user; what we collect depends on whether you are a homeowner or a provider and how you use the Services.

3.1. Information you provide directly

Category	Examples	Collected from
Account & identity	Name, username, password/credentials, account type (homeowner or provider)	Homeowners & Providers
Contact information	Email address, phone number	Homeowners & Providers
Property information	Service property address(es), gate/access notes, lawn size or property details you enter	Homeowners
Job content	Service requests, scheduling preferences, instructions, in-app messages, ratings, and reviews	Homeowners & Providers
Yard photos	"Before" and "after" photos of the yard/property associated with a job	Homeowners & Providers
Provider business profile	Service area, equipment, services offered, availability	Providers
Support communications	Information you include when you contact support or report a problem	Homeowners & Providers

3.2. Information collected automatically

Category	Examples
Precise geolocation	GPS-level location used to match homeowners with nearby providers and to power live job tracking (see Section 3.4)
Device & technical data	Device identifiers, device model and operating system, app version, language, IP address, network information, crash logs, and diagnostic data
Push-notification tokens	Tokens that allow us to send job, scheduling, and account notifications to your device
Usage data	Screens viewed, features used, in-app actions, and timestamps
Cookies / SDKs	[In-app analytics SDKs and similar technologies — list specific SDKs — PLACEHOLDER]

3.3. Payment information (tokenized only)

When you add or use a payment method, the card/payment details are collected and processed directly by Stripe, our Payment Processor.
Yardly stores only a tokenized reference to your payment method (and limited, non-sensitive details such as card brand and last four digits, [confirm exactly what Stripe returns to Yardly — PLACEHOLDER]).
Yardly never stores or has access to your full card number, CVV, or full bank account credentials. See Section 6.

3.4. Precise geolocation — special notice

Yardly uses precise (GPS-level) geolocation to (a) match homeowners with nearby providers, (b) route providers to the correct property, and (c) provide live tracking of a provider's location during an active or scheduled job.
We request your device's location permission. You can change location permissions at any time in your device settings, but disabling precise location will limit core features (such as matching and live tracking).
[Decision: whether providers' location is collected only while the App is in use, or also in the background during an active job — PLACEHOLDER. Background location collection requires specific OS disclosures and consent.]

3.5. Provider-specific information (current and forthcoming)

In addition to the above, for providers we collect or plan to collect:

Now: business/service profile, service area, equipment, availability, and the ratings/job history generated through the platform.
Forthcoming (not yet implemented):
- Bank/payout details for ACH payouts to providers. [ACH payout is planned but not yet live — PLACEHOLDER for the specific data fields, processor, and flow.]
- Identity verification and background-check information (e.g., information needed to run a background check via a consumer reporting agency under the FCRA). [Background checks are planned but not yet implemented — PLACEHOLDER for the consumer reporting agency, the data collected, the FCRA disclosure/authorization process, and adverse-action procedures.]
- Tax information needed for IRS Form 1099-NEC reporting (e.g., legal name, address, and taxpayer identification number / W-9). [PLACEHOLDER: confirm collection point and threshold.]

3.6. Information from other sources

We may receive information about you from:

the other side of a transaction (e.g., a homeowner's job details and a provider's profile are shared as needed to complete a job);
service vendors that provide mapping, analytics, hosting, messaging, fraud-prevention, and (forthcoming) identity/background-check and payout services; and
[Any other third-party sources — e.g., marketing partners, referral sources — PLACEHOLDER, or state "none."]

3.7. Sensitive information

Yardly does not intentionally collect special categories of sensitive personal data (such as government ID numbers, health data, or financial account numbers) except where required for forthcoming provider features (taxpayer ID for 1099 reporting, bank details for payouts, and information used for background checks). Precise geolocation is treated as sensitive data under some laws; see Section 9. [Confirm final list of sensitive data categories with counsel — PLACEHOLDER.]

4. How and why we use your information (purposes of processing)

We use personal information for the following purposes:

4.1. To provide the marketplace and complete jobs — create and manage accounts; match homeowners with providers; schedule, route, and deliver services; enable live job tracking; and facilitate before/after photo documentation.

4.2. To process payments — calculate the service price, applicable sales tax, and optional tip; charge homeowners via Stripe; and (forthcoming) remit payouts to providers. Yardly acts as merchant of record.

4.3. To communicate with you — send transactional and service messages (job status, scheduling, receipts, account and security alerts) via in-app messaging, email, push notifications, and SMS. See Section 5.

4.4. To enable ratings, reviews, and trust & safety — surface ratings/reviews, prevent fraud and abuse, investigate disputes, and (forthcoming) verify provider identity and run background checks.

4.5. To improve and develop the Services — analytics, troubleshooting, debugging, measuring performance, and developing new features.

