Clinch Pros LLC — Privacy Policy

Effective Date: May 21, 2026 Last Updated: July 10, 2026 Version: 1.13

1. Introduction

Clinch Pros LLC ("Clinch," "we," "us," or "our"), a Delaware limited liability company, respects the privacy of the businesses and individuals that use our software-as-a-service platform for residential remodeling contractors (the "Service," consisting of the Clinch mobile application, the web application at app.clinchwin.com, and the marketing website at clinchpro.com).

This Privacy Policy describes the categories of personal data we process, the purposes and legal bases for processing, the parties with whom we share data, and the rights that data subjects have under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), and other applicable laws.

Scope. This Policy applies to (a) account holders ("Customers") who sign up for the Service, (b) authorized users acting on behalf of a Customer, (c) visitors to our marketing website, and (d) individuals whose personal data is incidentally captured in Customer scans or photographs (e.g., a homeowner who appears briefly in an interior scan).

Roles under GDPR.

• For data about our Customers and their authorized users (signup, billing, support), Clinch acts as an independent controller.
• For Customer Content that Customers upload (scans, photographs, bids), Clinch acts as a processor on behalf of the Customer (who is the controller). The terms of our Data Processing Addendum ("DPA") govern that processing.
• For incidental personal data appearing within Customer Content (e.g., a homeowner's face or address visible in a scan), Customer is the controller; Clinch implements technical safeguards (EXIF GPS metadata strip — see Section 9; automated content moderation; planned face-blur — see Section 9.2) as a processor.
• For homeowners (the Customer's end-clients) who take photos through a remote-capture link issued by a Customer or who view AI-generated previews / proposals delivered by a Customer, the Customer is the controller and Clinch is the processor. Homeowners are not account holders; they interact with the Service as invitees of the Customer. Homeowner rights and the homeowner deletion path are set out in Section 7.5.

This Service is sold to business Customers (contractors, handypersons, designers, and similar trades). It is not marketed to consumers for personal, family, or household purposes; however, homeowners may interact with the Service as invitees of a Customer through homeowner-facing surfaces (remote-capture link, AI-generated proposal previews, scope-confirmation step). Section 7.5 sets out the rights and the deletion path available to those homeowners. See Section 11 (Children).

2. Personal Data We Collect

We collect the following categories of personal data. The CCPA category labels are shown for California-resident transparency.

2.1 Sensitive Personal Information

We do not intentionally collect sensitive personal information as defined under CCPA/CPRA (e.g., government IDs, biometric identifiers, precise geolocation, racial or ethnic origin, health data, sexual orientation, religious beliefs). The optional "Use my location" feature (Section 2.3) accesses your device's location to resolve a street address via your operating system's geocoding service (Google or Apple); because the raw coordinates are never transmitted to or stored by Clinch, we do not retain precise geolocation as sensitive personal information.

However, scans and photographs of residential interiors may incidentally capture images of individuals (e.g., the homeowner, a child, a domestic worker). To mitigate this risk we (a) strip EXIF GPS metadata on upload (currently deployed), (b) run automated content moderation through Google Cloud Vision SafeSearch on homeowner remote-capture uploads and contractor hero/retake uploads to reject obviously inappropriate content (currently deployed on those paths — see Section 9.2 for the exact scope), and (c) display a notice on the homeowner capture page asking the homeowner to avoid capturing people. We have an automatic face-blur step in development that will run server-side on upload; that step is planned and not yet deployed (see Section 9.2 for full status). Until it ships, the Customer is contractually responsible for not uploading scans that focus on or identify human subjects (Terms of Service §4).

2.2 We Do Not Knowingly Collect

We do not knowingly collect (a) personal data of children under 16, (b) biometric identifiers used for identification, (c) government-issued identification numbers, (d) financial-account numbers (Stripe handles payment data directly), or (e) precise geolocation on our servers — the optional location feature (Section 2.3) resolves an address via your device's operating-system geocoding service, and we receive only the address you save, not your raw coordinates.