4.6. To comply with law and protect rights — meet legal, tax (including IRS 1099-NEC), and regulatory obligations; enforce our terms; and protect the rights, safety, and property of users, the public, and Yardly.

4.7. With your consent — for any other purpose disclosed at the time we collect the information, or for which you later give consent.

4.8. Legal bases (for users protected by GDPR). Where the EU/UK GDPR applies (see Section 11), we rely on: performance of a contract (providing the Services); legitimate interests (improving and securing the Services, preventing fraud); consent (e.g., precise location, certain marketing); and legal obligation (tax/regulatory). [Confirm legal-basis mapping with counsel if/when serving EU/UK users — PLACEHOLDER.]

5. Communications, marketing, SMS, and push notifications

5.1. Transactional messages. We send messages necessary to operate the Services (e.g., job confirmations, provider-arrival alerts, receipts, security notices). These are part of the Services and are generally not optional while you have an account.

5.2. SMS / text messages (TCPA). By providing your phone number and opting in, you consent to receive service-related and, where you have agreed, promotional text messages from Yardly and/or matched providers. Message and data rates may apply. You can opt out of promotional texts at any time by replying STOP (or as otherwise described at opt-in). [PLACEHOLDER: SMS program terms, opt-in mechanism, message frequency, and help/STOP keywords — required for TCPA compliance.]

5.3. Marketing email (CAN-SPAM). If we send promotional emails, every such email will include an unsubscribe mechanism, and we will honor opt-outs as required by CAN-SPAM. [PLACEHOLDER: confirm whether Yardly will send marketing email at launch.]

5.4. Push notifications. You can control push notifications through your device settings. Disabling them may affect job and scheduling alerts.

5.5. Calls. [PLACEHOLDER: if Yardly or providers will place automated or prerecorded calls, add TCPA call-consent disclosures.]

6. Payments and tokenized payment information

6.1. Merchant of record. Yardly is the merchant of record for transactions on the platform. Homeowner payments — service price + applicable sales tax + optional tip — are processed by Stripe.

6.2. No raw card data at Yardly. Card and payment-credential data are collected and stored by Stripe, which is responsible for PCI-DSS compliance. Yardly stores only a tokenized payment reference and limited non-sensitive metadata; Yardly does not store, transmit, or have access to your full card number or CVV.

6.3. Tips. Optional tips are passed through 100% to the provider. [Confirm tip-handling and disclosure with counsel — PLACEHOLDER.]

6.4. Provider payouts (forthcoming). ACH payouts to providers are planned but not yet implemented. When launched, provider bank/payout details will be collected and processed as described in Section 3.5. [PLACEHOLDER: payout processor, data flow, and storage location.]

6.5. Stripe's privacy practices. Stripe processes payment information under its own terms and privacy practices. [PLACEHOLDER: link to Stripe privacy notice / data-processing terms, and confirm Yardly–Stripe controller/processor relationship.]

7. How we share your information

We share personal information only as described below. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. (See Section 9.4.)

7.1. With the matched other party. To complete a job, we share necessary information between the matched homeowner and provider, for example:

to the provider: the homeowner's first name, service address, job details, relevant access notes, before/after photos, and real-time location context for routing/tracking;
to the homeowner: the provider's name/profile, ratings, and real-time location during an active job.

7.2. With Stripe (payments). To process charges, taxes, tips, and (forthcoming) payouts, as described in Section 6.

7.3. With service providers / vendors. We share information with vendors that perform services for us, such as cloud hosting and storage, mapping and geolocation, analytics, crash reporting, customer support, messaging/SMS/email delivery, fraud prevention, and (forthcoming) identity verification, background checks, and payout processing. These vendors are permitted to use the information only to perform services for Yardly. [PLACEHOLDER: maintain an internal list of subprocessors/vendors; consider publishing it.]

7.4. For legal and safety reasons. We may disclose information to comply with law, legal process, or governmental requests; to enforce our terms; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of Yardly, our users, or the public.

7.5. Tax reporting. We disclose provider information to taxing authorities as required (e.g., IRS Form 1099-NEC).

7.6. Business transfers. If Yardly is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy or a successor policy.

7.7. With your direction or consent. We share information when you direct us to or otherwise consent.

7.8. Aggregated / de-identified data. We may create and share aggregated or de-identified information that cannot reasonably be used to identify you.

8. Data retention

8.1. We retain personal information for as long as needed to provide the Services and for the legitimate and lawful purposes described in this Policy, including to:

maintain your account while it is active;
complete transactions and resolve disputes;
comply with legal, tax, accounting, and regulatory obligations (e.g., transaction and 1099 records);
enforce our agreements and protect against fraud and abuse.

8.2. Specific retention periods. [PLACEHOLDER — define concrete retention periods for each major data category, e.g., account data, geolocation/tracking history, yard photos, in-app messages, transaction/tax records, support tickets, provider background-check and payout records. Do not publish until set by counsel/business.]