2.3 Location Information

If you choose to use the "Use my location" feature, Clinch accesses your device's approximate and precise location to suggest the job site's address. Your device's operating system (Google on Android, Apple on iOS) converts these coordinates into a street address. We store only the resulting address you save with a project; we do not store or transmit your raw GPS coordinates to our servers. Location access is optional — you can always type the address manually. We do not use location for advertising and do not sell it.

3. How We Collect Personal Data

Where scans are processed. All scan reconstruction, measurement extraction, and AI image generation occur on Clinch's servers (via our GPU compute sub-processor, Modal Labs — see Section 5). The mobile application captures photos and short video frames from your device's camera and uploads them over an encrypted connection (TLS 1.2+) to Clinch's storage (Supabase Storage — see Section 5) and processing infrastructure. No reconstruction or AI processing occurs on your device. Source photos and intermediate model outputs are held by Modal only for the duration of the active processing job and are deleted upon job completion; the finished artifacts (measurements and AI-generated images) are written back to Clinch storage under your Account and retained per Section 8. | Payment processor (Stripe) | Billing history, transaction IDs, payment-method tokens, last-4 digits (we do not see full card numbers) | | Automated diagnostic tools (Sentry) | Crash reports, error logs, device/OS metadata. PII patterns are auto-scrubbed in-process before transmission to Sentry (see Section 9.1). | | Product-analytics tools (PostHog) | Anonymized event records, session-replay recordings with all form-input fields masked (no client names, bid amounts, or payment data captured) — see Section 9.1 for masking detail and opt-out instructions | | Cookies and analytics (web only)| Session ID, page-view metadata, referrer URL — see Section 12 | | Third parties | If you sign up via a partner referral, we may receive a partner ID |

4. Why We Process Personal Data (Purposes and Legal Bases under GDPR Article 6)

The legal basis for each processing purpose is shown below. For California-resident purposes, all processing serves a "business purpose" under CCPA §1798.140(e).

We rely on legitimate interests only after balancing those interests against your rights and freedoms. You may object to processing based on legitimate interests by contacting support@clinchpro.com (see Section 7).

5. Who We Share Personal Data With (Sub-Processors and Service Providers)

We do not sell your personal data for money. However, our marketing website (clinchpro.com) uses third-party advertising and analytics technologies — currently the Meta (Facebook) Pixel and Google Analytics — that disclose online identifiers and browsing activity to those providers for cross-context behavioral advertising, which the CCPA/CPRA treats as "sharing" (and, under a conservative reading, may treat as a "sale"). See Section 5.2 for how to opt out. We also disclose data to the operational sub-processors and service providers listed below for the purposes shown; all sub-processors are bound by written agreements that restrict their processing to our instructions and require appropriate security safeguards. The Clinch application (app.clinchwin.com) does not load cross-context behavioral-advertising trackers (no Meta Pixel, Google Analytics, or similar).

In addition to the operational sub-processors above, our marketing website (clinchpro.com) discloses limited online-activity data to Google (Google Analytics) and Meta Platforms (Meta/Facebook Pixel) for cross-context behavioral advertising, as described in Section 5.2. The table above is the authoritative inventory of operational sub-processors as of the "Last Updated" date shown at the top of this Policy. We maintain this list inline within this Policy and update it whenever the inventory changes; the change is reflected here within seven (7) calendar days of any addition or removal. The purposes above are stated at a category level; Customers and DPA signatories may request the current, itemized sub-processor list — including any additional operational detail relevant to a data-protection assessment — by emailing support@clinchpro.com (subject line SUBPROCESSOR LIST). Enterprise (Business-tier) Customers will additionally receive direct email notice of material changes with reasonable advance notice, in accordance with our DPA.

5.1 Other Disclosures

We may disclose personal data to: (a) professional advisors (lawyers, accountants, auditors); (b) acquirers or successors in connection with a merger, acquisition, or sale of all or substantially all assets, subject to confidentiality obligations; (c) law enforcement or government authorities when required by valid legal process or to protect rights, property, or safety; and (d) affiliates under common control with Clinch.

5.2 Sale and Sharing of Personal Information

Clinch does not sell your personal information for money. However, our marketing website (clinchpro.com) runs third-party advertising and analytics technologies — currently the Meta (Facebook) Pixel and Google Analytics — that disclose online identifiers and browsing activity to those providers for cross-context behavioral advertising. Under the CCPA/CPRA this constitutes "sharing" (and, under a conservative reading, may constitute a "sale") of personal information.

Your opt-out options. You may opt out of this sharing/sale at any time, at no cost: (i) by submitting a request through our Do Not Sell or Share page at app.clinchwin.com/do-not-sell-share; and (ii) by transmitting a Global Privacy Control (GPC) signal from your browser or extension, and by using the standard ad-platform opt-out controls. We are deploying a consent-management tool on our marketing site that will automatically block these advertising technologies for any visitor who opts out or transmits a GPC signal; until that tool is live, please use the request page or your browser/ad-platform controls. The Clinch application (app.clinchwin.com) does not share personal information for cross-context behavioral advertising.

6. International Data Transfers

Clinch is based in the United States, and most of our sub-processors are located in the United States. If you access the Service from outside the United States (including from the European Economic Area, the United Kingdom, or Switzerland), your personal data will be transferred to, stored, and processed in the United States and may be processed in any other country where our sub-processors operate.

Transfer mechanisms.

• For transfers from the EEA / UK / Switzerland to the United States, we rely on the EU-US Data Privacy Framework ("DPF") where the recipient is self-certified, and on the Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914) and the UK International Data Transfer Addendum as a back-up or alternative.
• We perform a transfer-impact assessment for new sub-processors and implement supplementary measures (encryption in transit and at rest, access controls, contractual restrictions on government access) as appropriate.

You may request a copy of the relevant SCCs by emailing support@clinchpro.com.

7. Your Rights

7.1 Rights Under GDPR (EEA / UK / Swiss residents) — Articles 15–22, 77

Subject to applicable conditions and exemptions, you have the right to:

• Access the personal data we hold about you (Art. 15);
• Rectify inaccurate or incomplete personal data (Art. 16);
• Erase your personal data ("right to be forgotten") (Art. 17);
• Restrict our processing of your personal data (Art. 18);
• Data portability — receive your personal data in a structured, commonly used, machine-readable format (Art. 20);
• Object to processing based on legitimate interests or for direct marketing (Art. 21);
• Withdraw consent at any time for processing based on consent (Art. 7(3));
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Art. 22) — Clinch does not currently perform such automated decision-making;
• Lodge a complaint with a supervisory authority in your member state (Art. 77).

To exercise any right, email support@clinchpro.com or use the in-app data-deletion controls (see Section 9.2). We will respond within thirty (30) days (extendable by sixty (60) days for complex requests, with notice to you).

7.2 California Privacy Notice — CCPA / CPRA Rights (§§ 1798.100–1798.130)

California residents: This subsection is your CCPA / CPRA Notice at Collection and disclosure of rights. The categories of personal information we collect are listed in Section 2 above; the purposes for collection and the sources of the information are listed in Sections 3 and 4 above; the categories of third parties with whom we share the information are listed in Section 5 above; our marketing website discloses certain personal information for cross-context behavioral advertising (a "share," and possibly a "sale") via the Meta Pixel and Google Analytics, and you may opt out as described in Section 5.2; the retention periods are listed in Section 8 above.