8.3. Yard photos. [PLACEHOLDER: decide how long before/after photos are retained and whether homeowners/providers can delete them.]

8.4. Geolocation / live-tracking history. [PLACEHOLDER: decide retention period for precise-location and tracking history; consider minimizing.]

8.5. When we no longer need personal information, we will delete, anonymize, or de-identify it, unless retention is required by law.

9. Your privacy rights

The rights available to you depend on where you live. Yardly will not discriminate against you for exercising any privacy right.

9.1. Texas residents (Texas Data Privacy and Security Act — TDPSA)

If you are a Texas resident, you have the right to:

Confirm & access — confirm whether we process your personal data and access it.
Correct — correct inaccuracies in your personal data.
Delete — delete personal data we have about you.
Portability — obtain a portable copy of personal data you provided.
Opt out — opt out of (i) targeted advertising, (ii) the sale of personal data, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects. (As stated in Section 9.4, Yardly does not sell personal data or use it for targeted advertising.)
Sensitive data consent — because precise geolocation is sensitive data under the TDPSA, we process it based on your consent (e.g., your device location permission); you may withdraw consent (recognizing that core features may stop working).

To exercise these rights, see Section 9.6. You may appeal a denial of a request; see Section 9.7.

9.2. California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

Know / access — the categories and specific pieces of personal information we collected, the sources, purposes, and the categories of third parties to whom we disclosed it.
Delete — request deletion of personal information, subject to exceptions.
Correct — correct inaccurate personal information.
Opt out of sale/sharing — opt out of the "sale" or "sharing" (cross-context behavioral advertising) of personal information. (Yardly does not sell or share personal information in this sense — see Section 9.4.)
Limit use of sensitive personal information — direct us to limit use of sensitive personal information (e.g., precise geolocation) to permitted purposes.
Non-discrimination — not be discriminated against for exercising your rights.

Authorized agents. You may use an authorized agent to submit requests; we may require verification. Categories disclosed for a business purpose: [PLACEHOLDER — complete the CCPA category-by-category disclosure table, or incorporate by reference Section 3 and Section 7.] Shine the Light (Cal. Civ. Code § 1798.83): [PLACEHOLDER — include statement; Yardly does not share personal information with third parties for their own direct marketing, unless stated otherwise.]

9.3. Other U.S. state residents

[PLACEHOLDER — decide whether to extend rights to residents of other states with comprehensive privacy laws (e.g., Virginia, Colorado, Connecticut, Utah, Oregon, Montana, and others as applicable). Add state-specific language if Yardly operates beyond Texas.]

9.4. No sale; no sharing for targeted advertising

Yardly does not sell your personal information for money or other valuable consideration, and does not share it for cross-context behavioral / targeted advertising, as those terms are defined under the TDPSA, CCPA/CPRA, and similar laws. [Confirm this remains true given all analytics/advertising SDKs in use — PLACEHOLDER; some SDKs can constitute a "sale"/"share."]

9.5. Right to opt out via universal signals

[PLACEHOLDER — if applicable, describe support for the Global Privacy Control (GPC) or other universal opt-out mechanisms, as required by CPRA and certain state laws.]

9.6. How to exercise your rights

To submit a privacy request, use any of the following:

Email: [CONTACT EMAIL]
In-app: [in-app privacy/data settings — PLACEHOLDER]
Webform: [privacy request webform URL — PLACEHOLDER]
Toll-free number: [PLACEHOLDER — required for CCPA unless an exemption applies.]

We will verify your identity before fulfilling a request (for example, by confirming information associated with your account). We will respond within the timeframes required by applicable law. [Confirm response windows: e.g., TDPSA — 45 days, extendable; CCPA — 45 days, extendable — PLACEHOLDER.]

9.7. Appeals

If we decline your request, you may appeal by contacting us at [CONTACT EMAIL / appeals address — PLACEHOLDER]. We will respond to appeals within the period required by applicable law (e.g., 60 days under the TDPSA). If your appeal is denied, you may contact the Texas Attorney General [or the relevant state regulator — PLACEHOLDER].

10. Children's privacy

10.1. The Services are intended for adults aged 18 and older. Yardly does not knowingly collect personal information from anyone under 18, and the Services are not directed to children under 13 within the meaning of the Children's Online Privacy Protection Act (COPPA).

10.2. If you believe a person under 18 has provided us personal information, contact us at [CONTACT EMAIL] and we will take appropriate steps to delete it.

11. EU / UK users — forward-looking GDPR notice

11.1. Yardly currently operates in Houston, Texas, USA, and is not designed for or targeted to users in the European Economic Area (EEA), United Kingdom, or Switzerland.