You have the right to:

• Know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the third parties with whom we have shared the data;
• Delete your personal information, subject to statutory exemptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information. As described in Section 5.2, our marketing website uses advertising/analytics technologies (the Meta Pixel and Google Analytics) that constitute a "share" (and possibly a "sale") under the CPRA. You may opt out by submitting a request through our landing page at app.clinchwin.com/do-not-sell-share, by transmitting a Global Privacy Control (GPC) signal (CCPA Regulations § 7025), and by using standard ad-platform controls. We are deploying a consent-management tool that will automatically suppress these advertising technologies for any visitor who opts out or transmits a GPC signal; until it is live, please use the request page or your browser/ad-platform controls to opt out;
• Limit the use and disclosure of sensitive personal information to that necessary to perform the Service (although, as noted in Section 2.1, we do not intentionally collect sensitive personal information);
• Non-discrimination — we will not deny you the Service, charge you a different price, or provide a different level of quality because you exercised a privacy right;
• Authorized agent — you may designate an authorized agent to make a request on your behalf, subject to verification.

To exercise these rights:

• Email: support@clinchpro.com
• Subject line: "California Privacy Request"

We will verify your identity (typically by confirming control of the email address on file plus one additional data point) before responding. We will respond within forty-five (45) days (extendable by 45 days with notice).

Retention for fraud and abuse prevention after deletion. When you exercise your right to delete, we delete your personal information except for narrow categories that applicable law permits us to retain. To detect and prevent fraud and abuse — including free-trial and promotional-credit "farming" (repeatedly creating Accounts to obtain repeated free trials or credits) — we may retain, for no longer than necessary for that purpose: (i) records held by our payment processor (Stripe), including billing history and the email associated with your customer record, under the billing-records retention period in Section 8 (seven (7) years for U.S. tax compliance), used incidentally to enforce one-trial-per-business limits; (ii) a non-identifying payment-card fingerprint (a one-way token derived from a payment card that cannot be reversed into a card number), used to detect the same card across Accounts; and (iii) a limited internal deletion-audit record. We rely on the deletion exceptions in California Civil Code § 1798.105(d) (including detecting security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity), the analogous exceptions under other U.S. state privacy laws, and GDPR Art. 17(3).

7.3 Rights Under Other U.S. State Laws

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states with comprehensive privacy laws have rights substantially similar to those above. Use the same contact channels and we will respond in accordance with the timelines required by your state's law.

7.4 Appeals

If we deny your request, you may appeal by replying to our denial within sixty (60) days. We will respond to appeals within thirty (30) days (forty-five (45) days in Virginia and certain other jurisdictions).

7.5 Homeowner Rights (Non-Account Holders)

A homeowner is an individual who interacts with the Service as the end-client of a Customer (e.g., by taking photos through a Customer-issued remote-capture link, by viewing an AI-generated preview of their room, or by reviewing a proposal). Homeowners are not Clinch Account holders; the Customer is the controller of the homeowner's personal data, and Clinch is the processor.

Subject to applicable law (including CCPA/CPRA for California-resident homeowners and the GDPR/UK GDPR for EEA/UK-resident homeowners), homeowners may exercise the following rights:

• Access the personal data Clinch holds about the homeowner (limited to data Clinch can identify by capture link, project, or contact information the homeowner provides).
• Delete the homeowner's photos and any derived measurements or AI-generated previews. Clinch will route the request to the Customer (controller); Clinch will execute the deletion in Clinch's own systems within thirty (30) days of receiving the request, except where Clinch is legally required to retain the data.
• Correct inaccurate personal data.
• Object to processing for purposes the homeowner has not consented to.

How to exercise these rights. A homeowner may either (a) email support@clinchpro.com with the subject line HOMEOWNER PRIVACY REQUEST (include the contractor's name, the approximate date of the capture, and the email or phone the homeowner used to access the capture link), or (b) use the per-capture "Delete my photos" affordance the Service surfaces on the homeowner capture-completion page when available. Clinch will verify the homeowner's connection to the capture before acting and will respond within thirty (30) days (or the applicable statutory period).

Retention of homeowner-captured photos. Photos and measurements captured by a homeowner through a remote-capture link are retained per the Customer's active Subscription tier (see Section 8): Starter — 90 days; Pro — one (1) year; Business — three (3) years. A homeowner may request earlier deletion at any time using the channels above; Clinch will honor the request within thirty (30) days unless an overriding legal-retention obligation applies.

No advertising use. Clinch does not use homeowner-captured photos, measurements, or AI-generated previews to deliver advertising to the homeowner, to sell to third parties, or to train general-purpose machine-learning models. Disclosures of homeowner data are limited to the operational sub-processors identified in Section 5 acting on Clinch's documented instructions.

8. Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy, subject to the periods below.

After a retention period expires, data is either deleted or irreversibly de-identified.

9. Security and Privacy-by-Design Safeguards

9.1 Technical and Organizational Measures

We implement commercially reasonable measures appropriate to the nature of the data:

• TLS 1.2+ encryption in transit; AES-256 encryption at rest (Supabase Storage);
• Role-based access control to production systems with least-privilege;
• Multi-factor authentication required for staff access to production systems;
• Quarterly review of access permissions;
• Centralized secrets management;
• Sentry crash reports are scrubbed of PII patterns (email addresses, UUIDs, JWTs, Stripe customer IDs, Supabase service-role tokens, and other secret-shaped strings) in-process before transmission to Sentry's servers, via our own PII scrubber implementation. Sentry's servers never receive the raw event payload;
• PostHog session-replay recordings mask all <input>, <textarea>, and <select> elements by default; only synthetic interaction events (clicks, scrolls, route changes) and DOM mutations on non-input elements are recorded. Client names, bid amounts, payment-method details, and other sensitive form values are not captured in replay data. We have signed a Data Processing Agreement (DPA) with PostHog. Individual users may request exclusion from session-recording by emailing support@clinchpro.com (we will set the PostHog session_recording_enabled flag to false for the requesting user's distinct ID within five (5) business days);
• Incident-response plan, with a target of seventy-two (72) hour breach notification under GDPR Art. 33 where required.

9.2 Privacy-Engineering Features

• EXIF GPS strip: All photos uploaded through the Service have GPS metadata removed before storage. (Deployed.)
• Automated content moderation: Google Cloud Vision SafeSearch screens images uploaded through the following paths, at upload time and before persistence: homeowner remote-capture uploads (received via a contractor-issued capture link) and contractor hero/retake photo uploads (used by AI editing). Photos flagged above our configured thresholds for adult, violent, racy, or medical-or-gore content on those paths are rejected and are not persisted to our storage; flagged uploads are logged for audit. Contractor room-scan uploads from the mobile application are not currently screened — they are measurement photos captured by the authenticated contractor's own device, and the contractor is contractually responsible for their content (ToS §4, §7.4). If the moderation service is temporarily unavailable on a screened path, uploads may briefly proceed without screening. (Deployed on the homeowner-capture and hero/retake paths.)
• Per-scan deletion: Each scan has a one-click "Delete" control in the mobile and web apps. Deletion is propagated to Supabase Storage and database references within 30 days.
• Face-detection capability (roadmap, not currently a Service safeguard): We retain the ability to invoke face detection through our existing Google Cloud Vision integration and are designing an automatic face-blur write-back step for a future release. This is a planned roadmap item and not currently deployed. Until it ships, Customers are responsible for not uploading scans that focus on or identify human subjects (see Section 4 of the Terms of Service and Section 11 of this Policy); the face-detection-and-blur step is described here so that Customers can plan for it, not as a representation that the safeguard is presently in place.

9.3 No Guarantee

No system is perfectly secure. We do not guarantee against unauthorized access. In the event of a breach affecting your personal data, we will notify you and, where required, the relevant supervisory authorities in accordance with applicable law.

10. Automated Decision-Making and AI Usage

10.1 No Solely-Automated Decisions

We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing (GDPR Art. 22). All consequential decisions are subject to human review.