11.2. If and when Yardly offers the Services to users in those regions, additional GDPR/UK-GDPR protections will apply, including: identified legal bases for processing (see Section 4.8); data-subject rights (access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making); information about international data transfers and safeguards (e.g., Standard Contractual Clauses); and, where required, an EU/UK representative and/or Data Protection Officer. [PLACEHOLDER — complete full GDPR disclosures, transfer mechanisms, and representative appointment before serving EU/UK users.]

12. Data security

12.1. We maintain administrative, technical, and physical safeguards designed to protect personal information, including [encryption in transit and at rest, access controls, tokenization of payment references via Stripe, logging/monitoring — confirm and list actual measures — PLACEHOLDER].

12.2. Payment security. Raw card data is handled exclusively by Stripe under PCI-DSS; Yardly stores only tokenized references (see Section 6).

12.3. No method of transmission or storage is 100% secure. We cannot guarantee absolute security, and you use the Services at your own risk to that extent permitted by law.

12.4. Breach notification. If a security incident affects your personal information, we will notify you and regulators as required by applicable law. [PLACEHOLDER — reference applicable breach-notification obligations and internal incident-response process.]

13. Your choices and controls

Location: manage precise-location permissions in your device settings (note core-feature impact).
Push notifications: manage in your device settings.
SMS: reply STOP to opt out of promotional texts (see Section 5.2).
Marketing email: use the unsubscribe link (see Section 5.3).
Account: review and update account information in the App, or contact us to close your account.
Photos / camera: manage camera and photo-library permissions in your device settings.

14. Third-party links and services

The Services may reference or link to third-party websites, apps, or services (including Stripe and vendor tools). Their privacy practices are governed by their own policies, and Yardly is not responsible for them.

15. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you as required by law (for example, by in-app notice, email, or updating the "Last updated" date). Your continued use of the Services after changes take effect constitutes acceptance, to the extent permitted by law.

16. Contact us

[LEGAL ENTITY NAME] [REGISTERED ADDRESS] Email: [CONTACT EMAIL] [Privacy webform / in-app privacy settings — PLACEHOLDER] [Toll-free privacy number — PLACEHOLDER]

Open items requiring decision / attorney input

[LEGAL ENTITY NAME] — exact legal name of the Yardly operating entity.
[ENTITY TYPE] — corporate form (LLC, Inc., etc.).
[REGISTERED ADDRESS] — registered/mailing address.
[CONTACT EMAIL] — privacy contact email.
[EFFECTIVE DATE] / Last updated date.
Data Protection / Privacy Officer — name and contact, if appointed.
In-app privacy settings link, privacy request webform URL, and toll-free privacy number (toll-free likely required for CCPA).
Analytics/advertising SDKs — complete list of in-app SDKs/cookies, and confirm whether any constitute a "sale"/"share" under CCPA/CPRA or TDPSA.
Exactly what payment metadata Stripe returns to Yardly (e.g., card brand, last four) for Section 3.3.
Background-location decision for providers (in-use vs. background during active jobs) and required OS disclosures/consent.
Tip handling confirmation (100% pass-through) and disclosure language.
Provider payout (ACH) — processor, data fields, data flow, and storage; currently forthcoming.
Provider background checks (FCRA) — consumer reporting agency, data collected, FCRA disclosure/authorization, and adverse-action procedures; currently forthcoming.
Provider tax (1099-NEC) — W-9/TIN collection point and reporting threshold.
Final sensitive-data category list to confirm with counsel.
Other third-party data sources (e.g., marketing/referral) — list or state "none."
Stripe privacy notice / DPA link and confirmation of the Yardly–Stripe controller/processor relationship.
Subprocessor/vendor list — maintain internally; decide whether to publish.
Retention periods — concrete periods for each data category (account, geolocation/tracking, yard photos, messages, transaction/tax records, support, provider background/payout records).
Yard photo retention and user-deletion controls.
Geolocation/live-tracking history retention period (minimization recommended).
SMS program terms — opt-in mechanism, message frequency, HELP/STOP keywords (TCPA).
Marketing email at launch — confirm whether sending; finalize CAN-SPAM mechanics.
Automated/prerecorded calls — add TCPA call-consent language if applicable.
CCPA category-by-category disclosure table and Shine the Light statement.
Other U.S. state privacy laws — decide whether to extend rights (VA, CO, CT, UT, OR, MT, etc.) as Yardly expands.
Universal opt-out / Global Privacy Control (GPC) support — confirm and describe if applicable.
Rights-request response windows and appeal process — confirm statutory timeframes and appeals/regulator contact.
GDPR/UK-GDPR — full disclosures, legal-basis mapping, transfer mechanisms, and EU/UK representative/DPO before serving EU/UK users.
Security measures — confirm and list actual administrative/technical/physical safeguards.
Breach-notification obligations and internal incident-response reference.
[VENUE/COUNTY] and broader governing-law/venue alignment with the Terms of Service (not separately stated in this Policy but should be consistent).