10.2 AI Transparency Disclosures (EU AI Act Article 50, effective August 2, 2026)

The Service uses third-party AI systems to generate or transform content on your behalf. Consistent with the EU AI Act (Regulation (EU) 2024/1689) Article 50 transparency obligations applicable to "limited risk" AI systems:

• AI-generated images (hero photos and staged renderings produced via our AI image-generation sub-processors identified in Section 5) are labeled both in embedded metadata and with a visible "AI-generated visualization" label within the application and on export by default — including when a render is shared with or shown to a homeowner client. The label is designed to prevent a viewer from mistaking a render for a photograph of completed work. You may suppress the label only at your own risk and remain responsible for any disclosure required by applicable law (see Terms of Service §7.3).
• Bid-document extraction uses a large-language model (a Google-hosted large-language model). The extracted output is presented as AI-generated and labeled as such; you are responsible for reviewing it before relying on it.
• Content-moderation uses an automated classifier (Google Cloud Vision SafeSearch). If your upload is rejected, you may request human review by emailing support@clinchpro.com.
• No chatbot impersonation: When you interact with our support channels, we will tell you whether you are speaking with a human or an automated system.

10.3 Model Training on Customer Content

Clinch. We do not train any Clinch-owned machine-learning model on your identifiable Customer Content without your separate, opt-in consent. Aggregated, de-identified telemetry (e.g., counts of scans per device model, anonymized timing metrics) may be used to improve the Service.

Our AI sub-processors. Each AI sub-processor has its own data-handling commitments. As of the Effective Date of this Policy:

• Google (LLM API, paid tier) — Google's published terms state that, on the paid LLM API, prompts and responses are not used to improve Google's products. We use the paid tier exclusively for bid-document extraction.

• Google (Cloud Vision API) — under Google Cloud's Data Processing Addendum, Customer Data submitted to Vision is not used to train Google's models.

• Modal Labs — Modal's terms permit use of aggregated, de-identified data only; Modal does not train models on your inputs.

• OpenAI (image-generation API) — under OpenAI's API business terms, inputs and outputs you submit through the API are not used to train OpenAI's models. OpenAI is the AI sub-processor used for the hero-photo and staged-render image-editing features.

• Replicate, Inc. (AI image editing) — Replicate's standard, publicly posted Terms of Service grant Replicate certain rights with respect to inputs and outputs submitted through their platform, including a license that may be used to improve their services. We are not currently under an enterprise-tier agreement with Replicate that contractually restricts those default rights. As a result, when you use AI image-editing features on Customer-uploaded content, your submitted inputs are processed under Replicate's standard Terms of Service. We recommend that you do not use those features for any content you would not want processed under Replicate's standard terms. AI image editing is a feature-level choice — declining to use it does not affect your right to use the rest of the Service.

  Homeowner-uploaded photos — no Replicate processing without separate, explicit consent. Photos uploaded by a homeowner through a Customer-issued remote-capture link are not routed through Replicate without (i) a separate, explicit homeowner consent obtained at or before the capture step that names the AI sub-processor and its training-on-inputs posture, or (ii) the Service first migrating the homeowner image-editing path to an AI provider with contractually no-training terms (planned: Black Forest Labs / direct Flux API). Until one of those conditions is satisfied, the homeowner-facing "reimagine" preview is restricted to the on-Service color-recolor pipeline (a deterministic CIELAB color-replacement step that does not invoke any third-party generative model).

  We may, as our user base grows, evaluate moving to a Replicate enterprise tier or to an alternative AI image-editing provider; if and when that change occurs, this section and our sub-processor list will be updated and existing Customers will be notified under Section 16.

10.4 Open-Source ML Models and Weights

The Service incorporates pre-trained ML model weights distributed under permissive open-source licenses (predominantly Apache 2.0, MIT, BSD-2-Clause, and BSD-3-Clause) for tasks including image-feature extraction, semantic segmentation, monocular depth estimation, and 3D reconstruction. A complete inventory of model weights, their code and weights licenses, and their training-data lineage is maintained internally and is available to Business-tier and Enterprise-tier Customers upon written request to support@clinchpro.com. Model weights are evaluated against published license terms before deployment; weights with restrictive (non-commercial or share-alike) training-data inheritance are not shipped in production.

We will update this Section 10.3 promptly if any of the above arrangements changes. Material changes will be communicated under Section 16.

10.5 Aggregated Benchmarks and De-Identified Insights

The Service may compute and display aggregated, de-identified benchmarks (for example, typical markup ranges, average bid values, or win-rates by project type or geographic area) derived from Customer Content and usage across our Customer base. This processing relies on our legitimate interest (GDPR Art. 6(1)(f)) in providing competitive insights and improving the Service, and constitutes a "business purpose" — not a sale or share — under CCPA/CPRA. We apply the following safeguards:

• De-identification & k-anonymity floor. Benchmarks are computed only from de-identified, aggregated data. No benchmark is displayed unless it aggregates at least five (5) distinct Customers within the relevant segment, and we apply rounding, range-bucketing, and small-cell suppression to reduce re-identification risk. We do not disclose any Customer's raw figures to any other Customer.
• Opt-out. You may opt out of contributing to benchmark computation at any time, free of charge and with no effect on your access or service quality, via your Account settings or by emailing support@clinchpro.com (subject line BENCHMARK OPT-OUT). Opting out stops future contribution; already-computed, irreversible aggregates cannot be disaggregated.

11. Children

The Service is not intended for use by individuals under the age of 18, and we do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe we may have inadvertently collected personal data from a child (for example, a child appearing incidentally in a residential interior scan), please contact support@clinchpro.com and we will delete the information. Customers are responsible for not uploading scans or photographs that focus on or identify children.

12. Cookies and Similar Technologies (Web Application and Marketing Site)

We use cookies and similar technologies on app.clinchwin.com and clinchpro.com. Our marketing website (clinchpro.com) uses third-party advertising and analytics technologies — currently the Meta (Facebook) Pixel and Google Analytics — which set cookies and collect online identifiers and browsing activity. Their use constitutes "sharing" (and, under a conservative reading, may constitute a "sale") of personal information for cross-context behavioral advertising; see Sections 5.2 and 7.2 to opt out. Within the Clinch application (app.clinchwin.com), our only analytics tooling is first-party PostHog (configured with input-field masking, which does not sell or share data for advertising), and the application does not load third-party advertising trackers. The mobile application does not use browser cookies but does store local-storage data necessary for app function.

You may control cookies through your browser settings. Disabling strictly necessary cookies will prevent the Service from functioning.

Pre-launch posture (closed beta). During the closed-beta period (which is offered to United States-based contractors only — see Section 1 and Terms of Service §3.2), the Service does not present a separate cookie-consent banner. California residents (and residents of other states with universal opt-out rights) who wish to opt out of the "sharing"/"sale" of personal information for cross-context behavioral advertising described above may do so through our Do Not Sell or Share landing page at app.clinchwin.com/do-not-sell-share and by transmitting a Global Privacy Control (GPC) signal. We are deploying a consent-management tool on the marketing site that will automatically block the advertising technologies for opted-out or GPC-signaling visitors and present the required confirmation; until it ships, opt-outs are handled via the request page and browser/ad-platform controls. Before opening signup to visitors in jurisdictions where prior consent for non-essential cookies is required (the European Economic Area, the United Kingdom, and similar), we will additionally deploy a region-aware consent banner gating first-party analytics and session replay. Until those mechanisms ship, EEA/UK visitors are not the intended audience for the Service; if you believe you accessed the Service from such a jurisdiction and wish your data to be deleted, contact support@clinchpro.com.

13. Data Processing Agreement (DPA)

If you process personal data of EU, UK, Swiss, or California data subjects through the Service and require a formal Data Processing Agreement, our standard DPA template is published at app.clinchwin.com/dpa. The DPA incorporates the EU Standard Contractual Clauses Module 2 (Controller-to-Processor), the UK International Data Transfer Addendum, and CCPA / CPRA service-provider provisions, and lists the sub-processors in Section 5 above. To request an executed copy of the DPA countersigned by Clinch, email support@clinchpro.com with the subject line DPA - Execution request.

By accepting our Terms of Service, you also accept the DPA where it applies.

14. Marketing Communications and CAN-SPAM Compliance

We may send you marketing emails about Clinch products and features. Every commercial email we send complies with the U.S. CAN-SPAM Act (15 U.S.C. §§ 7701–7713), Canada's Anti-Spam Legislation (CASL) where applicable, and the EU ePrivacy Directive (2002/58/EC, as amended) where applicable. Specifically:

• Honest "From" line. Every commercial email is sent from a domain we own (@clinchpro.com) and clearly identifies "Clinch" or "Clinch Pros LLC" as the sender. We never use deceptive or third-party "From" addresses.
• Honest subject lines. Subject lines accurately reflect the content of the email. We do not use bait-and-switch subject lines, "Re:" or "Fwd:" prefixes for emails that are not actually replies/forwards, or other deceptive subject-line tactics.
• One-click unsubscribe. Every marketing email contains a visible, one-click "unsubscribe" link in the footer. Unsubscribe requests are honored within ten (10) business days (CAN-SPAM minimum is 10 business days; our internal target is 24 hours). After unsubscribing, you will continue to receive only transactional emails (receipts, password reset, security alerts, subscription renewal reminders, account-deletion confirmations), which are exempt from CAN-SPAM's unsubscribe requirement.
• Physical mailing address in every email. Every commercial email includes our physical postal address in the footer, as required by 15 U.S.C. § 7704(a)(5)(A): Clinch Pros LLC, 8 The Green, STE B, Dover, DE 19901, United States.
• No transfer of email lists. We do not sell, rent, lease, or otherwise transfer your email address or other contact information to any third party for that third party's own marketing purposes.

You may also opt out of marketing communications at any time by emailing support@clinchpro.com. Opting out of marketing does not affect transactional communications.

15. Third-Party Links and Services

The Service and marketing site may link to third-party websites or integrate with third-party services (e.g., Stripe checkout). This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated Policy at app.clinchwin.com/privacy with a new "Last Updated" date. For material changes (such as a new category of data collection or a new purpose of processing), we will provide at least thirty (30) days' advance notice by email to your Account address before the change takes effect. We maintain a changelog at the URL above.

If you do not agree to a material change, your remedy is to cancel your Subscription before the effective date.

17. Contact Us

Clinch Pros LLC 8 The Green, STE B Dover, DE 19901 United States Registered Agent: Northwest Registered Agent Service, Inc.

All inquiries — privacy requests, data-subject rights, security incident reports, legal notices, and general support — should be sent to support@clinchpro.com. To help us route your message promptly, please prefix your subject line with one of the following tags where applicable: PRIVACY, SECURITY, DMCA, LEGAL, or SUPPORT.

Geographic scope during closed beta. The Service is currently offered only to contractors and businesses based in the United States. We are not actively marketing to, or accepting signups from, data subjects in the European Economic Area, the United Kingdom, or Switzerland during the closed-beta period. Before opening the Service to EEA / UK / Swiss data subjects, we will appoint an in-region representative under GDPR Art. 27 / UK GDPR Art. 27 and publish the appointment here.

Supervisory authorities. EEA residents may lodge a complaint with their national data-protection authority. UK residents may complain to the Information Commissioner's Office (ICO). California residents may complain to the California Privacy Protection Agency (CPPA) at cppa.ca.gov.

Changelog

End of Privacy Policy.